The Role Of Cyber Forensic In The Criminal Justice System In India

Author: LawSphereX

Category: Criminal Law

Published: 2026-08-23T21:29:46.111642+00:00

Updated: 2026-08-26T17:05:23.566+00:00

THE ROLE OF CYBER FORENSIC IN THE CRIMINAL

JUSTICE SYSTEM IN INDIA

Mrs. Neha Chaudhary, Doctoral Research Scholar, School of Law, Bennett University (The Times Group), Greater Noida, Delhi (NCR), India. Dr. Preeti Singh, Assistant Professor, School of Law, Bennett University (The Times Group), Greater Noida, Delhi (NCR), India.

ABSTRACT

Convictions for complex crimes have decreased significantly, with a particularly low number of convictions, while computer-related offences are on the rise Criminals using technology are a major factor in committing various crimes, with their unethical behavior stemming from their use of computers and applications. Forensic science in cyber format, specifically "Cyber Forensics," plays a crucial role in aiding criminal investigations and other legal branches by providing easier and quicker investigations. The development of new technology has led to the automation of various business processes, but it has also created opportunities for computer abuse. Some attacks are simply modern versions of traditional crimes, while others involve entirely new forms of criminal activity that have emerged alongside technological advancements.

Criminals often exploit technology to engage in unlawful and unethical behavior using computers and their applications. Henceforth this research paper aims to examine the significance of cyber forensic science in investigations of criminal cases and other areas of law, particularly through the practice of "Cyber Forensics" to facilitate faster and more efficient investigations. Also, the paper focuses on understanding cyber forensic investigation methodologies in India using primary and secondary information from various sources such as research papers, articles, journals, conference proceedings, textbooks, and cyber data. Keywords: Criminal investigation, forensic science, justice, Criminal jurisprudence.

1. Introduction

Forensics is the term that describes the discovery, scrutiny, and storage of cyber evidence to investigate and mitigate cybercrime occurrences. The field of cyber forensics is multidisciplinary and incorporates computer science, law, and criminal intelligence to address the difficult issue of cyber evidence. The objective of cyber forensics is to investigate and address the research of the confidentiality of cyber proof while being able to procure data retrieved from any electronic means. It includes personal computers, smart mobile phones, storage media, performs sources perform, and others. These sources can be utilized to investigate violent offences in topics such as fraud, robbery, and cyber-attack.

Moreover, cyber, computer, or cyber forensics similarly indicates the procedure for safeguarding, purifying, and restoring electronic evidence employed to investigate and terminate a cyber assault. According to Saharan and Yadav, (Saharan & Yadav, 2022) cyber computer, or cyber forensics can be designated as the procedure for recycling, examining, and getting electronic proof. It is aided by expert software and tactics to rejuvenate evidence like removed documents, browsing times history, and emails on cyber Systems. The sample has been affected to recognize the origin of the cybercrime, sentence the perpetrator in a courthouse, and safe management in additional lawful action.

In addition, it is anticipated that cyber forensics scientists should be attentive and contemporary-oriented to the recollection of electronic evidence to ensure it is protected and firm the proof throughout courthouse investigation. (Krishnan & Zhou, 2020) Cyber forensics has become an essential tool for the investigation and prevention of cybercrime today, as it has mastered Criminalistics and Ballistics through generations of technology instilled in every second of our lives. Cyber forensics has continued to grow significantly, and it includes “storage, analysis, and protection of cyber evidence to trace criminal attacks, pinpoint vulnerabilities, and prevent future attacks” (Rohatgi & Shrivastava, 2023). This article will discuss the increasing value of cyber forensics in the cyber age and the battle against cybercrime.

There are many important reasons for the importance of cyber forensics in the cyber age. Firstly, every second, the explosion of technology results in another criminal activity opportunity; therefore, cybercriminals are constantly inventing new ways to exploit vulnerabilities, that’s why criminals must be aware of tools and tactics. Secondly, the spread of smart devices and integrated consumers results in a huge and intricate web of generated and stored information that must be reviewed, analyzed, and looked at to find traces that could potentially associate criminals with registers and through cooperation to assist in proven work.

(Curtis & Oxburgh, 2022) To have it analyzed, not only put future intrusions overestimated enterprise the protection of people. Finally, the rejection of either corporation or court and thus evidence that is the crucial exclusion of encroaching connections. This research work contributes to an understanding of cyber forensic crime investigation methodology and its prosecution in India. Cyber risks are fluid rather than stationary, and this space is in a constant state of flux to adapt to new hazards, together with innovative techniques, tactics, and tools to breach platforms and stay unnoticed. Cyber risks are not static; rather, the space is continuously changing in response to new threats, as well as new and innovative methods, tactics, and tools to penetrate systems and remain invisible. (Cremer et al.

