New Delhi | The Central Bureau of Investigation (CBI) has filed a supplementary chargesheet in the NEET-UG 2026 paper leak case before a special court in Delhi, adding a Nanded-based individual to the list of accused. The filing reportedly includes forensic experts’ findings and marks the conclusion of the agency’s investigation into the alleged leak, according to Hindustan Times.
The additional accused, Sheshrav Bajrang Suryawanshi, also known as Raj Suryawanshi, was arrested on 2 September 2026. With his inclusion, the number of individuals named in the CBI’s chargesheets has risen to 14.
Digital Forensics in the Paper Leak Investigation
Digital forensic examination has played a significant role in the investigation. According to reports on the CBI’s findings, forensic imaging of mobile devices helped investigators recover deleted WhatsApp conversations and PDF documents allegedly containing leaked examination questions.
Forensic imaging involves creating a bit-by-bit copy of digital storage, where technically feasible, to facilitate examination while preserving the original device and its contents. Investigators can analyse recovered messages, electronic documents, timestamps and other artefacts to reconstruct communication patterns and examine the possible circulation of confidential examination material.
However, recovering a message or document does not automatically establish who created, transmitted or received it, or whether the person concerned knowingly participated in an offence. Such conclusions require corroboration through contextual analysis, attribution evidence and other admissible material.
The supplementary chargesheet reportedly incorporates findings from forensic experts. The precise scope and conclusions of those findings should be assessed from the relevant investigative and court records.
CBI Names Nanded Resident as 14th Accused
According to the CBI’s allegations, Suryawanshi was closely associated with co-accused Shubham Khairnar, who was allegedly involved in distributing leaked examination papers to candidates.
Investigators allege that Suryawanshi asked candidates to assemble at a location in Nanded, Maharashtra, where they were provided with the question paper. The agency has further alleged that he retained candidates’ original educational certificates and identity documents to ensure payment after the examination.
These claims form part of the prosecution’s case and have not been established as proven facts merely by the filing of the chargesheet.
The CBI had earlier named 13 individuals in its initial chargesheet filed on 28 July 2026. Those named reportedly included subject experts associated with the National Testing Agency (NTA), intermediaries and coaching-centre representatives. According to the reporting, neither the initial nor the supplementary chargesheet named a government official.
Background: Cancellation of NEET-UG 2026
The National Testing Agency cancelled the NEET-UG 2026 examination on 12 May after allegations emerged that questions in a circulated guess paper overlapped with those in the examination conducted on 3 May.
The overlap reportedly involved at least 120 questions, prompting scrutiny of the circumstances in which the examination material had circulated. The cancellation triggered protests and a wider investigation into the alleged leak.
A re-examination was subsequently conducted on 21 June 2026.
The investigation has examined the alleged roles of intermediaries, individuals associated with coaching centres and others suspected of facilitating the circulation of examination questions.
Forensic Significance: From Data Recovery to Evidentiary Reliability
The case highlights several important issues in digital forensic investigations:
1. Recovery of deleted data: Deleted messages and electronic documents may provide investigative leads, but their recovery must be documented and their integrity assessed.
2. Attribution of digital activity: Investigators must establish the relationship between a device, a user and the relevant communications rather than assuming that ownership of a device proves authorship of every item found on it.
3. Timeline reconstruction: Timestamps, message sequences, file metadata and other digital artefacts may assist in reconstructing the movement of information, subject to technical limitations and validation.
4. Preservation and chain of custody: Proper seizure documentation, forensic acquisition, hashing where appropriate, secure storage and a documented chain of custody help establish whether digital evidence has remained reliable throughout the investigation.
5. Judicial assessment: Expert findings must be evaluated alongside the underlying data, the methodology used, corroborating evidence and the applicable rules of admissibility and evidentiary weight.
These principles are particularly relevant in cases involving examination fraud, where the alleged movement of confidential material may occur through messaging applications and electronic files.
What the Case Means for Examination Security
The NEET-UG 2026 investigation underscores the importance of combining preventive examination-security measures with effective digital forensic capabilities. Secure handling of question papers, controlled access, monitoring of suspicious communications through lawful procedures and timely preservation of electronic evidence can all contribute to investigating suspected examination irregularities.
Forensic evidence can help reconstruct events and test competing accounts, but it cannot replace careful investigation or the judicial process. The strength of the prosecution’s case will ultimately depend on the quality, reliability and legal assessment of the evidence presented before the court.