Cyber Forensics — A Case and Evidence Register for Post-Breach Investigations in India
A breach investigation needs one place where everything is written down.
Open a case, record evidence entries and timeline items against it, and keep the whole investigation in one register instead of across a WhatsApp thread and three spreadsheets.
Legal note: Court admissibility is subject to judicial determination on a case-by-case basis. Our procedures are designed with Indian Evidence Act Section 65B and IT Act requirements in mind, but we do not guarantee admissibility in any specific proceeding, we do not certify evidence, and nothing on this page should be read as a representation that a report of ours will be accepted by a court. We recommend engaging legal counsel early where proceedings are in prospect.
What the workspace does, and what it does not
Three things it records today, and three capabilities we are asked for often enough to name — marked as roadmap, because they are.
Case Register
Every investigation is a case record with its own status, scope and owner. The dashboard lists open and closed cases — and shows an honest empty state until you have one.
Evidence Entries
Each case holds evidence entries: type, description, who recorded it, an optional storage key, and an optional hash string the investigator supplies. Bachao.AI does not compute that hash, does not verify it, does not sign the item, and does not take custody of the underlying file.
Incident Timeline
Timeline items are recorded against the case as the investigation proceeds, so the sequence of events has one agreed version. The product does not reconstruct a timeline from logs.
Log ingestion and correlation — roadmap
Not built. There is no automated collection or correlation of cloud, endpoint, firewall, proxy or directory logs in the product. Log review on an engagement is done by people, with whatever export you can give us.
Malware analysis — roadmap
Not built. The product does not reverse-engineer payloads, classify malware families or identify command-and-control infrastructure.
Regulatory report drafting — roadmap
Not built. CERT-In's 6-hour incident report and a DPDP breach notification are documents we can help you prepare inside an engagement; nothing in the product drafts or files them for you.
How an investigation engagement runs
Four stages — scoped first, recorded as we go, handed over with the limits stated.
Tell us what happened on a call. We agree what is in scope, what access we need, who does what, and what we can realistically establish — in writing, before anything is collected.
We open a case in the workspace. Evidence entries and timeline items go in as your team and ours work through the incident, so there is one register rather than several accounts of it.
Analysis is human work. Findings are written against the case record, with what we could establish separated from what we could not.
You get the case record and the write-up. Filing with CERT-In, the police or your insurer is your decision; we can support it within the agreed scope, and we will say so plainly where we cannot.
CERT-In 6-hour mandate: Indian organisations must report cyber incidents to CERT-In within 6 hours of detection. That obligation is yours. We can help you prepare the submission inside an engagement — the product does not draft it, and we do not file it for you unless the scope says we do.
Not packaged yet
Cyber Forensics is still being built, so there is no plan to sell you and no tier list worth printing. If it is close to what you need, talk to us — we will scope the work, tell you plainly what exists today, and quote only for that.
Forensics FAQ
The questions your legal and security teams will ask.
Are your forensic reports admissible in Indian courts?
That is not ours to promise. Admissibility is determined by the court, case by case, under the Indian Evidence Act and the IT Act. We will tell you what was done, how it was recorded, and where the limits are. We do not describe our output as court-ready, and we do not offer a certificate of admissibility.
How is evidence handled?
Each case has an evidence register. An entry records the evidence type, a description, who collected it, an optional storage key and an optional hash string supplied by the investigator. Bachao.AI does not compute or verify that hash, does not digitally sign the entry, and does not hold the underlying file in escrow. If your matter needs cryptographically sealed custody, raise it at scoping — it is not in the product today.
How quickly can you start an investigation?
We do not publish a response SLA and we do not run a 24/7 rota. Email ceo@bachao.ai or book a call and we will tell you honestly what we can start, when, and with whom. If we cannot help at the speed you need, we would rather say so on the first call.
Do you collect logs from our cloud and endpoints automatically?
No. There is no collection agent and no log ingestion. Whatever gets analysed is what your team exports and hands over under the agreed scope, and whatever we record ends up in the case register because a person put it there.
Can you draft our CERT-In 6-hour report?
Not automatically. CERT-In's 2022 directions require reporting within 6 hours of detection, and the DPDP Act carries its own breach-notification duties. We can help you prepare those submissions as part of an engagement — the product does not draft them, and we do not file on your behalf unless that is written into the scope.
Can you appear as an expert witness or liaise with a cyber cell?
Expert-witness testimony and cyber-cell liaison are not part of this product and are not a standing service we advertise. If your matter needs either, tell us at scoping and we will say plainly whether we can help or point you to someone who can.
Explore more products
Bachao.AI covers your entire security surface — from code to cloud to compliance.
- Certified
- Certified
- Accredited
- In process
- GDPRIn process
Had a breach? Start with an honest scoping call.
Tell us what happened and we will tell you what we can realistically establish, how long it would take, and where you need someone other than us. No response SLA, no promises about a court.