, 2022) Therefore, cyber investigators need to be updated on the latest trends and emerging hazards. Generally, there are several major emerging hazards, including highly sophisticated Malware and Advanced Persistent Threats that use covert methods and encryption to evade detection. Similarly, the increased use of cyber assets and blockchain technologies makes it difficult for investigators to track financial transactions linked to cyber offences and assign them to the perpetrator while also posing various threats. IoT devices and the ability to carry out precedentially extensive cyber-physical attacks are another emerging menace. Finally, the physical and virtual worlds’ merging through IoT lends itself to an even greater potential impact. If more of this critical infrastructure is linked and controlled online, the possibilities are enormous.

(Mohamed, 2023) Cyberspace forensics is essential in our modern highly sophisticated fast-paced world as it saves time in the investigations and provides the best evidence with high accuracy. It is important for investigating potential proof, consisting of measurement and interpretation of discarded, encrypted, or polluted data and all the while sustaining a documented sequence of indistinguishability to avert tampering or corruption. (Admin, 2023). Cyber forensic professionals achieve a strong evidential base that can be used in court to indict the cybercriminal and use many information-acquisition tools and examination, measure, and other tools. Available cyber forensic examiners include a vast range of admit scopes, such as technical and domain expertise, cybersecurity skills, and strong social qualities.

They face a variety of challenges including accessing a diverse range of cyber proof, preserving tools and knowledge, and adapting to the evolving cyber flux. Additionally, they could come across data shielded or hidden by passwords, requiring a lot of time and resources to recover or decrypt.

(Anderson et al., 2021) Finally, the ever-evolving nature of cyber threats creates continual issues for cyber forensic specialists.

1.1 The primary objectives of cyber forensics are threefold:

1.1.1 Identify cyber evidence: Finding and locating all cyber evidence related to the cyber

incident is the first step in a cybersecurity investigation process. Cyber evidence is found in a variety of sources, such as electronic documents and emails, system logs, network traffic, as well as cyber imaging and recording. (David Mugisha, 2019)

1.1.2 Preserve and analyze cyber evidence: Preserving the integrity of the evidence is crucial

to ensure that it remains unchanged. After that, forensic investigators use special tools and techniques to analyze the evidence, hoping to find hidden data, recover erased files, and rebuild the chain of events that led to a cyber incident. (Robin Whitley & Debra Figarelli, 2009)

1.1.3 Present cyber evidence: Ultimately, the purpose of cyber forensics is to present

evidence to stakeholders to show the results of the investigation in a clear and accessible form. Most often, this type of evidence is contained within a forensic report or given in professional testimony. In the latter case, the evidence should meet certain legal standards, which would allow it to be used in court and successfully support prosecution in cyber incidents or the resolution of civil claims. (Sean E. Goodison, Robert C. Davis, Brian A. Jackson, 2015)

2. Cyber Forensic in solving crime

Cyber forensics does not only involve cybercrimes but it is used to solve real-world crimes like theft cases, murder, and terrorism. It helps the relevant authorities to trace the criminal by collecting appropriate cyber evidence. it also helps innocent people to prove their innocence through the evidence collected online. It also applies to the businesses to track the systems breaking and finding the attackers. (Mohammad Sameen Reshi, 2019) The other reason why this field of study has become so important includes the increased cases of cybercrime. According to the National Crime Records Bureau (NCRB) report for 2022, the number of cognizable crimes registered in India has tripled compared to 2021. (Singh R, 2023) This represents a major surge in criminal activity across the country and may come up to four times more than the present day”.

Therefore, cyber forensic experts play a critical role in

curbing these hostile acts identifying the actual culprits, and assisting the cybersecurity specialists in locating the hackers and crackers. cyber forensics is an important tool that is used to solve all types of crimes ranging from cyber-based crimes to other real-world crimes. The field helps in gathering and analyzing the cyber evidence, releasing the wrongly accused, and identifying the criminal. With the increased application of technology and the rate at which cybercrime is evolving, the importance of cyber forensics will continue to grow. The world in this current age has taken a step closer to digitization. This has not only embodied virtually every daily life remotely, but cyber forensics is being used in criminal cases today and is undoubtedly one of the delightful factors to the neighborhood, national, and international justice systems.

Currently, cybersecurity professionals are involved in offering investigation assistance not just in convicting the guilty and acquiring vindictive evidence but also in identifying exculpatory proof for the innocent. (EC-Council, 2023) Figure 1 Source: Phases of the forensic examination procedure as per National Institute of Standards and Technology (NIST) 2006

2.1 Forensics Experts Make It Hard to Be a Cybercriminal

People think of computer and computer crimes whenever they hear the word cyber forensics in criminal cases. In most cases, they are correct. For starters, cybercrime has been on the rise, and understandably so. Phishing has always been a risk, but hacks with the tools hackers have created recently have outpaced our previous hopes. They even manage well without a social engineering component. Cyber forensics experts can track down illicit bank accounts, identify the origin of attacks, identify your system’s vulnerabilities, and conduct a plethora of other similarly complicated actions. The largest cybercrimes ever committed have resulted in billions of dollars in losses. Despite initial success, (EC-Council, 2023; Yakowicz, 2015) Cyber

forensic investigators have developed tools to investigate beyond these computer crimes. When applied to criminal cases, cyber forensics can help us apprehend cybercriminals before they conduct the crime.

