Pakistan has constantly accused India being involved in terror attacks in its territory. On April 29, Lt Gen Ahmed Sharif Chaudhry, Director General of Inter-Services Public Relations ( DG ISPR) of Pakistan, held a press conference and publicly alleged Indian involvement in terror attacks.
This was further reiterated by Pakistan's Deputy Prime Minister and Foreign Minister, Ishaq Dar on April 30 when he invited independent experts to analyse and verify the claims.
Digital Lab Voyager Infosec partnered with ISPRMonitor to undertake a comprehensive digital investigation to forensically assess “irrefutable evidence” presented after Dar's call.
The investigation suggests that the claims are baseless and fictional. "What we found was not proof—but a staggering array of forgery, fabrication, and invented stories. From doctored screenshots to timeline anomalies, the entire narrative collapses under scrutiny, revealing an alarming degree of forgery, technical incompetence, and propaganda engineering by Pakistan’s military PR apparatus," reads the investigation report.
Forensics or Farce?
A key in any digital forensics is the use of cloned, non-active devices to preserve the integrity of data. ISPR’s entire “forensic investigation” was conducted on a live, active phone with dual SIMs, which is recklessness in basic forensic standards and should have disqualified the entire exercise, the report states.
Fabrication, Not Investigation
The report further says notes that a screenshot from an alleged terrorist's seized phone claims to have the alleged handler 'online', even after the phone was supposedly in custody of Pakistani authorities.
"In One of the slides presented by DG ISPR as “forensically obtained” WhatsApp evidence includes this screenshot allegedly taken from the seized mobile phone of a captured terrorist. The alleged handler “Shaknder” is shown as online—even though the phone was supposedly in the custody of Pakistani authorities and under forensic examination," the report says.
It further says that if the device was seized and undergoing digital forensics, the phone should have been in airplane mode or isolated from all networks to preserve data integrity and WhatsApp status updates (like “online”) require an active internet connection, which is not possible in a controlled forensic environment.
"The active, real-time interface implies either: The phone was never actually seized Or this screenshot was staged on a live phone—possibly a spoofed chat or a planted setup and Skander was not terror Handler but another con-artist from ISPR’s team who forgot to switch off his mobile during ISPR’s forensics forgery Either way, this is not digital forensics. It’s evidence of post-facto forge narrative engineering, not a legitimate investigation," the report decodes.
Phantom Calls from the Past?
Furthermore, the report says that DG ISPR showcased “recordings” of WhatsApp calls from over a year ago, which it calls is impossible unless the terrorist had installed call-recording malware himself (highly unlikely given his profile), or ISI planted spyware at the start, which means, the report claims, they knew in advance about terror attacks and chose not to prevent them.
Screenshot Sorcery
The report says that DG ISPR presented WhatsApp chat screenshots where the timestamp of the screenshot align within minutes of the messages, despite the suspect being arrested long after the dates in question.
"Is Pakistan claiming the terrorist was screenshotting all his crimes in real time just in case ISPR needed a press kit later?" asks Digital Lab Voyager Infosec.
This reveals that the evidence is absurd and the level of desperation and amateurish photo editing involved, says the rebuttal.
Drone: Chinese by make, Indian by blame
The report then makes a reverse search of a drone image that was claimed to be recovered from the terrorist's house. The search engine identifies the drone as a DJI model, which is made in China.
Money Trail or Money Tale?
ISPR had claimed that the Indian handler was cautious, sending only small sums of PKR 10,000 to avoid ISI surveillance. However, the ISPR then claims that he transferred PKR 1,95,000 in a single transaction to the alleged terrorist account.
Digital Lab Voyager Infosec found out that the “money received” screenshots show notifications captured just one minute after the transfers occurred despite the phone having been seized and forensically analyzed six months later.
ISPR had also claimed that long financial trails with multiple accounts were later contradicted by presenting only one payment trail .
"This is not a money trail—it’s a money tale. A fabricated narrative reverse-engineered from fake transaction records and conveniently timestamped screenshots. The only thing being transferred here is credibility—from ISPR to global ridicule," the investigation report reads.
IED lessons in Hindi, accent in Pakistani Punjabi
The report further reveals that the alleged Indian operator switches between Punjabi and Hindi, exposing inconsistencies in identity and accent. Voice analysis confirms the same person did not record both segments.
Missing Evidence, Invented Identities
ISPR claims they have the names of serving Indian Army officers but fails to provide a single Indian phone number any call metadata, ISP logs or contact trail proving communication with India, the investigation reveals.
Psy-War in Decline: From Doctrine to Farce
The report further suggests that even the press conference was a failed attempt. "The staged theatrics, emphasis on “Baluchistan,” saffron cloth-wrapped IEDs, and selective media screenshots (all from ARY News) point to a disinformation strategy riddled with amateur errors."
