Digital forensics

In short

Digital forensics is the scientific identification, seizure, preservation, acquisition, examination, analysis and presentation of data held in electronic devices, so that it is admissible as evidence in a court of law. It covers computers, mobile phones, servers, cloud accounts, CCTV/DVRs, drones, vehicle infotainment units and IoT devices, and is now part of almost every serious criminal investigation in India — financial fraud, cyberstalking, murder (call records and location), narcotics (chat apps) and terror cases. B.Sc Forensic Science syllabi examine it under electronic evidence, the Bharatiya Sakshya Adhiniyam, 2023 and the Information Technology Act, 2000, and it is the single most employable specialisation in the stream. Employers include the CFSLs and State FSLs, CBI, NIA, State Cyber Crime cells, C-DAC Thiruvananthapuram, NCRB, and private firms such as Deloitte, EY, KPMG, PwC Forensic, Lucideus/SAFE Security, eSec Forensics and CDR-analysis units of banks.

Explained

Definitions, principles and branches

• Digital evidence: any probative information stored or transmitted in binary form — files, logs, chats, images, metadata, deleted fragments, network packets.
• It is latent (invisible without tools), fragile (one wrong boot alters timestamps), easily copied bit-for-bit, time-sensitive (logs rotate, cloud data expires) and jurisdiction-crossing.
• Locard's principle applied digitally: every interaction leaves a trace — login records, browser cache, prefetch files, registry keys, DHCP leases.
• Cardinal rule (ACPO-style, followed in Indian practice): no action taken by the investigator should change data held on a device; if change is unavoidable (live RAM capture), the examiner must be competent, record what was done and be able to justify it.
• Original vs working copy: examination is always done on a verified forensic image, never on the seized original.
• Branches: computer/disk forensics, mobile device forensics, network forensics, memory (live/RAM) forensics, cloud forensics, database forensics, multimedia/audio-video and CCTV forensics, malware/reverse-engineering forensics, email forensics, IoT and vehicle forensics, cryptocurrency/blockchain forensics.

How data is stored, deleted and recovered

• Storage units: bit → byte (8 bits) → sector (512 B, or 4,096 B in Advanced Format) → cluster/block (allocation unit) → partition → volume.
• File systems: FAT32, exFAT, NTFS (with $MFT master file table, journal $LogFile, Alternate Data Streams), ext4 (Linux), APFS/HFS+ (Apple), F2FS/ext4 on Android.
• Deletion is not erasure: the OS only removes the directory pointer and marks clusters free; the content survives until overwritten — this is the basis of most recovery.
• Unallocated space: clusters marked free; carved for recoverable files.
• File carving: recovery by header and footer signatures regardless of file-system metadata — e.g. JPEG starts FF D8 FF and ends FF D9; PDF starts %PDF and ends %%EOF; ZIP/DOCX starts PK\x03\x04. Used when the file table is destroyed or the disk is formatted.
• Slack space: file slack = unused bytes between the end of a file and the end of its last cluster; RAM slack = the part of the last sector padded by the OS; both can hold earlier data.
• Hidden areas: HPA (Host Protected Area), DCO (Device Configuration Overlay), partition gaps, bad-sector marking, steganography, encrypted containers (VeraCrypt), ADS in NTFS.
• SSD problem: TRIM/garbage collection wipes deleted blocks *autonomously*, even with a write blocker attached, and wear levelling means the logical sector does not map to a fixed physical cell. So deleted-file recovery from an SSD is unreliable — a frequently asked exam point. Mitigation: capture quickly, keep the drive powered off, prefer logical/live acquisition where appropriate.
• Volatile evidence (order of volatility): CPU registers and cache → RAM → network connections and ARP cache → running processes → temporary files → disk → removable media → archival backups. Capture in that order.
• RAM holds encryption keys, decrypted content, open chats, clipboard, injected malware and process lists that never touch the disk — hence live acquisition in ransomware and malware cases.

