Lahorie
FULL MEMBER
- Joined
- Oct 26, 2011
- Messages
- 501
- Reaction score
- 0
- Country
- Location
IN DEPTH: Indian Plane Shot Down Over Pakistan in February - by DFRLab
What we know about the MiG-21 shootdown in Pakistan on February 27, 2019
@DFRLab
May 1
(Source: @michael1sheldon/DFRLab via @PDCMDOfficial/archive, @waseem_swaty/archive, @jf17pakistan, @Iyervval/archive, clockwise, left to right; Google Earth, background)
On February 27, 2019, Pakistan shot down an Indian Air Force (IAF) MiG-21 Bison fighter aircraft. Both sides made differing claims about what transpired that day. The shootdown occurred during an engagement following a Pakistani strike on Indian territory, which was in response to the February 26 Indian airstrike on Pakistani territory.
One story claimed that the IAF downed a Pakistani F-16, while Pakistan claimed that it shot down two IAF aircraft. Some outlets claimed that they were two MiG-21s, and others that they were one MiG-21 and one Su-30MKI. Media from either country refuted the other’s claims. As a result of the Pakistani shootdown of the IAF aircraft, Pakistan captured and subsequently returned the downed plane’s pilot, wing commander Abhinandan Varthaman.
On April 8, 2019, the IAF doubled down on its assertions that Abhinandan shot down an F-16. While the IAF presented some circumstantial evidence — in the form of unverified radar images of an F-16 dropping off radar — to support that claim, it was insufficient to conclude the claim to be substantiated. Open-source evidence collected via social media points to a single IAF MiG-21.
The Wreckage — The First Impact Zone
Two main impact areas, one approximately 1.5 kilometers northeast of the second, were observed for the single MiG-21 shot down on February 27. The first impact zone included the fuselage of the aircraft, mostly in one piece, and the second mostly comprised the tail assembly of an aircraft scattered over a wider area.
Overview of the crash area. (Source: @michael1sheldon/DFRLab via Google Earth)
In a March 4 article, Bellingcat identified the location of impact zone one, finding it to be between the two towns of Horan and Kotla. A video released on March 1 provided detailed footage from this crash site. Beyond the largely intact fuselage, which landed about 1,500 meters from impact zone two — which spread across the village of Sandar — a number of smaller objects at this site drew attention, given Indian claims about the incident. It is not entirely clear how the two crash sites ended up being so far from each other.
Video showing the first impact zone in detail. (Source: Media Talk)
The objects of interest, more specifically, were the remains of four separate missiles. Indian media claimed that Wing Commander Abhinandan fired off an R-73 infrared homing missile at a Pakistani Air Force F-16, shooting it down before he himself was struck by a second PAF jet. For this, the possible make-up of the armament for a MiG is of particular interest.
A MiG-21 has four pylons that hold missiles, two on each wing, and which are frequently loaded with two Russia-made missiles, the R-77 and the R-73. The R-77 is widely considered a counterpart to the U.S. AIM-120 AMRAAM, which the Pakistani F-16s would have been carrying. The R-73, a comparatively lighter missile to the R-77, is generally situated on the outer pylons, compared to its heavier counterparts, which are typically placed on the inner pylons, as shown in the image below. The R-77 missile was retroactively made compatible with later MiG-21 variants such as the MiG-21–93 and Bison, and thus would have been present on the downed aircraft.
Sample image showing a MiG-21 Bison with R-73 and R-77. (Source: Archive)
In surveying impact zone one, the DFRLab found the remnants of two R-77 missiles and two R-73s. The first identified missile was an R-77 on the left side of the fuselage. This fragment made up just less than half of the missile, comprising most of its forward portion. This would prove commonplace among the rest of the missile remains.
In comparing the missile fragment to a showroom model of an R-77, the DFRLab noticed several consistencies (in white rectangles) and identified a positive match for the forward section of this missile, marked red in the diagram at bottom left. (Source: Media Talk, top left; Оружие Отечества/archive, bottom left and right)
The second missile fragment was also from the forward portion of an R-77 and roughly half the size of the previous fragment. Matching markings and structural characteristics with a showroom model again revealed that this fragment also belonged to an R-77, albeit a separate missile than the one previously observed.
