How Do You Prove Your Data Was Stolen?
Key takeaways
- Proof is a timeline of specific actions, each with a system record behind it, and a suspicion that a breach occurred is not proof of exfiltration.
- The strongest artefacts are the file access logs, the identity provider logs showing the authentication, and the firewall or proxy records showing the destination.
- CERT-In directions require logs to be retained for 180 days, and that retention is what makes an exfiltration investigation possible at all.
- Chain of custody means documenting who handled each image or export, when, and how it was stored, because an unbroken record is what gives the evidence weight.
- A professional forensic report should state its limits, including what the available logs cannot rule out, because a report that overclaims is easily attacked.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What evidence proves a data breach happened?
Three layers, and all three are needed. The access layer: who authenticated, from where, and when, from identity provider, VPN and application logs. The collection layer: which records were read or copied, from database audit logs, file server access logs and export tools. The movement layer: where the data went, from firewall, proxy, DNS, cloud and email logs. The layers have to be joined by a common thread, usually a timestamp, an account and a destination. A single log line is an indicator; a joined sequence of access, bulk read and outbound transfer to an unfamiliar address is proof. Where there is no network visibility, the proof is weaker and rests on device forensics.
What is a chain of custody and why does it matter?
It is the unbroken record of who handled the evidence and when. When a forensic examiner takes an image of a drive or exports logs, they record the case reference, the time, the source system, the tool and its version, a hash of the exported data, where the copy was stored and who moved it after that. Every subsequent copy is logged the same way, and the hashes let anyone confirm the data has not changed since capture. In Indian practice this matters in three places: the bank, which asks whether evidence was preserved before it refunds; the police, whose case weakens if logs arrive without provenance; and the court, where an exhibit whose custody cannot be explained is challenged.
What can a forensic report show about exfiltration?
It can establish what left the systems, when, by which account, and by what route, provided the systems kept the logs. It can also establish the window during which the attacker had access, and that is often the more useful number, because every record touched inside it is potentially in scope. It can usually identify the initial access vector, whether a phished credential, an exposed remote access tool or an unpatched service, and that stops the second incident. What it cannot do is recover data that was never logged, or attribute an action to a named person, because logs show accounts, not people. A report that states its limits is more credible with CERT-In, a bank or a judge.
Do I need a forensic report to notify the regulator?
You do not need a completed report to start the CERT-In notification within six hours, because the duty is triggered by noticing an incident, not by proving it. But for the follow-up, for a customer notification under the DPDP Act 2023, for a cyber insurance claim and for any civil or criminal proceeding, a professional forensic report is what carries the weight. It is also the only document that reliably answers the question a customer, regulator or judge will ask: what data, how many records, over what period, and what have you done about it. Where the budget is limited, a scoped engagement that answers exactly those questions is better than a general one that answers none of them sharply.
| Evidence source | What it shows | Retention value |
|---|---|---|
| Identity provider logs | Who authenticated, from where, on which device | Must cover the access window |
| File and database access logs | Which records were read, exported or copied | Shows collection, not movement |
| Firewall, proxy and DNS logs | Outbound destinations, volume and timing | Shows the movement of data |
| Endpoint telemetry | Process execution, archiving tools, persistence | Ties an account to a device |
| Email and cloud audit logs | Forwarding rules, bulk downloads, new API keys | Often holds the earliest signs |
| Forensic report and custody log | The joined timeline, the method, the limits | The document a bank or court reads |
What are the frequently asked questions?
Get a straight answer on this
Send us your log retention window and the date you first noticed the incident, and we will scope a forensic and evidence-preservation engagement.
Send us the details See pricing