2.2 Collection of Criminal Evidence

When people think of forensics, their minds may conjure images of CSI professionals carefully combing through every facet of evidence at a crime scene. It’s a similar experience with cyber forensics, as the evidence is also being sought out but on a computing device rather than an application. This evidence could be in the shape of “cyber footprints” a hacker makes after he or she successfully infiltrates a large corporation’s system. The application of cyber forensics to civil and criminal issues has particularly helped combat fraud in criminal law. Forensics specialists who have access to this encrypted data have successfully prosecuted the following crimes: sexual assaults; murders and terrorism.

2.3 Exonerating the Innocent

The recent exposure of numerous wrongful convictions in the media has appealed to more people to become defendant advocates. In criminal cases, cyber forensics usually works for the prosecution. Criminal forensics works to overturn convictions. Cyber Evidence Innocence Initiatives use cyber evidence specifically to overturn wrongful convictions. The problem is that it only can be used after the fact. While the accused lacks the cyber access that the state has its power over, the state can subpoena the service providers of the accused. Although there is no legal alternative for service providers to cooperate with a defendant, a cyber forensics expert can still help prove the convicted parties’ innocence after the conviction occurs.

2.4 Fixing the Investigative Backlog with New Cybersecurity Professionals

One of the most important ones is attrition; according to the Federal Bureau of Labor Statistics,

2022 (Bureau of Labor Statistics, 2024) through 2030, there will be over 16,000 new openings

per year. Information security analysts, many from changing industries or dropping out of the workforce. The shortages would be to someone entering the field’s benefit. Even if you are currently working in cybersecurity or believe it is not the right moment to start a criminal justice career, it is. The time for choosing to become a cyber forensics investigator is now. There is a huge backlog in evidence and investigation that cyber analysis can solve, including at the

international level. (Barnes & Sanger, 2021). Without people to use them, the best cyber forensics tools would be worthless for criminal justice.

2.5 Reopening and Solving Cold Cases

The short supply of computer hacking forensic experts and the lack of them on hand during criminal cases is one of the few areas of despair in forensic cold cases. Yet the trend of reviving cold cases solves this problem as well; modern investigations still need these professionals, while some of such cases don’t even include a computer. “Although the shortage of computer hacking forensics experts for all the criminal cases is a concern, the reenergized interest in cold cases has the power to change it”. Additionally, adding old evidence to the expanding database is simply a strong weapon in the fight against this issue; the information on these cold cases is extremely useful. “But adding the old evidence to the database is a powerful weapon against it, and what prescription for any aging computer can be greater than adding new memories to help it function?”. (Eclipse Forensics, 2021)

2.6 Enter the World of Cyber forensic Investigation

Forensics is still one of the most romanticized parts of criminal justice. However, most potential employees willing to become Cyber forensic investigators lack the necessary cybersecurity skills to enter the industry. If you want to earn your living working in criminal justice as a cyber forensic investigator, it is the perfect moment to start. EC-Council’s Certified Hacking Forensics Investigator focuses on cyber forensics and evidence analysis and is labdriven and ANSI accredited. It is suitable for every IT professional preparing to change the field, and even currently practicing cyber forensic investigators willing to improve the existing knowledge.

3. Techniques and tools used in Cyber forensic

Cyber forensics is also referred to as cyber forensics. The latter is a segment of technology that involves an investigation of identification and evidence collection, preservation, and storage from electronic gadgets. Additionally, cyber forensic investigators gather evidence retrieved from their cyber investigations to facilitate probes and restore familiarity via the compromised evidence. The forensic techniques that are coupled with an array of survey data to gather information are known as tools used for forensic investigation. On the other hand, Cyber

forensic gurus deploy various software-specific tools to unearth and analyze cyber data. Such tools include those developed for data recovery, data decryption, network packet analysis, enumeration of past and present activity, and end-user data analysis revolving around network threats and data sources. (B.V. Prasanthi, 2016)

3.1.1 Forensic imaging tools: - It comprises software tools designed for creating an image of

a cyber device accurately replicating the contents of a target. They serve to provide sufficient evidence while keeping the original intact. EnCase, Access Data FTK, Cellebrite, and X-Ways Forensics are some of the popular forensic imaging tools.

3.1.2 Data recovery tools: - It aims to restore inaccessible files resulting from deletion or

damage. Such applications reconstruct file system structures, scour storage devices for leftover file remnants, and piece back together corrupted or reformatted information. R-Studio excels at carving data remnants while Get Data Back precisely scans for residual file signatures. Recuva offers user-friendly scans to find and rebuild both simple deleted files and specialized partition tables. Additionally, photo rec conducts low-level recovery of partitions and lost photos without requiring original file system data. Overall, a variety of data recovery tools exist to handle diverse situations requiring file salvage through specialized forensic methods.

