Ravindra BagaleCourses & study guides

28. Introduction to Digital Forensics

28.6 Forensics, Incident Response and the Law

By Last updated:

Forensics ekta chalat nahi – to incident response cha bhag aahe (Part 11 madhe purna baghu). Breach zalyavar order asa:

  1. Detect the incident (SOC, alerts – Part 11).
  2. Contain it (isolate the affected machine).
  3. Preserve evidence – image disks, capture memory, save logs (this chapter).
  4. Analyse – what happened, how, what was taken.
  5. Report and recover – fix, restore, and improve.

A note on Indian law: digital evidence is admissible under the Indian Evidence Act with a proper Section 65B certificate for electronic records (verify the current provisions yourself). CERT-In requires certain incidents to be reported. This is why chain of custody and integrity hashing matter so much – without them, good evidence can be thrown out.

Why this matters for security

After an attack, forensics answers the questions that stop the next one: how did they get in, what did they touch, and is it fully cleaned up? Done properly, it also turns an incident into evidence that can support legal action.

Ravindra Bagale's Tip

Interviewers ask, "There's been a breach – what will you do first?" The answer: not panic and delete or reboot everything! First, containment and preserving evidence (image + memory + logs). If you reboot, the evidence in RAM is lost for good. Follow the process with a calm mind.

Practice task

Write the six incident-response steps in order and mark which one this chapter covered. In one line, explain why rebooting a compromised machine immediately can destroy evidence.