What Is Digital Forensics?
Key takeaways
- The rule of forensics is that the original is never analysed, so the evidence is captured as a verified bit-for-bit image and all work happens on the copy.
- A cryptographic hash of the image, taken before and after analysis, is what proves the working copy is identical to the original and was not altered.
- Chain of custody documents every transfer of the evidence, with times, names and storage locations, because an unexplained gap is what a defence lawyer looks for.
- Live and memory forensics matter for an incident in progress, where a powered-off machine loses the running processes that show the intrusion path.
- The report states the method, the tools, the findings and the limits, because a forensic opinion that overstates its evidence is the one that gets broken.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does a digital forensics investigation involve?
Four stages. Identification, where the examiner establishes what devices, accounts, images and backups are in scope and which hold relevant evidence, and this is a conversation as much as a technical step. Preservation, where each item is secured, photographed in situ where possible, and its hash recorded. Acquisition, where a verified bit-for-bit image is taken, usually with a hardware write-blocker or an approved imaging tool, and a second hash proves the image matches the original. Analysis, where the image is examined for the artefacts relevant to the case, which might be recently used files, browser history, cloud sync records or deleted data. And reporting, with the method, tool versions, custody record and limitations.
What is a chain of custody and why does it decide cases?
It is the documented, unbroken history of the evidence from the moment it was seized. Every entry records who took custody, when, from whom, what was done to it, and where it was stored. A single break, such as an unlogged gap of two hours or a laptop left in a car boot, is enough for the other side to argue the evidence could have been altered, and Indian courts have directed that a forensic report without a proper custody record carries reduced weight. Practical discipline matters more than theory: use a sealed evidence bag with a tamper-evident label, keep a duplicate in a separate secure location, work only on verified images, and never analyse the original device.
What can digital forensics prove that a log review cannot?
It proves what happened on a device, as opposed to what a server recorded about it. Deleted files and their fragments, locally cached credentials, browser and messaging artifacts, USB and cloud sync history, and the running state of a machine during the incident are invisible to server logs but visible in a memory image or a disk image. It also proves absence, or the presence of absence: if a file was created and then securely deleted, the remnants are still there. Where the question is whether a departing employee copied customer data to a USB drive, device forensics is often the only route to an answer, and in India it makes a police complaint actionable.
How is a digital forensics report used in an Indian case?
Three ways. As the technical record attached to a cyber crime complaint or FIR, where it establishes the timeline, the systems affected and the access vector. As the basis for a legal notice, a bank dispute or a cyber insurance claim, where it needs to state the facts and their evidential weight. And as expert evidence, tendered through a court-appointed expert under the Bharatiya Nyaya Sanhita. The format matters: a clear scope, the method and tools used, a chronological findings section, conclusions that stick to what the evidence supports, and an explicit limitations section. AAVETech produces reports in a format CERT-In accepts and that clients can hand to their bank, insurer or counsel without rewriting.
| Stage | What happens | Output |
|---|---|---|
| Identification | Establish what devices, accounts and images are in scope | A written scope and evidence list |
| Preservation | Secure each item, photograph it, record its hash | Sealed items and an initial custody entry |
| Acquisition | Take a verified bit-for-bit image of each item | Image files with matching hashes |
| Analysis | Examine the copy for the artefacts relevant to the case | A timeline of events and findings |
| Reporting | Write up the method, findings and limitations | A report usable by bank, insurer, police or court |
What are the frequently asked questions?
Get a straight answer on this
Send us the device, the question you need answered and the date you noticed, and we will scope a forensic examination with a fixed fee.
Send us the details See pricing