Skip to content
DigitalForenSeek home

Paytm Forensics

Offline, read-only parser and analysis GUI for data acquired from the Paytm Android app, with per-record provenance, carving and a hash-chained audit log.

  • Version v0.1.0
  • Android
  • Mobile

Paytm Forensics (PaytmForensics) is an offline, read-only parser and analysis GUI for the Paytm Android app (net.one97.paytm). Point it at an already-acquired app data folder and it decodes about 20 SQLite databases, encrypted stores, WebView data and preferences into one chronological case with per-record provenance, then provides a desktop interface, a self-contained report and exports.

Paytm Forensics dashboard for a demo case: record counts, the subject's profile and linked bank accounts, a financial summary with top counterparties, and recent activity.
The dashboard. Every screenshot shows fabricated demonstration data; no real device, person or account appears. View full size: Paytm Forensics dashboard for a demo case: record counts, the subject's profile and linked bank accounts, a financial summary with top counterparties, and recent activity.

What it does

Section titled “What it does”
  • Transactions. The full UPI ledger from the passbook, plus payments evidenced only in chat, de-duplicated so nothing is counted twice, with NPCI RRN and UPI VPA cross-checked between ledger and chat.
  • Chat reconstruction from the Sendbird tables: conversations, participants and payment details per message, including conversations whose messages are gone.
  • Location history from signal databases and WebView cookies, with KML and GeoJSON export.
  • Everything else on disk: contacts, consents, background jobs, notifications, searches, app configuration, diagnostics, WebView storage, cart and crash sessions (39 parsers across 21 record domains).
  • Encrypted stores catalogued, not guessed. Hardware-keystore-protected stores are listed with their cipher, key alias and why they cannot be decrypted.
  • Entity resolution merges phone numbers, VPAs, customer IDs and chat IDs into one counterparty, normalising names so variants of one business are one party.
  • Master timeline of every timestamped record, in the same order in the GUI, report and CSV.
  • Deleted-record carving across every database and write-ahead log, de-duplicated against live values and labelled with a confidence.
  • Hide sensitive data: one toggle masks personal and bank identifiers across the interface and exports for screen sharing, without changing the case.
Transactions grid with a filter bar and a provenance panel showing the selected record's source file, table, row ID and hash, with sensitive data masked.
Transactions with sensitive data hidden. The panel on the right shows the selected record's provenance. View full size: Transactions grid with a filter bar and a provenance panel showing the selected record's source file, table, row ID and hash, with sensitive data masked.
Chat view listing demo conversations and a reconstructed thread of payment messages with amounts, status and RRN.
Chats reconstructed from the Sendbird tables. The app's own wording is quoted as app text, never presented as the tool's conclusion. View full size: Chat view listing demo conversations and a reconstructed thread of payment messages with amounts, status and RRN.

Evidence integrity

Section titled “Evidence integrity”
  • Databases without a write-ahead log are opened read-only and immutable; databases with a populated -wal are read from a verified scratch copy, so recent uncheckpointed rows are not silently lost.
  • SHA-256 and MD5 of every input at ingest; --verify re-hashes afterwards and checks nothing changed.
  • A hash-chained audit log that a third party can verify with --verify-audit.
  • Every record carries its source file, table, row ID or byte offset, live or carved origin, confidence and read mode.
  • Same input and version produce byte-identical JSON exports.

Requirements

Section titled “Requirements”
Item Requirement
Python 3.10 or newer
Parsing and carving Standard library only
GUI PySide6 (PySide6-Addons for the interactive map and PDF export)
Report Jinja2
Optional WeasyPrint (PDF), protobuf (analytics decoding), plyvel (WebView LevelDB on Linux and macOS) 
python tools/make_demo_case.py /tmp/ptmf-demopython run_gui.py /tmp/ptmf-demo/case

Next steps

Section titled “Next steps”

Source and license

Section titled “Source and license”

Source code, the methodology and the audit findings are on GitHub. The author is not affiliated with Paytm or One97 Communications.