Cyber Forensics India — Bachao.AI Methodology

When you need cyber forensics

The most common triggers for engaging cyber forensics in India:

1. Employee misconduct (data theft, fraudulent transactions, IP exfiltration)
2. Corporate fraud investigation (vendor kickbacks, financial misrepresentation)
3. Litigation support (e-discovery requests, court orders)
4. Insider trading or SEBI investigation support
5. Suspicious termination (need to preserve evidence before access revoked)
6. Post-incident forensic determination (root cause for board reporting)
7. Family / matrimonial disputes involving digital evidence

What makes evidence court-admissible in India

Under Indian Evidence Act Section 65B, electronic records require:

1. Certification by the person in charge of the relevant electronic device
2. Statement of the process used to produce the electronic record
3. Identification of the device used
4. Particulars of the producer

Additional considerations:

1. Chain of custody log from acquisition to presentation
2. Forensic image hashing (MD5 + SHA-256) at acquisition
3. Read-only acquisition (write-blocker for storage devices)
4. Original device sealing with tamper-evident bags
5. Forensic image storage in evidence locker with access log

Engagement types

Type 1 — Internal investigation (no litigation yet)

1. Discreet acquisition (often before employee aware)
2. Confidential report to in-house counsel or HR
3. Used to determine: scope of misconduct, evidence sufficiency, next steps

1. Civil dispute requiring digital evidence preservation
2. Section 65B certified report
3. May be used in mediation or formal litigation

1. Active case in court (civil or criminal)
2. Bachao.AI forensic team available as expert witness
3. Cross-examination preparation if needed

1. Working alongside police / CBI / DRI / Enforcement Directorate
2. Evidence transfer protocols for criminal proceedings
3. Bachao.AI forensic team operates under custody of investigating agency

What we forensically examine

Storage devices: laptops, desktops, external drives, USB drives, SD cards

Mobile devices: Android, iOS — full physical acquisition where possible (file system + deleted data + chat history including WhatsApp/Telegram/Signal recovery)

Cloud accounts: Google Workspace, Microsoft 365, Slack, Salesforce — authenticated extraction with proper authorization

Email systems: server-side acquisition with metadata preservation

Network devices: routers, firewalls, VPN concentrators (forensic image of running config + logs)

Cryptocurrency wallets: transaction history reconstruction, address attribution

Cloud storage: Dropbox, OneDrive, Google Drive (proper authorization paths)

The standard 3-week engagement

Week 1: Acquisition

1. Devices identified and seized (with proper authorization)
2. Forensic images acquired with write-blocker
3. Hashing and chain-of-custody log started
4. Original devices sealed
5. Cloud accounts authenticated and extracted

1. Forensic tools (FTK, X-Ways, Cellebrite, Magnet AXIOM) used per device type
2. Timeline reconstruction
3. Keyword and date-range searches per case requirements
4. Deleted data recovery
5. Cross-device correlation
6. Hash-set filtering to focus on relevant material

1. Section 65B certificate prepared
2. Forensic report with findings, methodology, evidence excerpts
3. Hash registry for every artefact referenced
4. Chain-of-custody log finalised
5. Briefing with engaging counsel

Pricing

How to start

Most forensic engagements start with a confidentiality call between the engaging counsel and Bachao.AI's forensic team lead. Engagement letter executed under appropriate NDA. Acquisition typically begins within 5 working days.

Schedule the forensics scoping call →

Related: Case Study: Court-Admissible WhatsApp Forensics for Mumbai Corporate Fraud · Digital Forensics for Indian Law Firms