The forensic process, step by step

1. Preparation and authorisation: search warrant / seizure authority under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS, in force 1 July 2024), Section 91/94-type production orders, and Section 69/69B IT Act for interception or monitoring. Carry Faraday bags, write blockers, sterile target media, labels, forms.
2. 2. Identification and on-scene triage: photograph the scene and screens, record the state (on/off), note running programs, cables, serial numbers, IMEI, network connections, and look for passwords on notes and whiteboards.
3. 3. Seizure: if ON and volatile data matters — capture RAM first, then decide. If OFF — leave it off. Pull the power plug at the back for desktops (avoids graceful shutdown scripts); for laptops remove battery/long-press only after RAM capture; for mobiles use airplane mode plus a Faraday bag to stop remote wipe, and keep the phone charged.
4. 4. Documentation and chain of custody: unbroken record of who handled the item, when, why and what was done — Form 1/seizure memo, tamper-proof evidence bags with unique numbers, Malkhana entry. A break in the chain is the commonest ground of challenge in Indian courts.
5. 5. Acquisition (imaging): create a bit-stream image through a hardware write blocker (Tableau, CRU WiebeTech) or software blocker, to E01/Ex01, AFF4, or raw dd format. Types: physical (every sector, including unallocated), logical (selected files/volumes), sparse/targeted, live.
6. 6. Verification: compute MD5 and SHA-256 hashes of the source and of the image; they must match. Re-verify at every handover; the hash is the digital equivalent of a tamper seal.
7. 7. Examination and analysis: keyword and regex search, timeline building, registry and log analysis, link-file/LNK, prefetch, shellbags, browser history, recycle bin ($I/$R), email headers, EXIF, deleted-file recovery, carving, hash-set filtering (NSRL known-good set), password cracking/decryption, malware triage.
8. 8. Reconstruction and interpretation: place actions on a single timeline (in IST, after noting the device's time zone and clock skew) and attribute them to a user account — not to a person; attribution to a human needs corroboration.
9. 9. Reporting and testimony: factual, reproducible report with tool names and versions, hash values, method, findings and limitations — plus the certificate under Section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023 (the provision that replaced Section 65B of the Evidence Act). Expert evidence is given under Section 39 BSA.

Mobile, network, cloud and multimedia forensics

• Mobile acquisition levels (increasing depth): manual (photographing screens) → logical (ADB/backup, iTunes backup) → file-system → physical (full flash) → JTAG/ISP (direct pin access) → chip-off (desolder NAND). Deeper methods recover more deleted data but are destructive and need justification.
• Mobile artefacts: SQLite databases (WhatsApp msgstore.db, call logs, contacts), app caches, notification logs, Google/Apple location history, Wi-Fi SSID lists, sensor and health data, IMEI/IMSI/ICCID, EXIF GPS in photos.
• Modern obstacle: full-disk/file-based encryption (iOS Secure Enclave, Android FBE) and end-to-end encryption mean physical extraction often yields ciphertext — the passcode or a cloud backup becomes the only route.
• Tools used in Indian labs: Cellebrite UFED and Physical Analyzer, MSAB XRY, Oxygen Forensic Detective, Magnet AXIOM, EnCase, FTK, X-Ways, open-source Autopsy/Sleuth Kit, Volatility (memory), Wireshark/NetworkMiner (network), C-DAC's indigenous CyberCheck, TrueBack (imaging), MobileCheck and Win-LiFT — accepted in Indian courts and used by CFSLs.
• Network forensics: packet capture (pcap), NetFlow, firewall/IDS and proxy logs, DNS logs; CDR/IPDR and tower-dump analysis for location and contact mapping; subscriber details via the service provider.
• IP attribution caution: CGNAT, dynamic IP allocation, shared Wi-Fi, VPN/Tor and proxies mean an IP identifies a connection, not a person; IPDR with source port and exact timestamp is needed to resolve CGNAT.
• Email forensics: read Received headers bottom-up for the true originating IP, check SPF/DKIM/DMARC results, Message-ID and X-headers to detect spoofing and phishing.
• Multimedia/CCTV: proprietary DVR formats, frame-rate and timestamp verification, recovery of overwritten footage, ELA and metadata checks for image tampering, and detection of deepfakes/synthetic audio (an active area, no settled standard yet).
• Cloud and crypto: preservation requests and MLAT/letters rogatory for data held abroad; blockchain tracing of wallet addresses and exchange KYC records.

