What is digital forensics?

Digital forensics is the discipline of recovering and analysing electronic data so that it can be relied on as evidence. It covers laptops and desktops, mobile phones, email systems, servers, cloud platforms, messaging apps, accounting systems and removable media. The word "forensic" signals the purpose: the work is done in a way that a court, tribunal, regulator or board can trust.

How does a digital forensic examination work?

NIST Special Publication 800-86 describes the forensic process in four phases: collection, examination, analysis and reporting. In practice an engagement usually runs as follows:

1. Identification and scoping: decide which custodians, devices, accounts and date ranges are relevant.
2. Preservation: stop routine deletion, suspend auto-wipe, and secure devices before the subject is alerted.
3. Acquisition: create a verified copy, known as a forensic image, without altering the original. The image is fingerprinted with a hash value so later analysis can be shown to match the source.
4. Examination: recover deleted files, parse system artefacts such as logs, browser history, USB connection records and file metadata, and extract chats and emails.
5. Analysis: build timelines, link activity to users, and test hypotheses such as "who altered this invoice and when?".
6. Reporting: document the method, findings and limitations so another expert could reproduce them.

Throughout, a documented chain of custody records who handled each item and when.

When is digital forensics used?

• Fraud and misconduct: tracing who created fictitious vendors, backdated documents or deleted ledger entries.
• Data theft: establishing whether an employee copied confidential files to USB drives or personal cloud storage before resigning, a common insider threat scenario.
• Cyber incidents: reconstructing how an attacker gained access, for example in business email compromise.
• Whistleblower investigations: testing allegations against email and chat records.
• Litigation and arbitration: supplying evidence and supporting eDiscovery, where large volumes of documents must be reviewed and produced.

What is the Indian legal framework?

Since 1 July 2024, electronic evidence is governed by the Bharatiya Sakshya Adhiniyam 2023 (BSA), which replaced the Indian Evidence Act 1872. Section 2(1)(d) defines "document" to include electronic and digital records, with illustrations covering emails, server logs, files on computers and smartphones, messages and location data. Section 61 provides that such records cannot be refused merely because they are electronic. Section 63, which replaced s. 65B of the Indian Evidence Act, sets the conditions for admitting computer output and requires a Section 63 certificate that records hash values.

Criminal procedure has also changed. Under the Bharatiya Nagarik Suraksha Sanhita 2023, s. 94 allows production of electronic communications and devices likely to contain digital evidence, and s. 105 requires police searches and seizures to be recorded by audio-video means. Section 79A of the IT Act 2000 allows the Government to notify Examiners of Electronic Evidence, whose opinion is relevant under s. 39(2) of the BSA.

For organisations, the CERT-In Directions of April 2022 require covered entities to keep ICT logs for a rolling 180 days within India and report specified incidents within six hours, which affects what data will exist when an investigation begins.

What mistakes damage digital evidence?

• Switching on or browsing a seized device, which changes metadata.
• IT staff copying files with ordinary tools, losing timestamps and deleted data.
• Re-issuing a departed employee's laptop before it is imaged.
• No record of who held the device, breaking the chain of custody.
• Relying on screenshots instead of verified exports.

How is digital forensics different from eDiscovery and cyber security?

Digital forensics answers "what happened, who did it and when" from device and system artefacts. eDiscovery is about finding, reviewing and producing relevant documents for a legal matter, usually at volume. Cyber security aims to prevent and contain attacks, while incident-response forensics investigates them afterwards. The three often overlap within one matter. Our article on preserving digital evidence in internal investigations covers the first steps, and our digital forensics and eDiscovery service covers acquisition, analysis and expert reporting.