Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Forensic reports commissioned by defense lawyers concluded that incriminating files were remotely placed on computers belonging to Bhima Koregaon accused Rona Wilson and Surendra Gadling before police seized them. A 2022 Wired investigation reported a connection between the wider hacking campaign and a Pune police official involved in the case. Those findings raise grave questions about the digital evidence, but they do not by themselves establish that Pune Police as an institution—or that official personally—ordered or carried out the planting.
The short answer: Arsenal Consulting reported signs that Wilson’s and Gadling’s devices had been compromised and that files later cited by prosecutors were delivered remotely. Wired, drawing on Arsenal’s work and cybersecurity analysis by SentinelOne, reported a link between the hacking operation and a Pune police official closely involved in the investigation. A technical or account connection is not the same as proof of who operated the malware, who directed the operation, or whether an institution authorized it. The sources cited here do not establish a final judicial finding that Pune Police planted evidence.
What is the Bhima Koregaon case?
The case followed violence around the January 1, 2018 commemoration at Bhima Koregaon in Maharashtra. Pune Police arrested activists, lawyers, academics and others, alleging links to the banned Communist Party of India (Maoist) and a conspiracy against the government. The accused denied the allegations. Electronic documents recovered from some accused people’s devices became an important part of the prosecution’s case. The investigation was later transferred from Pune Police to the National Investigation Agency (NIA); that transfer, on its own, does not prove wrongdoing by either agency.
The dispute is not simply about whether files appeared on computers. It is about whether the people who owned those devices created or knowingly possessed the files, whether the devices were accessed remotely, and what the forensic record can establish about the people behind any intrusion.
#1 Best Overall
What Arsenal reported about Rona Wilson’s computer
Arsenal Consulting, a Massachusetts digital-forensics firm retained by defense lawyers, examined a forensic copy of Wilson’s computer. Its reported findings described a compromise lasting about 22 months, beginning in 2016 and continuing until police seized the device on April 17, 2018. The firm attributed the intrusion to an attacker using remote-access malware associated with NetWire. The Washington Post’s February 2021 account reported Arsenal’s conclusion that at least 10 incriminating letters had been placed on the laptop. A later analysis reportedly identified more than 30 suspicious or planted documents in total.
Arsenal’s interpretation was that these files were delivered remotely, rather than created or used through ordinary hands-on activity by the computer’s user. The reported delivery mechanism involved malicious emails or links that appeared to lead to legitimate document-sharing material. If opened, such a link could install or activate remote-access software, enabling an attacker to monitor the system and transfer files onto it.
NetWire’s presence does not identify the operator. Remote-access malware can show a method of intrusion; attribution to a person or organization requires other evidence, such as infrastructure, account records, targeting, timing and corroboration.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the later report said about Surendra Gadling
Arsenal’s subsequent analysis concerned a computer or hard drive associated with lawyer and accused Surendra Gadling. Reporting on the analysis said that 14 files cited in the prosecution’s charge sheet had been planted, and that the device showed links to the same or related attacker infrastructure as Wilson’s computer. The Washington Post’s July 2021 report covered the findings. If accurate, common infrastructure would support the view that the two intrusions were connected, rather than isolated incidents; it still would not establish who directed them.
These findings were reported by a firm engaged by the defense. That is relevant context for readers assessing the evidentiary record, but it neither proves bias nor settles whether the technical conclusions are correct. The methods, source images, hash values, device handling and any competing expert analysis matter to that assessment.
What Wired added—and what “linked” means
In June 2022, Wired published an investigation of a broader hacking campaign that it called “ModifiedElephant,” drawing in part on SentinelOne’s analysis. The reporting described targeting of activists, journalists, academics and lawyers, and overlaps between campaign infrastructure and intrusions affecting Bhima Koregaon accused. Wired’s investigation reported that a recovery email used for attacker-controlled accounts contained the full name of a Pune police official closely involved in the Bhima Koregaon investigation. It characterized this as a provable connection between people involved in the hacking operation and people involved in the arrests. Wired reported that Pune Police and the official did not respond to its requests for comment.
That account connection is significant, but it should not be inflated into a claim that the official was proven to be the hacker or that police as an institution ordered the planting. The kinds of evidence involved form a ladder:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Forensic observations: traces of malware, files, timestamps and system activity.
- Expert interpretation: Arsenal’s conclusion that particular files were remotely planted.
- Campaign analysis: SentinelOne’s and Wired’s reported links among intrusions and infrastructure.
- Personnel connection: the reported recovery-email link involving a police official.
- Responsibility: proof of who operated the accounts, directed the operation, or acted with institutional authority.
- Legal outcome: a court’s assessment of admissibility, reliability and the effect on the prosecution.
Evidence at one level does not automatically prove the next. In particular, a recovery-email name may be an important lead, but by itself it does not show who controlled an account at the relevant time or who instructed an attacker. Nor does the absence of a response to a journalist’s inquiry amount to an admission.
Best Value
Timeline of the reported findings
- January 1, 2018: Violence occurred around the Bhima Koregaon commemoration.
- April 17, 2018: Police seized Wilson’s computer, according to reporting on the forensic findings.
- February 10, 2021: The Washington Post reported Arsenal’s initial findings on Wilson’s laptop.
- April 20, 2021: The Washington Post reported a later analysis identifying additional documents.
- July 2021: Reporting described Arsenal’s findings concerning Gadling’s device.
- June 2022: Wired published its investigation of the wider hacking campaign and the reported link to a Pune police official.
The reports establish a sequence of allegations and technical findings, not a verdict. This article does not assert a current 2026 ruling or custody status: the sources cited above do not establish the case’s later procedural developments. Any claim about a court’s treatment of the reports, an official inquiry, or the present status of the accused needs confirmation from current court records or official statements.
What the findings could mean for the prosecution
If files were put on a device remotely before seizure, their presence there would not alone prove that its owner wrote, knowingly possessed or accessed them. A compromise can complicate assumptions about authorship, possession, timestamps and user activity. It can also put the reliability of particular digital evidence and the account of how it came to be on a device in issue.
That does not automatically dispose of every charge. A court would need to consider the specific files, the forensic image and its integrity, seizure and handling records, examination logs, expert methods, and any prosecution response or independent analysis. It would also need to assess whether other evidence supports the allegations independently. Challenging files is not the same as proving the entire case false, just as finding files on a seized device is not proof that the accused created them.
The key questions include whether the original devices or complete forensic images were available for independent examination; whether hash values and chain-of-custody records are reliable; whether the prosecution obtained a competing forensic review; whether any accused user opened or modified the disputed files; and whether a court has evaluated the reports. The coverage cited here does not resolve all of those questions.
What is reported, alleged and unresolved
- Reported forensic conclusion: Arsenal said Wilson’s and Gadling’s devices showed evidence of remote compromise and that specified incriminating files were planted.
- Reported campaign link: Wired and SentinelOne connected aspects of the broader hacking operation to infrastructure associated with attacks on the accused.
- Reported personnel connection: Wired said an attacker-account recovery email contained the full name of a Pune police official involved in the investigation.
- Not established by those findings alone: who personally controlled the accounts, who ordered the planting, whether the official or police institution authorized it, and whether a court has accepted the reports as conclusive.
For the underlying reporting, see Wired, The Washington Post on Wilson, and The Washington Post on Gadling. The technical reports were prepared for the defense, and their conclusions should be distinguished from judicial findings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