Indian law, standards and institutions

• Bharatiya Sakshya Adhiniyam, 2023 (in force 1 July 2024, replacing the Indian Evidence Act, 1872): Section 2(1)(d) includes electronic records in "document"; Section 61 says electronic records are not to be denied admissibility; Section 63 governs admissibility of electronic records (the successor to Section 65B) and Section 63(4) requires a certificate from a person in charge of the device *and* an expert; Section 39 covers expert opinion. The Supreme Court's ruling in *Anvar P.V. v. P.K. Basheer* (2014) and *Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal* (2020) — that the certificate is mandatory for secondary electronic evidence — continues to guide practice under the new numbering.
• Information Technology Act, 2000 (amended 2008): Section 65 (tampering with source documents), Section 66 (computer-related offences), 66C (identity theft), 66D (cheating by personation), 66E (privacy), 67/67A/67B (obscene and child sexual abuse material), 69/69A/69B (interception, blocking, monitoring), Section 70B (CERT-In as the national incident-response agency), Section 79A (Central Government may notify an Examiner of Electronic Evidence — the formal status an examining lab needs). Note the presumption as to electronic records is *not* in the IT Act — it was Section 85B of the Indian Evidence Act, 1872 (inserted by the IT Act) and is now carried into the BSA, 2023.
• BNSS, 2023: search and seizure powers, and provisions encouraging audio-video recording of search and seizure — relevant to documenting digital seizures.
• Standards: ISO/IEC 27037 (identification, collection, acquisition and preservation of digital evidence), ISO/IEC 27041, 27042 (analysis and interpretation), 27043 (investigation principles), ISO/IEC 17025 (lab competence — the basis of NABL accreditation of Indian FSL digital divisions). NIST CFTT publishes tool-validation reports.
• Institutions: DFSS (Directorate of Forensic Science Services, MHA) and the CFSLs (Hyderabad, Chandigarh, Kolkata, Pune, Bhopal, Guwahati); CFSL Delhi under CBI; State FSLs; NCRB (publishes crime statistics and runs CCTNS); I4C (Indian Cyber Crime Coordination Centre) with the National Cyber Crime Reporting Portal and the 1930 financial-fraud helpline; CERT-In directions of 28 April 2022 requiring reporting of specified incidents within 6 hours and retention of ICT logs for 180 days; RBI and SEBI cyber-incident reporting norms for regulated entities.
• Digital Personal Data Protection Act, 2023: passed and notified in stages; its rules were notified in 2025 with phased implementation, so obligations on handling personal data in investigations are tightening — check the current commencement position before relying on a specific clause.

Anti-forensics, limitations and quality assurance

• Anti-forensic techniques: secure wiping (DoD/Gutmann patterns), encryption, steganography, timestamp manipulation ("timestomping"), log deletion, use of live/amnesic OS (Tails), VMs, disposable SIMs, data hiding in slack/HPA, file-extension and signature spoofing.
• Counter-measures: signature-vs-extension mismatch checks, $MFT and $LogFile analysis, multiple independent timestamp sources (MACB times, prefetch, event logs, cloud sync records), memory capture before shutdown.
• Limitations to state in a report: no recovery after overwriting; SSD TRIM losses; encrypted data without a key; attribution limits; cloud data outside Indian jurisdiction; tool-version dependence; absence of a certificate making evidence inadmissible however sound the technique.
• Quality assurance: validated tools, dual-tool verification of critical findings, proficiency testing, peer review, sterile (wiped and verified) target media, documented SOPs, NABL/ISO 17025 compliance, and an audit trail generated by the tool itself.