Comparing the second missile fragment to an R-77. The red highlighted section of the diagram at bottom left is the same section as those shown in the images at top left and right. (Source: Media Talk, top left; Оружие Отечества/archive, bottom left and right)
This second fragment reappeared in a tweet on March 17, in which it appeared with a second missile allegedly from the crash site. The tweet, and several others like it, claimed the image showed two R-73s. This was not accurate, however. The tweet, embedded below, showed a single R-73 in the rear of the photo and a single R-77 at the front. The R-77 — and, more importantly, the damage to it — closely resembled the second fragment shown above.
Tweet showing two air-to-air missiles, R-73 and R-77. (Source:@KhanAmerKhan/archive)
The other missile, the R-73, in the tweet did not appear in any open-source imagery prior to the March 17 post. This would account for one of two R-73s attached to the MiG shot down.
The forwardmost part — more specifically, the seeker module — of a second R-73 was documented in another photo of the wreckage, though it was not clear if it had been relocated to that position or if it had landed there after the missile struck the aircraft. Because the damage to the R-73 in the photo differed from that of the R-73 in the tweet, the DFRLab concluded that they were separate missiles.
Graphic depicting where on a R-73 the forward section is located. (Source: History of PIA — Forum/archive, top; militaryrussia/archive, bottom)
As pointed out in a graphic posted by Twitter user @0threshold, attached to the left wing was the engine section of an R-73, still mounted to its launch unit. This may have been from the same missile as the R-73 fragment above, or it could have been from a second R-73.
Comparison of the wreckage with R-73 engine section and launch unit. (Source: Media Talk, left; militaryrussia/archive, right and bottom)
This would make all four missiles accounted for — the two images of separate R-77 fragments, one of which was also apparent in the tweet; a third missile, an R-73, also shown in the tweet; and this final fragment of a second R-73. This means that the downed MiG-21 could not possibly have shot down an F-16, provided that the R-73 presented in the tweet was actually attached to the plane and not falsely introduced into the body of evidence.
The Wreckage — The Second Impact Zone
To identify whether one or two MiG-21s were shot down, the DFRLab identified every fragment recorded and found that they all likely belonged to a single aircraft. These findings are detailed below.
One of the largest intact pieces recorded at the second impact zone was a fuel tank, or “drop tank,” likely originating from a MiG-21. The drop tank was pictured in front of a distinctive three-story building in the village of Sandar. It was unclear whether the tank had landed in this spot, as the ground appeared undamaged, though it did appear to have taken significant damage as result of impact with the ground.
Geolocation of the drop tank. The white dashed line indicates a dirt road, while the numbers identify different floors of the building. (Source: Google Earth, left; @PDCMDOfficial/archive, right)
Reports from India and international media stated that one of the pictures was of the wreckage of an F‑16 that fell in Pakistan territory. Open-source examination by Bellingcat, however, suggested the wreckage is of the outer covering of MiG-21. Specifically, this part appears to be from the lower part of a MiG-21 tail assembly.
Two separate sightings of this part have been made, once in a photo where it lay in a puddle of water in an elevated position and once in a video where it was dragged along the ground. This piece appears to be the lower rear part of a MiG-21.
Locating where pieces of the wreckage belonged on the MiG-21. Each numbered sections of the images at left indicate a vertical rivet line, while the dashed line at right represents the ventral fin. (Source:@PDCMDOfficial/archive, background; @JF17Thunder, foreground)
Analysis of the debris shows that it likely detached from a larger fragment of the aircraft’s empennage, which included part of the vertical stabilizer and right elevator — used to house the rudder and controlling the plane’s pitch, respectively — of a MiG-21. In counting the rivets on the unpainted MiG-21, the number of vertical rivet lines in the wreckage matched those in a MiG-21 reference photo. Further inspection of the video footage showed a protrusion from the main bulk, which closely matched the lower vertical stabilizer for a MiG-21, further suggesting that this part came from the rear of the aircraft.
The video footage from Facebook showed this fragment being dragged along the ground, so it was unclear whether this fragment landed somewhere near the drop tank, though it was spotted in nearly the same location.
Geolocating the lower empennage part. The white box denotes the protrusion of the second floor of a building, while the white dashes denote the shrubbery outline. (Source: @JF17Thunder, left; Google Earth, right)
Comparing the building in the video footage to the one in satellite imagery, it seemed that the stone wall in the right side of the camera’s field of view was the same one that the drop tank was leaning up against.