From calibri to conspiracy: A pattern of forgery
Taking a dig at Dar, the report suggests it is not his first brush with creative document production. "As a senior leader of the PML-N, a party with an established history of forgery, Dar was part of the same political cabal that authored one of the most embarrassing frauds in recent South Asian history: the Calibri font scandal," Digital Lab Voyager Infosec says.
Similarly, in 2017, Nawaz Sharif, then Prime Minister and current PML-N supremo, was disqualified from office after presenting documents dated 2006 that were typed in Microsoft Calibri, a font not publicly released until 2007.
A narrative planned in advance: ISPR’s “time machine” screenshot
ISPR had claimed that Indian agencies had launched a coordinated social media campaign to “cover up” the detection of a drone and IED by Pakistani forces by presenting a screenshot of a tweet allegedly part of this Indian narrative.
However, the screenshot clearly shows the tweet was taken just 58 minutes after it was posted, and the original tweet itself was dated March 19.
"ISPR presented a screenshot of a tweet posted on March 19 — and that screenshot was captured just 58 minutes after the tweet was published. But the person they later accused was arrested on April 25, and as their phone was seized and forensically examined not earlier," the investigation mentions.
The report questions as to why was ISPR taking screenshots of tweets 1.5 months before the arrest, and keeping them ready, unless they were manufacturing a story in advance?
It further asks why was a screenshot of a tweet, dated March 19, and captured within an hour of its posting would be taken and kept in ISPR propaganda lab, to substantiate an alleged terror evidence recovered from a phone that wasn't even in state custody until over a month later?
It accuses ISPR of evidence planting and not a forensic trail. "The timeline betrayal in the screenshot exposes a sinister truth: ISPR was fabricating this story for weeks, if not months, preparing doctored “evidence” in advance to publicly frame India."
Conclusion
“ISPR didn’t uncover a conspiracy. They staged and rehearsed one," says Digital Lab Voyager Infosec.
It claims that ISPR pre-fabricated propaganda, assembled weeks in advance to build a false case.
"ISPR didn’t recover evidence. They staged it. This press conference by DG ISPR marks a new low in Pakistan’s long history of information warfare. Not only was the so-called evidence riddled with technical, logical, and narrative flaws, it revealed an intelligence establishment out of sync with operational reality and global scrutiny."
The report accuses ISPR of propaganda for producing "fabricated screenshots, fake audio, inconsistent messaging, and laughable theatrics do not amount to evidence."
This was further reiterated by Pakistan's Deputy Prime Minister and Foreign Minister, Ishaq Dar on April 30 when he invited independent experts to analyse and verify the claims.
Digital Lab Voyager Infosec partnered with ISPRMonitor to undertake a comprehensive digital investigation to forensically assess “irrefutable evidence” presented after Dar's call.
The investigation suggests that the claims are baseless and fictional. "What we found was not proof—but a staggering array of forgery, fabrication, and invented stories. From doctored screenshots to timeline anomalies, the entire narrative collapses under scrutiny, revealing an alarming degree of forgery, technical incompetence, and propaganda engineering by Pakistan’s military PR apparatus," reads the investigation report.
Forensics or Farce?
A key in any digital forensics is the use of cloned, non-active devices to preserve the integrity of data. ISPR’s entire “forensic investigation” was conducted on a live, active phone with dual SIMs, which is recklessness in basic forensic standards and should have disqualified the entire exercise, the report states.
Fabrication, Not Investigation
The report further says notes that a screenshot from an alleged terrorist's seized phone claims to have the alleged handler 'online', even after the phone was supposedly in custody of Pakistani authorities.
"In One of the slides presented by DG ISPR as “forensically obtained” WhatsApp evidence includes this screenshot allegedly taken from the seized mobile phone of a captured terrorist. The alleged handler “Shaknder” is shown as online—even though the phone was supposedly in the custody of Pakistani authorities and under forensic examination," the report says.
It further says that if the device was seized and undergoing digital forensics, the phone should have been in airplane mode or isolated from all networks to preserve data integrity and WhatsApp status updates (like “online”) require an active internet connection, which is not possible in a controlled forensic environment.
"The active, real-time interface implies either: The phone was never actually seized Or this screenshot was staged on a live phone—possibly a spoofed chat or a planted setup and Skander was not terror Handler but another con-artist from ISPR’s team who forgot to switch off his mobile during ISPR’s forensics forgery Either way, this is not digital forensics. It’s evidence of post-facto forge narrative engineering, not a legitimate investigation," the report decodes.
Phantom Calls from the Past?
Furthermore, the report says that DG ISPR showcased “recordings” of WhatsApp calls from over a year ago, which it calls is impossible unless the terrorist had installed call-recording malware himself (highly unlikely given his profile), or ISI planted spyware at the start, which means, the report claims, they knew in advance about terror attacks and chose not to prevent them.
Screenshot Sorcery
The report says that DG ISPR presented WhatsApp chat screenshots where the timestamp of the screenshot align within minutes of the messages, despite the suspect being arrested long after the dates in question.