3.1.3 Network forensics tools: -This tool is designed to capture network traffic and identify

potential threats or unauthorized network access. Wireshark, Network Miner, and Security Onion are among the best-known network forensic tools.

3.1.4 Malware analysis tools: -This tool was created for malware identification and analysis.

They dissect and reverse-engineer malware, determining its genetic sequence and other characteristic behaviors. IDA Pro, Olly Dbg, and Wireshark are popular examples of malware analysis tools.

4. Legal framework for Cyber Forensics as per Information Technology (I.T) Act 2000,

with amendments The confluence of legal paradigms, i.e., the Information Technology Act, 2000 has made the legal domain at par with the contemporary challenges of cyberspace. Suhas Katti v. State of Tamil Naidu (Suhas Katti, 2004) related to cyber forensics was the distribution of filthy, defamatory, and annoying messages concerning a lady. The offender in

this incident cyberbullied the victim by sending filthy texts established a fake email address in the plaintiff’s name and used it to post libelous information on the net. The convicted was indicted under Section 469 and 509 of the Indian Penal Code, 1860, and Section 67 of the Information Technology Act, 2000. This is a critical case because it emphasizes the law’s reliance on cyber proof, particularly under the 65B section of the Indian Evidence Act, thus establishing a threshold for cybercrime prosecution. Another important issue that was revealed by Section 79A of the IT is the issue of confidence in cyber evidence.

Therein, “electronic evidence” was defined as evidence that is transmitted or stored in cyber form and includes computer evidence, cyber-sounding recordings, cybersounding visual images, and any other information that may be stored in any cyber manner such as telephones, or cyber fax machines. In other words, this IT provides a legal foundation for the Central Government of India (as specified in Section 79A of the Information Technology Act, 2000) to appoint any department or agency of the Central government or any state government to be the Examiner of Electronic Evidence. For every law, there has to be enforcement, and a law without an enforcement mechanism is toothless. Therefore, it is relevant to understand the mechanism too.

In this case, the effect and the nature of the computer-related crime become relevant, whether it is used to carry out dishonestly or fraudulently any activity as a means, or a tall target is given Section 66 of the Information Technology (Amendment) Act, 2008 (as specified in Section 66 of the Information Technology Act, 2000) As made clear, any act can only be covered or investigated in the present legislation be an act as recognized under section 43 of the Act which can only be an offence when done with dishonest and fraudulent intentions as expressed under sections 24 and

25 of the Indian Penal. If the act does not meet the above criteria, then it will only be found as

an offence and it does not fall under the jurisdiction of the Organized Crime Task Force and cannot undergo further investigations on cybercrime. (Rishi, 2019) In this stage, the complainant could approach either cyber-crime police stations or the cops in its absence. As soon as the person gets to know that the gathered information highlights the revelation of a cognizable offence purporting to have been committed under the IT (Amendment) Act, 2000, the nature/modus operandi of cyber-crime is noted down along with adjudicate documents like, server logs, copy of defaced web page in soft copy and hard copy, etc to the complaint. (Kethineni, S., 2020). Subsequently, a preliminary inquiry of the entire

scene of the offence is carried out to locate the possible evidence and to come up with the initial assessment of the same. The pre-investigation dialectal assessment should be conducted to ascertain relative details regarding the scope of the crime and the whereabouts of the parties concerned. A preservation notice is issued to all the affected parties where necessary so that they can preserve valid scientific evidence. Containment ought to be done to block the access of the affected machine and terminate access to it so that it may not be interfered with and its integrity might not be compromised. For instance, in case of financial fraud, the IO may ask the bank to stop the freeze of the account of the suspect.

When evidence is to be seized the procedure for collection of the evidence from switched-off systems and live systems is based on the mandate of search and seizure under Section 165, CrPC, and Section 80 of the IT (Amendment) Act, 2008 and shall find its reflection in the Pachamama. Nevertheless, it is also essential to avert the fabrication and spoliation of the cyber evidence by preserving the chain of custody of the evidence from the time of its seizure to transferral it to a forensic laboratory for analysis and presentation in the court of law to prove its authenticity. Hashing is broadly utilized in ensuring the integrity of forensic evidence and media.

Hash integrity verification entails the following methods: Hashing is a commonly used method of ensuring the integrity of evidence, particularly media, through the following ways: Hashing refers to a cryptographic hash function algorithm, which is a mathematical function that produces “cyber fingerprints” of the message, often referred to as a “message digest”. Hashing returns a “hash value” or “hash result”, a standard length of a practically unique message. (Aishwarya Lakshmi, K. , Honnavali, P. B. , Rajashree, S. ,2021). In the Cyber Evidence Collection Form, the IO documents the process, tools used, hash values obtained from forensic images, and the hashing algorithm. Under section 72 of the IT Amendment Act, 2008, an IO may be criminally convicted in case of a failure to maintain a chain of custody and proper documentation.