Another image also surfaced, showing the above wreckage with a partial vertical stabilizer, partial engine, and right elevator from a MiG-21.
Comparing the multiple angles available of this site to satellite imagery, the DFRLab determined that the rear section landed outside a building in the eastern section of Sandar. Two perspectives were selected to illustrate this point; one looking westward down the mountain and toward the village center and one looking eastward toward the adjacent building.
Geolocation of the first perspective, with numerals identifying two separate buildings. (Source: Google Earth, right; @PDCMDOfficial/archive, left)
The first perspective included a number of key details to assist in this geolocation. First, there were two buildings with flat roofs down a steep incline and partially obscured by trees. There was a dirt road leading toward these buildings from behind the photographer.
Geolocation of the second perspective. The numbers indicate different parts of a single building complex. (Source: Google Earth, left; @khalid_pk/archive), right)
The second perspective, looking eastward, showed a building with three separate protrusions. These three protrusions were visible in satellite imagery, along with two trees at the entrance to the building. A panorama stitched together from three separate images of the scene revealed more details matching the satellite imagery. Note that the different locations of the photographers created the false impression that there are two pieces of wreckage and two roads.
Panorama of the main empennage crash area. (Source: @DFRLab via @PDCMDOfficial/archive, left; @theairwar/archive, center; @khalid_pk/archive, right)
In the northern section of the village, a left elevator was found. While left and right elevators are highly similar, this elevator had an upward facing circular set of rivets, which would be downward facing when attached to a MiG-21. Because of the orientation of this piece of wreckage, it was clear that this was the underside of a left elevator, complementing the right elevator still attached to the larger piece of wreckage.
Comparison of MiG-21 elevators. (Source: The Horse Stable Channel, left; @waseem_swaty/archive, right)
Other angles of this piece of wreckage revealed a three-story building with characteristically orange roofing in the background. This building was surrounded by a wall and was visibly adjacent to at least one building.
Multiple angles of the three-story building, including another image of the left elevator (at right). Source:@khalid_pk/archive,left; @waseem_swaty/ archive, right)
Comparing this building against satellite imagery of the general crash area, it appeared that the left elevator had landed approximately 400 meters north of where the external fuel tank was photographed and approximately 500 meters northwest of where the main piece of empennage appeared to have landed. Twitter user @obretix reached similar conclusions about the geolocations of these fragments.
Comparing imagery from the crash site with a compound in the northern portion of Sandar. (Source: Google Earth, left; @khalid_pk/archive, right)
Another piece of wreckage, seemingly from the left side of the tail fin, or “vertical stabilizer,” was documented at this same location. It was clear that this was the left side due to the positioning of the lettering in relation to a green-painted panel at the top of the vertical stabilizer. In this image, the lettering was closest to the green panel in the number section. As the image below shows, the letters “CU” should be directly below the green panel on the right side.
Wreckage image matches aircraft tail — the sample image shows the right side of a vertical stabilizer, while the wreckage at right is of the opposite side of the vertical stabilizer, thus the writing appears reversed as it relates to the flag. (Source: Kashmir Obsever/archive, left; @khalid_pkarchive, right)
Looking at the orange box highlighted in the above image shows that the part says CU-2328, matching IAF MiG-21 Bison marking conventions, as well as documents captured from Wing Commander Varthinan.
Conclusion:
Many unanswered questions remain about the MiG shootdown during the February 27 skirmish. There was no evidence to suggest that either a PAF F-16, an IAF Su-30MKI, or more than one IAF MiG-21 were downed in this incident. All documented debris available in the open-source environment appeared to have originated from a single MiG-21 bison that broke up mid-air and landed in two adjacent impact zones.
The fact that the aircraft was struck at the rear coupled with the dispersion of the wreckage in a northeasterly direction suggests that the MiG was struck from behind at a point where it was moving toward the Indian border. It is still unclear what aircraft shot down the MiG-21, and it is possible that conclusive evidence on this question will never be released.
Since all R-73 missiles were accounted for, the claims that the wing commander fired a missile before his aircraft was struck seem highly unlikely. The only way that an R-73 could have been fired during this engagement would be if the evidence presented in the March 17 tweet was fabricated, which the DFRLab could not confirm.
