Ketan Agarwal Murder Case: Siya Goyal & Chetan Chaudhary Deleted Phone Data, But Cyber Experts Say It Can Be Fully Retrieved

Pune: As investigators continue to probe the alleged murder of Ketan Agarwal, digital evidence has become one of the most important aspects of the investigation. Police have sent deleted WhatsApp chats, Instagram conversations and other digital records from the accused's mobile phones to forensic experts in an effort to reconstruct their communication before and after the incident.

Investigators suspect the accused deleted chats and online activity around the time of the alleged crime near Lonavala. Sources said they also cleared the recycle bins on their devices to remove traces of the data. However, police believe deleted information can still be recovered through forensic examination.

‘Deleted Data Can Be Recovered’

Speaking to The Free Press Journal on the condition of anonymity, a cyber police expert based in the Pune district said mobile phones and other digital evidence are sent to the Regional Forensic Science Laboratory (RFSL) after a case is registered.

"We send the phone data, or anything recovered, to the RFSL. Only investigation agencies, including the police, can do this as part of a legal investigation after an FIR is registered. The findings can later be presented in court by the investigating officer, and they do stand," the expert said.

Criminals Believe Deleting Gets The Job Done…

The officer said criminals often believe deleting evidence will permanently erase it, but that is not always true.

"Many criminals think deleting key evidence will help them. But in many cases, the data is recoverable. It depends on the phone and storage, but deleted data can often be retrieved. We submit a request to forensic experts. Sometimes the results come within 10 days, while in other cases it may take a couple of months. Digital evidence has become extremely important, so cyber police regularly work with forensic laboratories," the expert added.

How Is This Possible?

According to digital forensic experts, investigators use specialised forensic tools to recover deleted information. One method is logical extraction, which copies accessible data such as contacts, messages, call logs, browser history and app databases. Even when chats or files are deleted, traces may still remain in the phone's databases or system files.

A more advanced technique is physical extraction. Instead of copying only visible files, experts create a complete copy of the phone's storage. This may reveal deleted messages, photos, location history, cached files and metadata if the data has not been overwritten.

Forensic analysts also use a process called file carving. When a file is deleted, only its reference is usually removed, while the actual data may remain until new information replaces it. By scanning the phone's storage, experts can sometimes reconstruct deleted files.

Recovery Is Not Guaranteed…

Deleted chats from apps such as WhatsApp may also leave behind local backups, notification logs, cached media, thumbnails or database remnants. If cloud backups exist, investigators may seek access through the legal process.

Even if the actual chats cannot be recovered, metadata can still provide valuable clues. It can reveal when a file was created, where it was captured, which device was used and when it was deleted. Such information often helps investigators build an accurate timeline.

However, recovery is not guaranteed. If deleted data has already been overwritten, the phone uses strong encryption, or the device has undergone a secure factory reset, recovering the information becomes much more difficult. However, it's completely possible, noted the cyber expert in Pune.

Even in such situations, investigators do not rely only on the mobile phone. They can also examine cloud backups, telecom call detail records, mobile tower locations, CCTV footage, financial transactions, GPS records and data from other connected devices to reconstruct events.

Why It Matters In The Ketan Agarwal Case

In the Ketan Agarwal case, police are also examining a meeting between the two main accused, Siya Goyal and Chetan Chaudhary. They met on 17th June, a day before Ketan's death. According to investigators, the two met at a café in Pune's Lulla Nagar and remained there for about an hour. Police are trying to determine whether the alleged murder conspiracy was discussed during that meeting.

The case, which was initially treated as an accidental fall at Lohagad Fort on 18th June, later turned into a murder investigation after police examined CCTV footage, mobile phone records and other technical evidence. According to investigators, the alleged conspiracy involved deleted chats, location records and digital communication between the accused. These findings are now undergoing forensic analysis as the investigation continues.

Police have maintained that the forensic examination is still underway and no final conclusions have been drawn. The alleged digital evidence, along with other material collected during the investigation, will ultimately be tested before the court during the trial.