Next, the evidence is packaged, labeled, tagged, and updated on the evidence database. The custody may be retained by sending the hardware for forensic analysis or by withholding the issued orders by the court. The cyber evidence is sealed and remarks and the signature of the sealant and the IO are noted on the seal. Finally, where releases are sought, the forensically imaged copy is sent for investigation. The cybercrime investigation also requires external information used in analyzing the time-zone conversions showing the incident’s exactitude, and transformation of the internal user ID to the real user ID is critical. Information is gathered from ISPs, mobile service providers, social

networking websites, financial institutions, and website domains, and correlated with lab results to re-construct the case. (Asawat, 2010)

5. Legal framework for Cyber Forensics as per Indian Evidence Act, 1872 with

amendments The confluence of legal paradigms, i. e. the law of evidence has made the legal domain stand at par with the contemporary challenges of cyberspace. Firstly, the traditional law defining the term Evidence was amended to include electronic evidence in Section 3, The Evidence Act, 1872, and other parallel legal recognition in Section 4, The Information Technology Amendment Act, 2008 makes the matter in electronic form to be accepted and is to be ‘treated as ‘written’ if the need arises. These both show a prima facie acceptability of cyber evidence in any trial. Concerning the admissibility of electronic records, Section 65-B of the Evidence Act, of 1872 was laid out where various conditions were enunciated.

Since cyber evidence ought to be collected and preserved in certain form, their admissibility and the same ought to be collected and preserved in certain forms, their admissibility of the media content imbibing storage devices from the crime site also becomes an important factor. Reading Section 3 and Section 65-B, The Evidence Act, 1872, cumulatively, it can be inferred that certain computer outputs of the original electronic record, e. g. the matter on computer printouts and floppy disks and CDs, “are now made admissible as evidence “without proof or production of the original record”. (Ranjan, 2020)

6. Balancing the procedures of cyber forensics investigations with privacy concerns is

essential for ethical practices. With the increasing use of cyber technology, a new set of problems with an existing one has emerged within privacy and security. It is the ethical issue of the use of cyber forensics, which defined is the collection, preservation, and analysis of electronic device data utilized to support legal and investigation processes. While cyber forensics can support law enforcement and cooperate with the investigatory organization, the practice also raises a critical ethical issue regarding how to approach the need for investigation and individual privacy. The primary ethical concern in this regard is the invasion of privacy. Researcher suggests that there has been a lack of authorization and approval required to access private data and information.

One of the most famous examples related to the issue is the Apple case in 2016 when the FBI demanded that Apple create a so-called backdoor to access the iPhone of the shooter of San

Bernardino. Several “anti-privacy” groups decided that if the company gives the information, then it will give one to them about the Bank system. Following government information in 2016, such as camera footage, “phone calls and banking transactions,” or “phone records” this will lead to the relinquishment of civil liberties or sparking public safety concerns. Furthermore, another critical ethical issue is the issue of bias and discrimination. Especially, when the white skin and gender inequality continue to appear, such data analysis tools might be misused by other institutions. For instance, in 2018 on the iv-blind face-scoring AI, the system was identified as functionally by gender and race, with a 99% certainty in relation to C-group physicist. Additionally, with the same control, race and gender have been strongly built.

Finally, there are also concerns about the accuracy and reliability of cyber forensics. As technology advances, it becomes easier to manipulate and alter cyber evidence, making it difficult for forensic professionals to conduct accurate investigations. For example, as early as 2017, researchers at the University of Washington created a software tool that could “create” realistic video clips of famous individuals saying things they never did. This clip was an early example of a deepfake. Even if this is still a relatively new technology, it presses questions on forensic specialists’ ability to accurately and reliably comb through cyber evidence. Although there are ethical concerns with the current state of the issue, it is still an instrumental instrument for law enforcement and businesses to make use of.

In most cases, it factually solves crimes and asserts the people linked to criminal acts accountable. Nevertheless, ethical and legal requirements must be instituted to ensure that the investigations completed are above board and up to code, all safeguarding the rights of privacy and discrimination-free while ensuring no bias or misinterpretation is widely adopted. This will take a high degree of scrutiny, accountability, and responsibility from forensic specialists and continue their learning to adapt to this new field. Industry requirements are one way to move forward, establishing and following rules for cyber forensics specialists in their line of duty. For example, the ASCLD has a lab protocol guide for cyber and multimedia evidence, providing a method on how they should approach, identify hazards, assess evidence.