Michael Sheldon is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Kanishk Karan is a Digital Forensic Research Associate at the @DFRLab.
What we know about the MiG-21 shootdown in Pakistan on February 27, 2019
@DFRLabMay 1
(Source: @michael1sheldon/DFRLab via @PDCMDOfficial/archive, @waseem_swaty/archive, @jf17pakistan, @Iyervval/archive, clockwise, left to right; Google Earth, background)
On February 27, 2019, Pakistan shot down an Indian Air Force (IAF) MiG-21 Bison fighter aircraft. Both sides made differing claims about what transpired that day. The shootdown occurred during an engagement following a Pakistani strike on Indian territory, which was in response to the February 26 Indian airstrike on Pakistani territory.
One story claimed that the IAF downed a Pakistani F-16, while Pakistan claimed that it shot down two IAF aircraft. Some outlets claimed that they were two MiG-21s, and others that they were one MiG-21 and one Su-30MKI. Media from either country refuted the other’s claims. As a result of the Pakistani shootdown of the IAF aircraft, Pakistan captured and subsequently returned the downed plane’s pilot, wing commander Abhinandan Varthaman.
On April 8, 2019, the IAF doubled down on its assertions that Abhinandan shot down an F-16. While the IAF presented some circumstantial evidence — in the form of unverified radar images of an F-16 dropping off radar — to support that claim, it was insufficient to conclude the claim to be substantiated. Open-source evidence collected via social media points to a single IAF MiG-21.
The Wreckage — The First Impact Zone
Two main impact areas, one approximately 1.5 kilometers northeast of the second, were observed for the single MiG-21 shot down on February 27. The first impact zone included the fuselage of the aircraft, mostly in one piece, and the second mostly comprised the tail assembly of an aircraft scattered over a wider area.
Overview of the crash area. (Source: @michael1sheldon/DFRLab via Google Earth)
In a March 4 article, Bellingcat identified the location of impact zone one, finding it to be between the two towns of Horan and Kotla. A video released on March 1 provided detailed footage from this crash site. Beyond the largely intact fuselage, which landed about 1,500 meters from impact zone two — which spread across the village of Sandar — a number of smaller objects at this site drew attention, given Indian claims about the incident. It is not entirely clear how the two crash sites ended up being so far from each other.
The objects of interest, more specifically, were the remains of four separate missiles. Indian media claimed that Wing Commander Abhinandan fired off an R-73 infrared homing missile at a Pakistani Air Force F-16, shooting it down before he himself was struck by a second PAF jet. For this, the possible make-up of the armament for a MiG is of particular interest.
A MiG-21 has four pylons that hold missiles, two on each wing, and which are frequently loaded with two Russia-made missiles, the R-77 and the R-73. The R-77 is widely considered a counterpart to the U.S. AIM-120 AMRAAM, which the Pakistani F-16s would have been carrying. The R-73, a comparatively lighter missile to the R-77, is generally situated on the outer pylons, compared to its heavier counterparts, which are typically placed on the inner pylons, as shown in the image below. The R-77 missile was retroactively made compatible with later MiG-21 variants such as the MiG-21–93 and Bison, and thus would have been present on the downed aircraft.
Sample image showing a MiG-21 Bison with R-73 and R-77. (Source: Archive)
In surveying impact zone one, the DFRLab found the remnants of two R-77 missiles and two R-73s. The first identified missile was an R-77 on the left side of the fuselage. This fragment made up just less than half of the missile, comprising most of its forward portion. This would prove commonplace among the rest of the missile remains.
In comparing the missile fragment to a showroom model of an R-77, the DFRLab noticed several consistencies (in white rectangles) and identified a positive match for the forward section of this missile, marked red in the diagram at bottom left. (Source: Media Talk, top left; Оружие Отечества/archive, bottom left and right)
The second missile fragment was also from the forward portion of an R-77 and roughly half the size of the previous fragment. Matching markings and structural characteristics with a showroom model again revealed that this fragment also belonged to an R-77, albeit a separate missile than the one previously observed.
