Investigators working to piece together the final movements of Dr Umar Un Nabi – the alleged “suicide bomber” in last Monday’s deadly explosion outside Delhi’s Red Fort – have zeroed in on one element they now consider the most crucial in establishing his final moments: the digital footprint left behind by two mobile phones he was last seen carrying.
The phones, which he was seen using in CCTV footage from a medical shop in Haryana just days before the attack, have become the focal point in the probe into the shocking case. If traced, according to officials privy to the investigation, the devices could reveal the identities of the men who directed him, funded him – and whether the Red Fort blast was part of a larger plan.
At least five mobile numbers linked to him, spread across Delhi, Faridabad and Mewat, have been flagged. But the last two phones, the ones he used between October 30 and November 10, remain missing – and investigators say they are the “single biggest missing piece” in the conspiracy puzzle.
Over the past week, investigators from the National Investigation Agency (NIA), Delhi Police Special Cell, and Jammu & Kashmir Police have worked to build a minute-by-minute reconstruction of Nabi’s final 36 hours. His movements – from Faridabad to Nuh to Delhi – are being plotted against tower dumps, CCTV timelines, encrypted chat logs and witness testimonies.
Officials said that the initial investigation has revealed that his two primary numbers were deactivated on October 30 – the same day his close associate, Dr Muzammil Shakeel Ganaie, was apprehended. The timing, investigators said, is not a coincidence. It suggests that when Nabi learnt that agencies had cracked down on this apparent “white-collar” terror module, he abandoned all traceable phones and switched to two new prepaid numbers acquired using fake identities.
The strongest early clue came from a CCTV camera in Dhauj market, barely 800 metres from Al-Falah University, where Nabi worked and lived. The footage, timestamped October 30, shows him sitting inside a medical store with a black bag and two phones. He hands one to the shopowner for charging while keeping the other in his hand. Investigators said that the simultaneous use of two phones indicates that one was used for routine communication, while the other was reserved exclusively for handlers and operational messaging.
Since then, investigators have traced more than 65 CCTV clips mapping his route through Khalilpur and Rewasan toll plazas, into Faridabad, and eventually Delhi. What has struck them is that in every confirmed sighting after November 9 evening – including at Turkman Gate’s Faiz Elahi Mosque, where he arrived at 2.30pm on November 10, and the Red Fort parking lot where he remained for over three hours before the blast – the phones are never visible.
Investigators involved in the probe said that they suspect Nabi either handed the phones to someone ahead of the blast, or disposed of them.
Inside Faiz Elahi Mosque, where he spent 15 minutes after removing his mask and walking in alone, staff members told police that they didn’t see him interact with anyone or leave anything behind. But investigators said that gaps in the data appeared suspicious. “The absence of data is itself a kind of evidence,” a senior officer said. “Something happened inside those 15 minutes.”
Because of the suspicion of a handoff, investigators have also prepared a list of all people who visited the mosque on November 10, especially around the time Nabi was there. They are verifying their antecedents and questioning those they have identified to determine if any of them were the accomplice who received the phones.
From the mosque, Nabi drove straight to Red Fort’s Sunehri Masjid parking lot where his Hyundai i20 was parked in a zone not covered by cameras.
Officers say the movements of at least two unidentified devices – IMEIs that appear in tower dumps from both Nuh and Turkman Gate – are now emerging as key leads. One of these devices moved in near-parallel to Nabi’s route on November 9 and 10.
What is also becoming clear, one of the investigators cited above said, is that Nabi routinely switched SIM cards, relied heavily on encrypted apps such as Signal, Briar, and Element, and communicated with coded terms – “delivery,” “testing,” “shipment” – retrieved from Muzammil’s seized phone. Investigators say his methods were inconsistent with the profile of a lone radical; they reflect the habits of someone trained to leave as little metadata as possible. “These two phones,” an officer said, “will tell us everything — if they still exist.”
Following the reconstruction of Nabi’s trail, police have intensified ground operations across Faridabad, Nuh, Ballabgarh, and bordering pockets of Gurugram. Teams from NIA and Delhi Police have raided mosques, rented rooms, coaching centres, eateries and medical stores linked to Nabi’s route. Patrol units have been instructed to monitor new tenants and check identity papers in localities known for frequent movement of migrant workers and students.
ATM trail from Nuh
Another breakthrough came from Ferozepur Jhirka in Nuh district, where CCTV footage captured Nabi withdrawing cash from an HDFC Bank ATM around 1.07am on November 10 – 17 hours before the blast. He arrived in the same white Hyundai i20 later used in the explosion, appearing tense and hurried, according to the ATM guard.
Mohar Singh, the guard on duty, told investigators Nabi claimed there was a medical emergency in his family and insisted on checking the ATM himself when told there was no cash. He then convinced Singh to accompany him to another ATM, where he withdrew around ₹76,000 in two instalments, tipping the guard ₹1,000 before dropping him back. Singh described seeing items “covered in bedsheet material” in the rear seat, and recalled that Nabi was impatient, anxious, and driving erratically.
Investigators believe the cash withdrawal was the final step before Umar executed the attack. “The money could have been used to purchase additional materials or pay contacts assisting him. Every minute of his movement that day is now under review,” said a senior officer.
Ammunition mystery
Adding another layer to the investigation, forensic teams recovered three cartridges – two live rounds and one empty 9mm shell – from near the Red Fort blast site, according to Delhi Police officers assisting NIA in the probe. The ammunition type, they said, is typically used by security personnel or those with special permissions. This, they said, has raised new questions because no firearm fragments were found at the scene and none of the victims belonged to security forces.
Investigators have not established a direct link between Nabi and the bullets, but they have not ruled out the possibility that he carried them during his journey from Faridabad to Delhi. Officers are now examining whether Nabi was in possession of a weapon he discarded before reaching Red Fort. “This adds a new dimension,” a senior official said. “We are looking at whether there was a second actor, or whether these were part of something Nabi planned but never executed.”
