E21 — Forensic Message Recovery

EVIDENCE REF: E21 · CASE CB-02

FORENSIC MESSAGE RECOVERY — DELETED THREAD

Source: Sameer Rane's iPhone 14 Pro · App: WhatsApp · Thread: Arjun Malhotra

Mumbai Police — Cyber Cell · Device Forensics · Report No. CC-2025-0214-0061 Device seized: 15 Feb 2025 · Analysis completed: 19 Feb 2025 · Examiner: Insp. R. Tamboli

Recovery Method

Sameer Rane's iPhone 14 Pro (IMEI: 356901102847631) was extracted using Cellebrite UFED 4PC under legal authority. The WhatsApp thread between Rane and Malhotra had been deleted from the application on 14 February 2025 at 20:58 — approximately 11 minutes after Aarav Singh reported finding the body. Deletion was of the "Delete for me" type (locally deleted; server copies may exist). The thread was partially recovered from device flash storage using file carving techniques. Messages marked [RECOVERED] were reconstructed from unallocated storage. Message content fidelity is assessed as high for complete recoveries; two partial fragments are noted separately.

RECOVERED THREAD — MALHOTRA, ARJUN ↔ RANE, SAMEER · 10–14 FEBRUARY 2025

💬 Arjun Malhotra

RECOVERED

Arjun Malhotra

Sameer — Joshi sent me the audit query. ₹12.67 lakhs to a vendor with no invoices, no PO, no delivery confirmation. I need an explanation before this gets to the board.

10 Feb 2025 · 17:04

RECOVERED

This is a services arrangement. I'm handling it. Tell Joshi to back off.

10 Feb 2025 · 17:31

RECOVERED

Arjun Malhotra

Services from whom? NK Film Projects isn't on our vendor list. It doesn't even appear to have a GST number. What services?

10 Feb 2025 · 17:45

RECOVERED

Post-production facilitation. I'll get you the documentation.

10 Feb 2025 · 18:02

— 4 messages deleted, not recovered —

RECOVERED — PARTIAL

Arjun Malhotra

...I checked MCA. NK Film Projects LLP was incorporated 3 January. The same week the first payment went out. Sameer, this is embezzlement. You routed production money through your own company...

12 Feb 2025 · 14:18

RECOVERED

You don't know what you're talking about. Don't use that word.

12 Feb 2025 · 14:44

RECOVERED

Arjun Malhotra

My lawyer is filing a formal complaint Monday. If you return the full amount before wrap I'll ask him to hold it. Otherwise it goes to the board and the investor group. Your choice.

12 Feb 2025 · 15:01

RECOVERED

Don't do anything stupid. Let me talk to you properly. After wrap. Trailer 7, 19:50. Come alone.

12 Feb 2025 · 15:22

RECOVERED

Arjun Malhotra

Fine. But my lawyer already has a draft. This doesn't go away just because we talk.

12 Feb 2025 · 15:30

— 2 messages deleted, not recovered —

RECOVERED

The party starts at 9. Be there at ten to eight. Don't mention this to anyone.

14 Feb 2025 · 12:41

The message at 12 Feb 2025, 15:22 — "Trailer 7, 19:50. Come alone." — is the meeting Sameer Rane proposed to Arjun Malhotra two days before the murder. Arjun's planner (Vault A) records "NK confirmed 8 PM, T7" — consistent with a revised meeting time communicated via the NK Film Projects number (see E05 and E16). The thread was deleted from Rane's device at 20:58 on 14 February 2025 — while Rane was ostensibly in the Main Production Office (badge R-PROD-01 scan at 20:41:58).

Device Deletion Log

Thread deletion event recorded in device system log at 20:58:14, 14 February 2025. Deletion action performed by device owner (Face ID authenticated at 20:57:52 — 22 seconds before deletion). The deletion occurred approximately 10 minutes after production assistant Aarav Singh's emergency call to security at 20:47:41.