Comparing the second missile fragment to an R-77. The red highlighted section of the diagram at bottom left is the same section as those shown in the images at top left and right. (Source: Media Talk, top left; Оружие Отечества/archive, bottom left and right)
This second fragment reappeared in a tweet on March 17, in which it appeared with a second missile allegedly from the crash site. The tweet, and several others like it, claimed the image showed two R-73s. This was not accurate, however. The tweet, embedded below, showed a single R-73 in the rear of the photo and a single R-77 at the front. The R-77 — and, more importantly, the damage to it — closely resembled the second fragment shown above.
Tweet showing two air-to-air missiles, R-73 and R-77. (Source:@KhanAmerKhan/archive)
The other missile, the R-73, in the tweet did not appear in any open-source imagery prior to the March 17 post. This would account for one of two R-73s attached to the MiG shot down.
The forwardmost part — more specifically, the seeker module — of a second R-73 was documented in another photo of the wreckage, though it was not clear if it had been relocated to that position or if it had landed there after the missile struck the aircraft. Because the damage to the R-73 in the photo differed from that of the R-73 in the tweet, the DFRLab concluded that they were separate missiles.
Graphic depicting where on a R-73 the forward section is located. (Source: History of PIA — Forum/archive, top; militaryrussia/archive, bottom)
As pointed out in a graphic posted by Twitter user @0threshold, attached to the left wing was the engine section of an R-73, still mounted to its launch unit. This may have been from the same missile as the R-73 fragment above, or it could have been from a second R-73.
Comparison of the wreckage with R-73 engine section and launch unit. (Source: Media Talk, left; militaryrussia/archive, right and bottom)
This would make all four missiles accounted for — the two images of separate R-77 fragments, one of which was also apparent in the tweet; a third missile, an R-73, also shown in the tweet; and this final fragment of a second R-73. This means that the downed MiG-21 could not possibly have shot down an F-16, provided that the R-73 presented in the tweet was actually attached to the plane and not falsely introduced into the body of evidence.
The Wreckage — The Second Impact Zone
To identify whether one or two MiG-21s were shot down, the DFRLab identified every fragment recorded and found that they all likely belonged to a single aircraft. These findings are detailed below.
One of the largest intact pieces recorded at the second impact zone was a fuel tank, or “drop tank,” likely originating from a MiG-21. The drop tank was pictured in front of a distinctive three-story building in the village of Sandar. It was unclear whether the tank had landed in this spot, as the ground appeared undamaged, though it did appear to have taken significant damage as result of impact with the ground.
Geolocation of the drop tank. The white dashed line indicates a dirt road, while the numbers identify different floors of the building. (Source: Google Earth, left; @PDCMDOfficial/archive, right)
Reports from India and international media stated that one of the pictures was of the wreckage of an F‑16 that fell in Pakistan territory. Open-source examination by Bellingcat, however, suggested the wreckage is of the outer covering of MiG-21. Specifically, this part appears to be from the lower part of a MiG-21 tail assembly.
Two separate sightings of this part have been made, once in a photo where it lay in a puddle of water in an elevated position and once in a video where it was dragged along the ground. This piece appears to be the lower rear part of a MiG-21.
Locating where pieces of the wreckage belonged on the MiG-21. Each numbered sections of the images at left indicate a vertical rivet line, while the dashed line at right represents the ventral fin. (Source:@PDCMDOfficial/archive, background; @JF17Thunder, foreground)
Analysis of the debris shows that it likely detached from a larger fragment of the aircraft’s empennage, which included part of the vertical stabilizer and right elevator — used to house the rudder and controlling the plane’s pitch, respectively — of a MiG-21. In counting the rivets on the unpainted MiG-21, the number of vertical rivet lines in the wreckage matched those in a MiG-21 reference photo. Further inspection of the video footage showed a protrusion from the main bulk, which closely matched the lower vertical stabilizer for a MiG-21, further suggesting that this part came from the rear of the aircraft.
The video footage from Facebook showed this fragment being dragged along the ground, so it was unclear whether this fragment landed somewhere near the drop tank, though it was spotted in nearly the same location.
Geolocating the lower empennage part. The white box denotes the protrusion of the second floor of a building, while the white dashes denote the shrubbery outline. (Source: @JF17Thunder, left; Google Earth, right)
Comparing the building in the video footage to the one in satellite imagery, it seemed that the stone wall in the right side of the camera’s field of view was the same one that the drop tank was leaning up against.