Applying industry standards will ensure consistency and reliability in the field of forensics, among other ethical problems. We can further reach a consensus to forge understanding among forensic specialists, security specialists and various other stakeholders. The former would be accomplished by identifying concerns to all these groups while figuring out compromises which exist between security needs and privacy rights. Through cooperation, a mutually agreed accord can ensure a level of trust and

confidence in cyber forensics which will ensure it is conducted ethically and responsibly. All in all, ethics in cyber forensics is a multidimensional problem which requires consideration on the scale between guard needs and privacy concerns. However, it is an essential tool for law enforcement to have under their belt in their fight against crime, cyber or otherwise. To ensure forensic investigators conduct forensic investigations ethically, standardization with guidelines is crucial, awareness and conversation, a level of transparency, and investigation with a sense of responsibility. Continued learning for cyber forensic investigators to review their findings with bias and privacy upkeep should be more frequent than before. This will include recognizing one’s bias, familiarizing themselves with privacy laws, and assurance that collected data for whatever case is correct and reliable.

In so doing, forensic specialists can continue to expand awareness and consideration in their field of work. Policymakers also need to help push for ethics in forensic movies due to the ease and importance of cyber autonomy coefficient. They should also help in promoting this matter, as a society they should generate conversation which in turn increases accountability among forensic investigators and law enforcement. (Jaju, 2023) There is a significant issue in the ethics of cyber forensics that should be addressed by professionals, policymakers, and societies. Ethical protocol should address the need for the means of investigations and the protection and harassment of individual personal life and behavior. The option is made to the investigation be in line with ethical and fair: conduct it.

Cooperation, honesty and record retrieval, and learning create ethical cyber forensics for the benefit of the individual and for the sake of justice and safety.

7. Judicial Pronouncements of cyber forensic in India

1.The Aarushi Talwar-Hemraj Double murder case: (Talwar V State of U.P, 2017) The Aarushi Talwar-Hemraj double murder case of 2008 is an example where cyber forensics was instrumental in the examination of electronic evidences. Using computer data, emails and phone records cyber traces reconstruct the communication and interaction process of victims with potential suspects. The analysis of cyber footprints handles and integrity challenges to provide information on the victim’s activities and evaluation of possible leads. 2.The 26/11 Mumbai Terror Attacks (Deshpande, 2010) In 2008, during the Mumbai terror attacks, cyber forensics was used to analyze communication

networks and electronic data. Phone records, emails, GPS data, and internet logs were used to trace back the activities and communication channels of the terrorists. Modern cyber forensics and evidence aggregation were used to recreate the timeline for the investigation where the established cyber communication network was encrypted with access from different jurisdictions. On analyzing these data, the law enforcement helped piece up these events and identify all suspected individuals. 3. The Vyapam Scam: (Srivastava, 2017) The other situation one has used cyber forensics is in a case threatening admission and recruitment in the Madhya Pradesh state called Vyapam scam. Computers, emails and all financial transition forms were analyzed to detect the variations and deceitful tricks employed to twist the procedure of the appraisal.

Cyber forensics was helpful in linking the evidence and discerning the major affiliates in it. 4. Sunanda Pushkar Death case (Mateen, 2021) Cyber forensic took place in the process of investigating the death of Sunanda Pushkar, the wife of the Indian politician Shashi Tharoor. Based on the victim’s history and recent evidence, the examination of electronic devices, including mobile phones and laptops, helped to understand the picture before her death. Additionally, to detect possible motives and connections, cyber forensics provided evidence of the data available on connections, social media, and online presence. Despite limited access to some personal data, the forensic cyber analysis presented the details of the case. 5.

The Unnao Rape case (Singh, 2020) In the Unnao Rape case of Uttar Pradesh in which the legislator was charged with a molestation case, Cyber forensic analysis was done to probe electronic evidence. The investigators looked at the victim’s doctoring phone, social networking accounts, and communication database or logging to investigate the patterns and chronology of the incident. The Cyber forensic professionals have recovered the essential evidence and played a crucial role in building the case firmer.

8. CHALLENGES FACED BY CYBER FORENSICS

The growth and development in the technology makes it a threat for existing methods of

forensic science. Some challenges are (Shubham Maheshwari & Nandini Sharma, 2021)

8.1 Admissibility of evidence

The major problem after the investigation will be proving the evidence in the court of law. Besides, another problem will be the collection of the evidence because the technology is advancing very fast. An expert will be required for the preparation of the opinion on the use of the information during the investigation. The cyber evidence will be submitted if it is bound not to take sides in the case, but it is banked to the knowledge that it is the most difficult of evidence because cyber evidence can be tampered with easily because of cybercrimes.

8.2 Advancement of Encryption

The encryption is evolving with advancement of the technology which gives makes it difficult to decrypt the same for the specialist. As the encrypted messages contain important files which may be important to the case.

8.3 Anti-forensics

This method makes it difficult for cyber forensic analysts to locate data sources by altering, concealing, or even rendering it unrecoverable while examining the source.

8.4 Lack of standardization

Technology advances are also a major problem because they do not provide an opportunity to standardize and prepare, the higher the technology, the more difficult it is for a forensic specialist to rely on a single standard. NIST has published a guideline on the standardization of forensic investigation; however, for it to be more applicable and helpful, the update is required for frequent which makes it a challenge to utilize.

