This scenario is illustrative. The names, numbers and files are synthetic and describe how the workflow runs, not a real operation.
The situation
A state narcotics cell is tracking a cross-border syndicate that lands contraband at coastal jetties. A courier has been intercepted, but the organisers stay hidden behind rotating burner phones and false identity documents.
The investigating officer holds a mix of evidence: three seized handsets and the photos on them, four SIM cards registered under false names, highway toll receipts, and four months of call data records running to hundreds of thousands of lines.
The difficulty
- Rotating handsets. Phones are swapped weekly between drivers and warehouse staff.
- A second identity. The suspected organiser also operates as Kabir Sheikh, with separate hotel check-ins and social media accounts.
- Volume. No analyst can hand-correlate that many call records against hotel registers and toll receipts.
How the investigator works it in Anvexer
The officer opens a case on an air-gapped Anvexer workstation and uploads the material.
1. Call records parsed and clustered
Anvexer reads the call data records, sets aside routine traffic, and surfaces a tight group of eight numbers that talk to each other mainly in the 48 hours before suspected landings. It also flags two numbers that were used in the same handset.
2. Photo locations and the movement timeline
The photos from the courier's phone carry camera timestamps and GPS coordinates. Anvexer places them on the offline map in time order, and the vehicle's route over ten days appears, including a stop near an unmonitored jetty in the early hours, minutes before a short call to an overseas number.
3. Multi-attribute identity resolution
The hotel register for Kabir Sheikh and an FIR from an earlier case share a phone number, a date of birth and a home address. Anvexer weighs these attributes together, not the names, and proposes that the two records are the same man. Because the names differ, the match goes to the review screen, where the officer confirms it.
The result
Anvexer produces a 28-page dossier and a movement timeline for the investigating officer. It isolates the eight priority burner numbers and links the seized photo locations to the tower timestamps in the call records. Every link cites the call record, photo or document it came from, with its Admiralty rating.
What to do with it, whether to seek warrants, where and when, stays with the officer and their supervisors.