Cyber forensics in India: how the process works and who does it

What is cyber forensics

Cyber forensics is the discipline of identifying, preserving, examining and presenting digital evidence. Anyone asking what is cyber forensics is usually asking how a fact that exists only as data, such as a deleted message, a login record or the contents of a phone, can be turned into proof that stands up when it is challenged. The word forensic points to the setting: the work is done so that its results can be used before a court or another authority, and every step has to be explainable and repeatable.

The term is used with several names. Computer forensics, digital forensics and cyber forensic work overlap, and in India the phrases are used almost interchangeably. What distinguishes the discipline from ordinary IT support is the standard of care. A technician who recovers a lost file wants the file back. A forensic examiner wants to recover it without altering anything, and to be able to show that nothing was altered. The legal context of that standard is described in the guide to the IT Act 2000.

Kinds of digital evidence

The Information Technology Act gives a definition that shows how broad the field is. Section 79A, which deals with the Examiner of Electronic Evidence, explains electronic form evidence as any information of probative value that is either stored or transmitted in electronic form, and includes computer evidence, digital audio, digital video, cell phones and digital fax machines. In practice the sources an examiner meets are computers and their storage, mobile phones, e-mail and messaging accounts, servers and the logs they keep, cloud storage, network records and recordings.

Two features make digital evidence different from other kinds. It is easy to change, often without any sign, and it is easy to copy exactly. The first is the reason for the care described below; the second is what makes a careful method possible, because an exact copy can be examined while the original is kept safe.

The process of a forensic examination

Examinations follow a recognisable order, though the details change with the case. The table sets out the six stages that appear in most accounts of the process.

Why the hash matters

The fourth stage depends on an idea that the Information Technology Act itself uses. In describing how an electronic record is authenticated, section 3 defines a hash function as an algorithm that maps one sequence of bits into another, generally smaller, set called the hash result, so that an electronic record yields the same hash result every time the algorithm is run on it, and so that it is computationally infeasible to reconstruct the record from the result or to find two records that produce the same result. These properties are what let an examiner say that a copy is identical to the original: if the two hash results match, the copy is exact, and if one byte were changed the results would differ.

Chain of custody

The second stage is as important as the technical work. A court will want to know where the device was from the moment of seizure, who had access and what was done. A record of each hand-over, with dates and signatures, is the chain of custody. A gap in it gives the other side an argument that the evidence may have been altered, however sound the analysis.

Cyber forensics in India: laboratories and institutions

The work of cyber forensics in India is organised through central and State laboratories, and the position of cyber forensics in India has changed as new laboratories have been added. According to the Ministry of Home Affairs, the facilities include the following.

The ministry has also provided assistance to 20 States and Union Territories for strengthening cyber forensic capacity in State forensic laboratories under the Nirbhaya funded scheme, and has given Rs 116.5 crore under the scheme for the prevention of cyber crime against women and children, for cyber forensic-cum-training laboratories, which have been commissioned in 33 States and Union Territories. These figures come from a ministry reply of December 2025 and describe the position at that date.

The Information Technology Act adds an institution of its own. Under section 79A the Central Government may notify any Department, body or agency of the Central Government or of a State Government as an Examiner of Electronic Evidence, for the purpose of providing expert opinion on electronic form evidence before any court or other authority. The investigating side is governed by section 78, under which an offence under the Act is investigated by a police officer not below the rank of Inspector.

Techniques used in a forensic examination

Once a verified copy exists, the examiner chooses techniques to suit the evidence. Disk analysis looks at the structure of a storage device, including files that have been deleted but not yet overwritten, and fragments of files that can be reassembled by recognising their internal pattern. Timeline analysis collects the timestamps that systems record when files are created, opened and changed, and builds an ordered account of what happened on a device. Log analysis reads the records that servers, applications and network equipment keep, which can show who logged in, from where and when.

Some evidence is fragile in a different way. The contents of a computer’s memory disappear when it is switched off, so an examiner dealing with a live system may capture them first. Mobile phones are examined by extraction tools that read the stored messages, call records, application data and location history, and the depth of the extraction depends on the model and on whether the device is locked. Network forensics follows traffic records to reconstruct how an intrusion reached a system. Each technique answers a different question, and a report usually combines several.

The method has a legal edge as well. Section 69 of the Act allows the Central Government, a State Government or an officer specially authorised by either to issue directions for the interception, monitoring or decryption of information through any computer resource, on the grounds the section lists. Where data is encrypted, that route and the cooperation of the person holding the key are the ways in which an examiner may reach it, and an examiner who cannot reach it must say so in the report.

Challenges of cyber forensics in India

The difficulties are the same ones that affect the investigation of cyber crime in general, and they are described in the page on cyber crime in India. Three bear directly on forensic work. The first is volume: a single phone or laptop can hold a very large amount of data, and sorting out what matters takes time. The second is location: data held on a server in another country is outside the reach of a seizure in India, and the police must ask for it through a different route. The third is capacity. The ministry’s own figures, which show a growing network of laboratories and training facilities, reflect the effort to meet it.

None of these challenges is a reason to doubt the method. They are reasons why early reporting and careful preservation by victims matter, because a well-preserved device makes the examiner’s task far easier. For anyone who wants to know what is cyber forensics in operational terms, the short answer is that it is a way of making sure that digital facts can be proved.

The law on electronic evidence

The rules on whether an electronic record can be admitted and how it must be proved are in the law of evidence. From 1 July 2024 that law is the Bharatiya Sakshya Adhiniyam, which replaced the Indian Evidence Act 1872; matters pending on that date continue under the earlier Act. The Information Technology Act affects the subject from the other direction, by giving electronic records and signatures legal recognition in sections 4 and 5, and by naming the offences that digital evidence is most often collected to prove. Decisions of the courts on how electronic evidence must be produced are gathered under case reports, and the statistics on offences that raise these questions are in the page on cyber crime in India.

What a victim or organisation should do first

The most useful thing a non-specialist can do is to avoid damaging evidence. A device should not be wiped, reset or tidied, files should not be opened and re-saved if they may matter, and accounts should not be closed before the relevant records have been kept. Screenshots of messages, the web addresses of fake pages, transaction references and the dates and times of calls should be saved. An organisation should keep its logs and avoid rebuilding a compromised system before an examiner has copied it. The incident should then be reported through the national portal at cybercrime.gov.in or the helpline 1930, so that the police can arrange a proper examination.

An organisation has a second set of tasks. It should write down what was observed, by whom and when, because an early and accurate note of the first signs of a problem is often the best guide to where the examiner should look. Affected machines are best isolated from the network rather than switched off, so that nothing spreads and the contents of memory are not lost, but the decision should be taken with advice. Backups that pre-date the incident should be kept untouched, and every action taken on an affected system should be recorded, since each action alters the evidence and the examiner will need to separate the organisation’s own changes from those of the attacker. A short, dated log made while the response is happening is worth more than a long account written from memory afterwards.

Frequently asked questions