Red Fort Blast in Delhi: Forensic and Digital Evidence Reveal Attack Details

On 10 November 2025 at approximately 18:52 IST, a white Hyundai i20 car detonated near the Gate 1 area of the Red Fort metro station in Old Delhi, killing at least 12 people and injuring over 20 others in the initial official count.

Forensic teams from the capital’s laboratory collected over 40 samples from the blast site, which included two spent cartridges and two distinct types of explosive residues. Preliminary chemical analysis identified one residue as ammonium‐nitrate based; the second residue is reported to be “more potent” though unidentified publicly.

Distinct observations were made: despite the high intensity, there was an absence of typical external wiring debris, electronic detonator remains or a conventional crater, which suggests a highly engineered device or alternative ignition mechanism. The tremor from the blast reached the underground metro station adjacent to the site, indicating the blast’s high yield.

Investigators are now focusing on the supply chain of the material used. According to sources, the plotters had procured large quantities of fertiliser and other precursor chemicals—such as NPK fertiliser—from the NCR region, which are commonly used in improvised explosive devices when processed.

A strong link has been drawn between the blast car and earlier seizures in Faridabad—where security agencies uncovered approximately 2,900 kg of explosive materials, detonators and gel sticks in properties linked to the same terror module. The use of ammonium-nitrate mixtures, possibly combined with more energetic compounds like RDX, is now the working hypothesis.

DNA profiling played a key role in identifying the driver of the blast car. Human remains found in the driver’s seat area of the i20 were matched to the mother and brother of Dr Umar Un Nabi through samples submitted to the All India Institute of Medical Sciences (AIIMS) forensic lab. Investigators found one of Umar’s legs trapped between the steering wheel and accelerator of the car, cementing the conclusion that he was the driver at the time of detonation.

Digital forensics uncovered multiple communication channels used by the terror module: secure message-app groups on platforms such as Signal and encrypted drafts on email, used to coordinate procurement of precursor chemicals, vehicle movement and surveillance of target locations. CCTV footage traced the Hyundai i20 entering Delhi from the Badarpur toll at around 8:04 a.m. on the day of the blast after it had transited through NCR earlier that morning.

The forensic results and digital trail suggest that the explosion was not a spontaneous vehicle accident but a pre-planned, high-yield device engineered for maximum impact in a high-security urban space.

tracing the origin of the more potent explosive residue, its import, manufacture or local synthesis

mapping the full network of individuals involved—both in logistics and technical support

examining the vehicle’s ownership trail (the Hyundai had changed hands several times) and rental history

reviewing protocols around fertiliser and precursor sales in the NCR

analysing how the device evaded detection in a high-surveillance zone

The unfolding investigation underscores a worrying trend: a terror module integrating educated professionals, high-end communication encryption, and large-scale explosive manufacturing—all aimed at striking within the national capital’s heritage heart. With forensic and digital evidence increasingly aligning, authorities are steering the probe toward dismantling the broader network before further attacks can be carried out.