Three days after the car explosion near Delhi’s Red Fort, investigators across Delhi, Haryana, Uttar Pradesh and J&K have pieced together a terror trail involving radicalised doctors, forged identities, multiple reconnaissance vehicles, a Turkiye link and over 3,000kg of explosive chemicals.

Here is the chronological picture of everything known so far.

• The blast took place on November 10, when a white Hyundai i20 driven by Umar Nabi, a 28-year-old Pulwama doctor, exploded near the Red Fort, killing 12 on the spot — the toll later rose to 13.
• Investigators say Umar spent three hours inside a mosque in the walled city before the explosion, and may have been tracking updates about the Faridabad module’s arrests while possibly communicating with handlers using a Signal app.
• On Wednesday, the government classified the explosion as a terrorist incident, and Prime Minister Narendra Modi chaired an emergency Cabinet meeting, ordering agencies to proceed with “utmost urgency and professionalism”.
• As initial leads emerged, investigators traced the Hyundai i20 to Umar and began examining his academic and personal networks, including Al-Falah University in Faridabad, where he pursued higher studies.
• The first breakthrough came when Delhi Police found a red Ford EcoSport abandoned in Khandawali village in Faridabad on Wednesday, suspected to have been used for reconnaissance before the blast.
• The EcoSport carried registration number DL 10 CK 0458, registered to Umar Nabi; investigators later confirmed the vehicle had been bought using forged documents.
• Faridabad Police detained Faheem, a relative of Umar, for parking the EcoSport in the village.
• The search for the car had prompted Delhi Police to issue an alert across all police stations and border points before the address on its documents led them to New Seelampur. A madrasa imam from the area told PTI he had no connection to the vehicle and handed over his phone for examination.
• Around the same time, investigators began probing Umar’s links with Dr Muzammil Ahmad Ganaie, alias Musaib, a faculty member at Al-Falah University who had been the first among eight people arrested by J&K Police in a related terror module bust.
• Another lead emerged: both Umar and Muzammil had travelled to Turkiye in 2021, where investigators now believe they were radicalised, possibly after meeting over-ground workers of the banned Jaish-e-Mohammed.
• PTI sources said the two had Turkish immigration stamps in their passports, and agencies were examining whether they met any foreign handler during the trip.
• After returning to India, Umar and Muzammil allegedly began collecting ammonium nitrate, potassium nitrate and sulphur, storing the materials in and around the Al-Falah University campus.
• Investigators suspect the module initially planned a December 6 attack around the Babri Masjid demolition anniversary, with Umar reportedly assembling a vehicle-borne IED after studying online detonation circuits.
• Further analysis of call records revealed that Muzammil had made multiple reconnaissance visits to the Red Fort in January 2024, weeks before Republic Day, and that Umar had accompanied him on some visits.
• Tower dump records and CCTV footage traced repeated visits by the two doctors, leading investigators to consider that the module may also have been preparing an attack for January 26.
• Following the busting of the Faridabad module and the recovery of 360kg of inflammable material, investigators believe Umar may have panicked, advancing his plans.
• Police investigations say that at least eight suspects were working in pairs, preparing multiple vehicles for possible simultaneous blasts in different cities.
• Diaries recovered from Umar and Muzammil had coded entries, references to around 25 names, and dates between November 8 and 12, believed to reflect the final planning window.
• Investigative sources later told ANI that Muzammil, Adeel, Umar and Shaheen raised around ₹20 lakh, handed it to Umar, and used around ₹3 lakh to buy over 20 quintals of NPK fertiliser from Nuh, Gurugram and nearby areas.
• Investigators also discovered that Umar created a Signal group with two to four members, and that a financial dispute had arisen between him and Muzammil.
• As the investigation expanded into Uttar Pradesh, the ATS detained Dr Mohammad Arif, a 32-year-old DM cardiology student at GSVM Medical College in Kanpur, after disclosures made by Dr Shaheen Sayeed, a former GSVM professor and Al-Falah associate already under arrest.
• Sayeed is alleged to be part of what investigators call a “white-collar terror module” linked to JeM and Ansar Ghazwat-ul-Hind, involving academically qualified professionals.
• Preliminary analysis of Sayeed’s call records reportedly showed contact with the suspected mastermind and other module members, and investigators believe the group used a shared email ID to exchange draft messages to avoid detection.
• On Thursday, another vehicle linked to the module — a red Maruti Brezza registered to Shaheen — was recovered from the premises of Al-Falah University; it was suspected to have been used for reconnaissance or escape.
• Forensic teams are analysing materials from the blast site to check whether any signal device fragments used for communication survived the explosion.
• DNA tests have now confirmed that the remains found at the blast site belonged to Umar Nabi, establishing that he was driving the explosive-laden Hyundai i20.
• Across J&K, Haryana and Uttar Pradesh, agencies have together seized around 3,000kg of explosive chemicals, including ammonium nitrate, potassium chlorate and sulphur, indicating large-scale preparation.
• The death toll from the blast climbed to 13 after another injured victim died at LNJP Hospital on Thursday.
• The incident has revived concerns about the rise of “white-collar” militant operations, with security officials warning that radicalisation among academics and students represents a changing threat landscape that must be countered without deepening sectarian divides.