9. Conclusion

Cyber forensic investigations are critical in the detection and prevention of complex cyber threats and attacks, in addition to providing essential evidence for a court of law. The incidentbased method of cyber forensics has a variation in the styles of managing probes, allowing an investigator to shift his or her approach based on different factors of the particular case. This article has covered the main aspects, methodologies, and best practices of cyber forensics, with

a focus on the incident-based technique. By reviewing relevant literature, documented cases, and examples, the paper found that identifying incidents and initiating a response, securing and preserving obtained evidence, performing. Cyber forensic analysis, and presenting cyber evidence and finding reports have been emphasized. They have also identified several key challenges and trends in the field of cyber forensics, including rapidly growing cyber threats, using artificial intelligence and machine learning, and finding a balance between privacy concerns and investigative goals. As the field of cyber forensic continues to evolve, various challenges will notoriously develop and make it difficult for professionals, researchers, and policymakers to implement effective strategies while respecting individual privacy and human rights.

Cyber forensics has a cross-domain impact, assisting in the resolution of high-profile crimes such as the BTK serial killer case to protect corporate systems. It sorts through fragmented cyber files to provide compelling evidence; it is the link between law enforcement and the protection of public and private lives. With great power come significant responsibilities. Pursuit of truth must coexist with privacy, civil liberties, and legal law. Ethics serve as a reminder. Striking a balance is necessary to retain the field’s objectivity and reliability. Taking the previously discussed thoughts into account, cyber forensics is not only an aggregation of tools or technology but a purpose that couple’s creativity with a human need for protection and justice. Its relevance has never been clearer, indicating that justice must be achieved in both the physical and cyberspace realms.

The potentiality for cyber forensics is massive, and it paints a picture of a future that is both more secure and just.

REFERENCES

1. Saharan, S., Yadav, B. (2022). Digital and Cyber Forensics: A Contemporary Evolution in

Forensic Sciences. In: Singh, J., Sharma, N.R. (eds) Crime Scene Management within Forensic Science. Springer, Singapore. https://doi.org/10.1007/978-981-16-6683-4_11

2. Rohatgi S, Shrivastava S (2023) Combating cybercrimes with Digital Forensics.

Advancements in Cybercrime Investigation and Digital Forensics 97–113. doi: 10.1201/9781003369479-5

3. Krishnan S, Zhou B (2020a) Predicting crime scene location details for First Responders.

2020 8th International Symposium on Digital Forensics and Security (ISDFS). doi:

10.1109/isdfs49300.2020.9116386

4. Curtis J, Oxburgh G (2022a) Understanding cybercrime in ‘real world’ policing and law

enforcement. The Police Journal: Theory, Practice and Principles 96:573–592. doi: 10.1177/0032258x221107584

5. Cremer F, Sheehan B, Fortmann M, et al (2022) Cyber risk and cybersecurity: A systematic

review of data availability. The Geneva Papers on Risk and Insurance - Issues and Practice 47:698–736. doi: 10.1057/s41288-022-00266-6

6. Mohamed N (2023) Current trends in AI and ML for cybersecurity: A state-of-the-art survey.

Cogent Engineering. doi: 10.1080/23311916.2023.2272358

7. Admin (2023) What is Digital Forensics: Process, tools, and types: Computer Forensics

overview. In: RecFaces. https://recfaces.com/articles/digital-forensics. Accessed 23 Apr 2024

8. Anderson P, Sampson D, Gilroy S (2021) Digital investigations: Relevance and confidence

in disclosure. ERA Forum 22:587–599. doi: 10.1007/s12027-021-00687-1

9. David Mugisha (2019) In: (PDF) Digital Forensics: Digital Evidence in Judicial System.

https://www.researchgate.net/publication/332245703_DIGITAL_FORENSICS_Digital_Evid ence_In_Judicial_System. Accessed 23 Apr 2024a

10. Robin Whitley & Debra Figarelli (2009) In: A simplified guide to crime scene investigation.

https://www.forensicsciencesimplified.org/csi/CrimeSceneInvestigation.pdf. Accessed 23 Apr 2024a

11. Sean E. Goodison, Robert C. Davis, Brian A. Jackson (2015) In: Digital Evidence and the

U.S. Criminal Justice System. https://www.ojp.gov/pdffiles1/nij/grants/248770.pdf. Accessed

23 Apr 2024a

12. Eclipse Forensics (2024) 3 famous cases solved through digital forensics. In: Eclipse

Forensics.https://eclipseforensics.com/3-famous-cases-solved-through-digital-forensics/. Accessed 23 Apr 2024.

