Kunal Gupta
Senior Partner – Forensic Investigation, Data Analytics & Risk Consulting
Lawyer · Company Secretary · Certified Fraud Examiner · 12+ years
Digital Forensics
Digital Forensics & E-Discovery Reviews
Defensible preservation, recovery and review of digital evidence across devices, mailboxes, chat and logs, turned into an evidence trail that stands up before regulators and courts.
What we establish
- Who did what, and when, from metadata, system and access logs
- Whether files were wiped, backdated or tampered with, and by whom
- Where the real conversation lived: WhatsApp, Signal, Telegram and ephemeral messaging
- What the ERP, core banking system and ledgers say about money flows across entities, devices and people
- Which documents matter, and which are privileged, across large mailboxes and shared drives
- Whether a disputed agreement, invoice or board minute was altered or created after the fact
Most white-collar evidence today is digital, contested and easy to lose. Our in-house digital-forensics practice preserves it defensibly, recovers what others cannot, and turns terabytes of devices, mailboxes and logs into an evidence trail that stands up before regulators and courts. It is the engine under every investigation and crisis response we run, and structured document review runs on our AI-native eDiscovery platform, with certificates under Section 63 of the Bharatiya Sakshya Adhiniyam.
How we do it
Our method
- 1
Preserve
Sound acquisition of laptops, servers, phones and removable media, hash-verified and court-defensible, under chain of custody.
- 2
Collect
Microsoft 365, Google Workspace and SaaS collection; endpoint and server-log forensics; collection aligned with the DPDP Act and GDPR.
- 3
Recover
Wiped files, deleted chats and mobile and ephemeral-messaging extraction. Reconstructing activity and exposing spoliation, backdating and tampering.
- 4
Analyse
Metadata, system and access logs assembled into a defensible who-did-what-when timeline; ERP, CBS and ledger analytics; link analysis across entities, devices and money flows.
- 5
Review
Large-scale mailbox and document review with de-duplication, keyword, concept and privilege tagging.
- 6
Report and transfer
Findings and certificates in a form counsel can annex, with lawful cross-border transfer of the review set to counsel where required.
Deliverables
- Hash-verified forensic images under documented chain of custody
- Defensible who-did-what-when timeline
- Recovered data and findings on spoliation, backdating and tampering
- Reviewed, de-duplicated document set with keyword, concept and privilege tagging
- Certificates under Section 63 of the Bharatiya Sakshya Adhiniyam
- Transaction and link-analysis outputs across entities, devices and money flows
Eight capabilities
- 01
Forensic imaging & chain of custody
Sound acquisition of laptops, servers, phones and removable media, hash-verified and court-defensible.
- 02
Email & e-discovery
Large-scale mailbox and document review with de-duplication, keyword, concept and privilege tagging.
- 03
Mobile & chat recovery
WhatsApp, Signal, Telegram and ephemeral-messaging extraction, often where the real conversation lives.
- 04
Deleted-data & artefact recovery
Recovering wiped files, reconstructing activity, exposing spoliation, backdating and evidence tampering.
- 05
Metadata & timeline analysis
Metadata, system and access logs assembled into a defensible who-did-what-when timeline.
- 06
Transaction & data analytics
ERP, CBS and ledger analytics; link analysis across entities, devices and money flows.
- 07
Cloud & endpoint collection
Microsoft 365, Google Workspace and SaaS collection; endpoint and server-log forensics.
- 08
Privacy-compliant, cross-border
Collection aligned with the DPDP Act and GDPR, and lawful cross-border transfer to counsel.
Where digital forensics plugs in
- Under every internal investigation and enforcement response: covert imaging of mailboxes, shared drives and, with consent and DPDP safeguards, personal devices.
- Disputes and arbitration: document authenticity and forgery review of agreements, signatures, invoices, board minutes and electronic records, including creation dates, alterations and back-dating.
- Capital markets: reconstruction of trading patterns, UPSI flows and communications from devices and mailboxes to support PIT compliance reviews, internal enquiries and responses to SEBI investigations.
- Insolvency: digital forensics on company systems and email review to build the evidentiary basis for Section 66 fraudulent and wrongful trading applications.
The technology behind it
- A digital forensics engine for email discovery, metadata mapping and device-level analysis.
- AI-powered monitoring to detect anomalies in transactions, behaviours and interactions.
- An integrated platform unifying data sources, third-party intelligence and investigative workflows.
- Strict adherence to global data privacy frameworks (GDPR, DPDP) for secure processing end to end.
Also in Investigations
- Internal InvestigationsCounsel-led fact-finding with forensic execution. Findings that hold up before boards, audit committees, auditors and regulators.
- Crisis Management & Regulatory ResponseA written crisis protocol, role-specific preparation and a rehearsed first-72-hours response, so every function knows what is expected of it when a regulator arrives unannounced or an enforcement action begins.
- Market IntelligenceDiscreet market, vendor and competitor enquiry through pretext outreach, discreet calls and on-ground checks. Understanding the market as it really is: priced, positioned and behaving.
- OSINT & Desktop ProfilingDeep open-source research and digital-footprint analysis to profile entities and individuals remotely and at scale. A complete picture, built entirely from open, lawful sources.
- Asset TracingLocating and mapping hidden, undisclosed or dissipated assets across property, banking and corporate structures, and building the trail to recover them.
- Skip TracingLocating absconding individuals, from debtors and guarantors to fraudsters, and confirming their whereabouts on the ground.
How an engagement starts
Tell us what you can’t see.
Every engagement starts with a confidential conversation. No matter is too early, or too sensitive, to raise. A partner replies within one working day.
- 01
A 30-minute call
To align on the question, the team and the sites involved.
- 02
A fixed-scope proposal
A tailored scope and fee note within five working days.
- 03
Discreet execution
Small senior teams, conflict-checked, DPDP and GDPR compliant handling.