Key points

• Digital evidence - probative data in binary form; latent, fragile, and perfectly copyable bit-for-bit.
• Cardinal rule - never work on the original; examine a verified forensic image.
• Write blocker - hardware/software device permitting reads but blocking writes to the suspect drive.
• Hash value - MD5/SHA-256 digest proving the image equals the source; any single-bit change alters it completely.
• Chain of custody - unbroken documented trail of custody and handling; its breach is the commonest court challenge.
• Physical vs logical image - sector-by-sector copy including unallocated space, vs copy of selected live files only.
• Deletion only removes pointers - data stays in unallocated clusters until overwritten.
• File carving - recovery by header/footer signatures when the file system is gone (JPEG FF D8 FF … FF D9).
• Slack space - leftover bytes in the last cluster of a file that may hold earlier data.
• Order of volatility - registers → RAM → network state → processes → disk → backups; collect in that order.
• SSD TRIM - autonomously erases deleted blocks, so SSD deleted-data recovery is unreliable.
• Section 63 BSA, 2023 - admissibility of electronic records; 63(4) certificate is mandatory, replacing Section 65B of the 1872 Act.
• Section 79A IT Act - notification of an Examiner of Electronic Evidence; Section 70B - CERT-In.
• CERT-In directions (2022) - report listed incidents within 6 hours; retain logs 180 days.
• ISO/IEC 27037 - international standard for identifying, collecting, acquiring and preserving digital evidence; ISO/IEC 17025 underpins NABL lab accreditation.
• Faraday bag plus charger - isolates a seized phone from the network to prevent remote wipe.
• IP is not identity - CGNAT, VPNs and shared Wi-Fi mean IPDR plus exact timestamps are needed.
• C-DAC CyberCheck/TrueBack - indigenous Indian forensic tools used by CFSLs and State FSLs.

Formulas and examples

Example 1 — sectors and capacity. A seized drive reports 1,953,525,168 sectors of 512 bytes.

• Bytes = 1,953,525,168 × 512 = 1,000,204,886,016 B.
• In decimal: ÷10¹² ≈ 1.0002 TB (a "1 TB" drive).
• In binary: 1,000,204,886,016 ÷ 1,024² ≈ 953,870 MiB; ÷ 1,024³ ≈ 931.5 GiB — which is why Windows shows about 931 GB for a 1 TB disk.

Example 2 — imaging time and sterile media. The same 1 TB drive is imaged raw over USB 3.0 at a sustained 120 MB/s.

• Size ≈ 1,000,205 MB → t = 1,000,205 ÷ 120 ≈ 8,335 s ≈ 2 h 19 min.
• Verification needs a full read of source and image; if hashing also runs at 120 MB/s, add about 2 h 19 min per pass → roughly 7 h in all for image plus two verification reads.
• Target media must be at least 1 TB and wiped; with E01 compression at, say, 40% saving, the image occupies about 600 GB.

Example 3 — file slack. Cluster size 4,096 B; a recovered document is 9,500 B.

• Clusters used = ceil(9,500 / 4,096) = ceil(2.32) = 3 clusters = 12,288 B.
• File slack = 12,288 − 9,500 = 2,788 B of potentially evidential leftover data.
• For 1,000 such files, slack ≈ 2,788 × 1,000 ≈ 2.79 MB to examine.

Example 4 — hash verification outcome. Source SHA-256 = 3f2a…b71c; image SHA-256 computed after acquisition = the same 64 hex characters → image is a true copy. Six months later, re-hashing the image gives a value differing in one character.

• Interpretation: the image file has changed (bit rot, accidental write, or tampering). Even a single flipped bit changes roughly half the output bits (avalanche effect), so the magnitude of difference says nothing about the size of the change.
• Action: fall back to the second verified copy, record the discrepancy in the report — never conceal it.

Example 5 — password keyspace. A VeraCrypt container is protected by an 8-character password from lowercase letters plus digits (S = 36).

• C = 36⁸ = 2,821,109,907,456 ≈ 2.82 × 10¹² combinations.
• At 1,00,000 guesses/s (GPU-slowed by the container's key derivation): 2.82 × 10¹² ÷ 10⁵ = 2.82 × 10⁷ s ≈ 326 days worst case, about 163 days on average.
• Add two characters (L = 10): 36¹⁰ ≈ 3.66 × 10¹⁵ → about 1,160 years at the same rate — which is why examiners pursue the passphrase, RAM keys or cloud backups rather than brute force.