Another image also surfaced, showing the above wreckage with a partial vertical stabilizer, partial engine, and right elevator from a MiG-21.
Comparing the multiple angles available of this site to satellite imagery, the DFRLab determined that the rear section landed outside a building in the eastern section of Sandar. Two perspectives were selected to illustrate this point; one looking westward down the mountain and toward the village center and one looking eastward toward the adjacent building.
Geolocation of the first perspective, with numerals identifying two separate buildings. (Source: Google Earth, right; @PDCMDOfficial/archive, left)
The first perspective included a number of key details to assist in this geolocation. First, there were two buildings with flat roofs down a steep incline and partially obscured by trees. There was a dirt road leading toward these buildings from behind the photographer.
Geolocation of the second perspective. The numbers indicate different parts of a single building complex. (Source: Google Earth, left; @khalid_pk/archive), right)
The second perspective, looking eastward, showed a building with three separate protrusions. These three protrusions were visible in satellite imagery, along with two trees at the entrance to the building. A panorama stitched together from three separate images of the scene revealed more details matching the satellite imagery. Note that the different locations of the photographers created the false impression that there are two pieces of wreckage and two roads.
Panorama of the main empennage crash area. (Source: @DFRLab via @PDCMDOfficial/archive, left; @theairwar/archive, center; @khalid_pk/archive, right)
In the northern section of the village, a left elevator was found. While left and right elevators are highly similar, this elevator had an upward facing circular set of rivets, which would be downward facing when attached to a MiG-21. Because of the orientation of this piece of wreckage, it was clear that this was the underside of a left elevator, complementing the right elevator still attached to the larger piece of wreckage.
Comparison of MiG-21 elevators. (Source: The Horse Stable Channel, left; @waseem_swaty/archive, right)
Other angles of this piece of wreckage revealed a three-story building with characteristically orange roofing in the background. This building was surrounded by a wall and was visibly adjacent to at least one building.
Multiple angles of the three-story building, including another image of the left elevator (at right). Source:@khalid_pk/archive,left; @waseem_swaty/ archive, right)
Comparing this building against satellite imagery of the general crash area, it appeared that the left elevator had landed approximately 400 meters north of where the external fuel tank was photographed and approximately 500 meters northwest of where the main piece of empennage appeared to have landed. Twitter user @obretix reached similar conclusions about the geolocations of these fragments.
Comparing imagery from the crash site with a compound in the northern portion of Sandar. (Source: Google Earth, left; @khalid_pk/archive, right)
Another piece of wreckage, seemingly from the left side of the tail fin, or “vertical stabilizer,” was documented at this same location. It was clear that this was the left side due to the positioning of the lettering in relation to a green-painted panel at the top of the vertical stabilizer. In this image, the lettering was closest to the green panel in the number section. As the image below shows, the letters “CU” should be directly below the green panel on the right side.
Wreckage image matches aircraft tail — the sample image shows the right side of a vertical stabilizer, while the wreckage at right is of the opposite side of the vertical stabilizer, thus the writing appears reversed as it relates to the flag. (Source: Kashmir Obsever/archive, left; @khalid_pkarchive, right)
Looking at the orange box highlighted in the above image shows that the part says CU-2328, matching IAF MiG-21 Bison marking conventions, as well as documents captured from Wing Commander Varthinan.
Conclusion:
Many unanswered questions remain about the MiG shootdown during the February 27 skirmish. There was no evidence to suggest that either a PAF F-16, an IAF Su-30MKI, or more than one IAF MiG-21 were downed in this incident. All documented debris available in the open-source environment appeared to have originated from a single MiG-21 bison that broke up mid-air and landed in two adjacent impact zones.
The fact that the aircraft was struck at the rear coupled with the dispersion of the wreckage in a northeasterly direction suggests that the MiG was struck from behind at a point where it was moving toward the Indian border. It is still unclear what aircraft shot down the MiG-21, and it is possible that conclusive evidence on this question will never be released.
Since all R-73 missiles were accounted for, the claims that the wing commander fired a missile before his aircraft was struck seem highly unlikely. The only way that an R-73 could have been fired during this engagement would be if the evidence presented in the March 17 tweet was fabricated, which the DFRLab could not confirm.
Michael Sheldon is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Kanishk Karan is a Digital Forensic Research Associate at the @DFRLab.