13. Barnes JE, Sanger DE (2021) U.S. is said to have unexamined intelligence to pore over on

virus origins. In: The New York Times. https://www.nytimes.com/2021/05/28/us/politics/coronavirus-origins-intelligence.html .Accessed 23 Apr 2024

14. Yakowicz (2015) In: Companies lose $400 billion to hackers each year | inc.com.

https://www.inc.com/will-yakowicz/cyberattacks-cost-companies-400-billion-each-year.html .Accessed 23 Apr 2024a ,

15. Bureau of Labor Statistics (2024) Information security analysts : Occupational Outlook

Handbook. In: U.S. Bureau of Labor Statistics. https://www.bls.gov/ooh/computer-andinformation-technology/information-security-analysts.htm. Accessed 23 Apr 2024

16. EC-Council (2023) The evolving role of Cyber Forensics in criminal cases. In:

Cybersecurity Exchange. https://www.eccouncil.org/cybersecurity-exchange/computerforensics/cyber-forensics-criminal-cases/ Accessed 23 Apr 2024

17. EC-Council, (2023) Cybersecurity courses, Training & Certification: EC-Council. In:

Cybersecurity Exchange. https://www.eccouncil.org/10-biggest-cyber-crimes-data-breachestill-date/ Accessed 23 Apr 2024

18. Mohammad Sameen Reshi (2019) In: (PDF) Cyber Forensics and Cyber Crime: A

multidimensional study of techniques and issues. https://www.researchgate.net/publication/335568235_Cyber_Forensics_and_Cyber_Crime_A _multidimensional_Study_Of_Techniques_and_issues. Accessed 23 Apr 2024a

19. Singh R (2023) How to read the NCRB 2022 report on crime in India. In: The Indian

Express.https://indianexpress.com/article/explained/ncrb-2022-report-crime-india-limitations- 9054144/ Accessed 23 Apr 2024

20. B.V.

Prasanthi (2016) In:

(PDF)

Cyber Forensic Tools:

A

Review. https://www.researchgate.net/publication/313848609_Cyber_Forensic_Tools_A_Review. Accessed 23 Apr 2024a

21. Suhas Katti v. State of Tamil Nadu, CC No. 4680 of 2004 (2004).

22. Information Technology Act 2000, s 79A, Central Government to notify Examiner of

Electronic Evidence.

23. Information Technology Act 2000, s 66, ‘Computer related offences’

24. Office USGA (2023) Cybercrime: Reporting mechanisms vary, and agencies face

challenges in developing metrics. In: Cybercrime: Reporting Mechanisms Vary, and Agencies Face Challenges in Developing Metrics | U.S. GAO. https://www.gao.gov/products/gao-23-

106080. Accessed 24 Apr 2024

25. Kethineni, S. (2020). Cybercrime in India: Laws, Regulations, and Enforcement

Mechanisms. In: Holt, T., Bossler, A. (eds) The Palgrave Handbook of International Cybercrime and Cyberdeviance. Palgrave Macmillan, Cham. https://doi.org/10.1007/978-3- 319-78440-3_7

26. Aishwarya Lakshmi, K., Honnavali, P.B., Rajashree, S. (2021). Ensure the Validity of

Forensic Evidence by Using a Hash Function. In: Ranganathan, G., Chen, J., Rocha, Á. (eds) Inventive Communication and Computational Technologies. Lecture Notes in Networks and Systems, vol 145. Springer, Singapore. https://doi.org/10.1007/978-981-15-7345-3_28

27. Asawat V (2010) Information technology (amendment) act, 2008: A new vision through a

new change. SSRN Electronic Journal. doi: 10.2139/ssrn.1680152

28. Ranjan P (2020) Resolving the conundrum of requirement of certificate under Section 65B

of Indian Evidence Act, 1872. SSRN Electronic Journal. doi: 10.2139/ssrn.3735354

29. Jaju A (2023) Ethical Digital Forensics – balancing investigation procedures with privacy

concerns - privacy protection - United States. In: Ethical Digital Forensics – Balancing Investigation Procedures With Privacy Concerns - Privacy Protection - United States. https://www.mondaq.com/unitedstates/privacy-protection/1306880/ethical-digital-forensics-- balancing-investigation-procedures-with-privacy-concerns. Accessed 24 Apr 2024

30. Talwar, N. v. State of U.P. and Anr. (2017) Dr. (Smt.) Nupur Talwar vs State Of U.P. And

Anr. on 12 October, 2017. Allahabad High Court

31. Deshpande, R. (2010) ‘Terror at the Taj Bombay: Customer-Centric Leadership’, Harvard

Business Publishing Education.

32. Srivastava, V. (2017) ‘Vyapam Scam: The CBI’s Clean Chit Is Not the Final Word on the

Matter’, The Wire.

33. Mateen, Z. (2021) ‘Sunanda Pushkar case: Shashi Tharoor cleared of wife’s murder’, BBC

News

34. Singh, P. (2020) ‘The 2017 Unnao Rape case - A complete case study’, iPleaders Blog

35. In: “Cyber forensic: A new approach to combat ... http://www.penacclaims.com/wpcontent/uploads/2021/05/Shubham-Maheshwari.pdf. Accessed 24 Apr 2024a