Where it is used

• Government forensic labs: CFSLs under DFSS and State FSL cyber divisions — digital evidence examiners handling seized phones, laptops and DVRs, and issuing Section 63(4)/79A-backed reports.
• Police and central agencies: State Cyber Crime police stations, CID cyber cells, CBI, NIA, ED and the Income Tax/GST investigation wings, where device imaging during searches is routine; I4C and the 1930 helpline workflow for financial fraud.
• Banking, NBFC and fintech fraud units: HDFC, ICICI, SBI, Paytm, PhonePe risk teams analysing UPI trails, device fingerprints, CDR/IPDR and mule-account networks; CERT-In-mandated 6-hour incident reporting.
• Big Four and consulting forensic practices: Deloitte Forensic, EY Forensic & Integrity Services, KPMG, PwC, Grant Thornton — e-discovery, employee misconduct, IP theft, whistle-blower and FCPA/anti-bribery investigations, data-breach response.
• IT/ITeS and product security: DFIR (digital forensics and incident response) analysts at TCS, Infosys, Wipro, HCL, Accenture SOCs and at security firms, doing ransomware triage, memory forensics and root-cause analysis.
• Courts and compliance: expert witnesses, CDR analysts in civil and matrimonial matters, insurance fraud investigation, and audit of CCTV/attendance data in industrial disputes.

Interview questions

• Q: Why is a bit-stream image taken instead of simply copying the files? A: A file copy takes only live data, while a bit-stream image copies every sector — including unallocated space, slack and partition gaps — so deleted files and hidden data remain recoverable.
• Q: What proves that your image is identical to the seized drive? A: Matching hash values (MD5 and SHA-256) of the source and the image, recorded at acquisition and re-verified at each handover.
• Q: A suspect desktop is found running. Do you shut it down? A: No — capture RAM and other volatile data first (encryption keys, open chats, network connections), then disconnect power from the rear; in some cases imaging live is necessary for full-disk-encrypted systems.
• Q: Why might you fail to recover deleted files from an SSD? A: TRIM and garbage collection erase deleted blocks on the drive's own initiative, and wear levelling moves data between physical cells, so the deleted content may genuinely be gone even with a write blocker fitted.
• Q: What certificate makes electronic evidence admissible in India today? A: The certificate under Section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023, which replaced the Section 65B certificate of the Indian Evidence Act, 1872 from 1 July 2024.
• Q: Why do you put a seized phone in a Faraday bag? A: To cut off mobile, Wi-Fi and Bluetooth signals so the data cannot be remotely wiped or altered; it is kept powered because screen-lock or shutdown may re-encrypt data.
• Q: Does an IP address identify an offender? A: No — it identifies a connection at a time; with CGNAT, VPNs, proxies and shared Wi-Fi, IPDR records with source port and precise timestamps plus corroborating evidence are needed.
• Q: How would you detect a file whose extension has been changed to hide it? A: Compare the file's header signature (magic number) with its extension; a JPEG renamed .dll still begins FF D8 FF.
• Q: What is file carving and when is it needed? A: Recovering files from raw data using header and footer signatures, used when the file system or file table is destroyed, formatted or corrupt.
• Q: Your tool reports a chat message, but the phone's clock was wrong. What do you do? A: Record the device time zone and skew against a reference clock, convert all timestamps to a stated reference (usually IST), and corroborate with server-side or network timestamps before drawing conclusions.
• Q: Can forensics attribute an action to a specific person? A: It attributes activity to a device and a user account; linking that to a human needs corroboration such as CCTV, biometrics, admissions or possession evidence.
• Q: Which standard guides collection and preservation of digital evidence? A: ISO/IEC 27037, with 27041/27042/27043 for assurance, analysis and investigation principles, and ISO/IEC 17025 for laboratory competence and NABL accreditation.

Common mistakes

• Booting the suspect machine or plugging the drive in without a write blocker — this alters timestamps and can destroy the case.
• Omitting hash values, or hashing only once and never re-verifying at handover.
• Still quoting "Section 65B of the Indian Evidence Act" instead of Section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023.
• Treating "deleted" as "gone" on an HDD, and assuming it is recoverable on an SSD — the position is the reverse of the intuition.
• Shutting a live system down and losing RAM-resident encryption keys and volatile artefacts.
• Confusing decimal and binary capacity (1 TB vs 0.91 TiB) and so claiming data is "missing" from an image.
• Writing conclusions beyond the data — naming a person from an IP address or a user account, or omitting limitations from the report.

Related topics

Cyber crime · Forensic psychology · Questioned documents and handwriting examination · Fingerprint and biometric identification · Crime scene management and evidence collection · Criminal law and the Bharatiya Nyaya Sanhita.