"Is Pakistan claiming the terrorist was screenshotting all his crimes in real time just in case ISPR needed a press kit later?" asks Digital Lab Voyager Infosec.
This reveals that the evidence is absurd and the level of desperation and amateurish photo editing involved, says the rebuttal.
Drone: Chinese by make, Indian by blame
The report then makes a reverse search of a drone image that was claimed to be recovered from the terrorist's house. The search engine identifies the drone as a DJI model, which is made in China.
Money Trail or Money Tale?
ISPR had claimed that the Indian handler was cautious, sending only small sums of PKR 10,000 to avoid ISI surveillance. However, the ISPR then claims that he transferred PKR 1,95,000 in a single transaction to the alleged terrorist account.
Digital Lab Voyager Infosec found out that the “money received” screenshots show notifications captured just one minute after the transfers occurred despite the phone having been seized and forensically analyzed six months later.
ISPR had also claimed that long financial trails with multiple accounts were later contradicted by presenting only one payment trail .
"This is not a money trail—it’s a money tale. A fabricated narrative reverse-engineered from fake transaction records and conveniently timestamped screenshots. The only thing being transferred here is credibility—from ISPR to global ridicule," the investigation report reads.
IED lessons in Hindi, accent in Pakistani Punjabi
The report further reveals that the alleged Indian operator switches between Punjabi and Hindi, exposing inconsistencies in identity and accent. Voice analysis confirms the same person did not record both segments.
Missing Evidence, Invented Identities
ISPR claims they have the names of serving Indian Army officers but fails to provide a single Indian phone number any call metadata, ISP logs or contact trail proving communication with India, the investigation reveals.
Psy-War in Decline: From Doctrine to Farce
The report further suggests that even the press conference was a failed attempt. "The staged theatrics, emphasis on “Baluchistan,” saffron cloth-wrapped IEDs, and selective media screenshots (all from ARY News) point to a disinformation strategy riddled with amateur errors."
From calibri to conspiracy: A pattern of forgery
Taking a dig at Dar, the report suggests it is not his first brush with creative document production. "As a senior leader of the PML-N, a party with an established history of forgery, Dar was part of the same political cabal that authored one of the most embarrassing frauds in recent South Asian history: the Calibri font scandal," Digital Lab Voyager Infosec says.
Similarly, in 2017, Nawaz Sharif, then Prime Minister and current PML-N supremo, was disqualified from office after presenting documents dated 2006 that were typed in Microsoft Calibri, a font not publicly released until 2007.
A narrative planned in advance: ISPR’s “time machine” screenshot
ISPR had claimed that Indian agencies had launched a coordinated social media campaign to “cover up” the detection of a drone and IED by Pakistani forces by presenting a screenshot of a tweet allegedly part of this Indian narrative.
However, the screenshot clearly shows the tweet was taken just 58 minutes after it was posted, and the original tweet itself was dated March 19.
"ISPR presented a screenshot of a tweet posted on March 19 — and that screenshot was captured just 58 minutes after the tweet was published. But the person they later accused was arrested on April 25, and as their phone was seized and forensically examined not earlier," the investigation mentions.
The report questions as to why was ISPR taking screenshots of tweets 1.5 months before the arrest, and keeping them ready, unless they were manufacturing a story in advance?
It further asks why was a screenshot of a tweet, dated March 19, and captured within an hour of its posting would be taken and kept in ISPR propaganda lab, to substantiate an alleged terror evidence recovered from a phone that wasn't even in state custody until over a month later?
It accuses ISPR of evidence planting and not a forensic trail. "The timeline betrayal in the screenshot exposes a sinister truth: ISPR was fabricating this story for weeks, if not months, preparing doctored “evidence” in advance to publicly frame India."
Conclusion
“ISPR didn’t uncover a conspiracy. They staged and rehearsed one," says Digital Lab Voyager Infosec.
It claims that ISPR pre-fabricated propaganda, assembled weeks in advance to build a false case.
"ISPR didn’t recover evidence. They staged it. This press conference by DG ISPR marks a new low in Pakistan’s long history of information warfare. Not only was the so-called evidence riddled with technical, logical, and narrative flaws, it revealed an intelligence establishment out of sync with operational reality and global scrutiny."
The report accuses ISPR of propaganda for producing "fabricated screenshots, fake audio, inconsistent messaging, and laughable theatrics do not amount to evidence."
You may also like
India suspends Bilawal Bhutto Zardari, Imran Khan's X accounts amid rising tensions with Pakistan
'I tried Gtech's best-selling £40 patio heater and was surprised at how much warmth it creates'
Lando Norris injured and 'upset' with George Russell after Miami GP incident
Echoes of 1971 as Ferozepur Cantt goes dark in 30-minute drill
'Big talk, no action': Cong's neta stirs row with toy Rafale
