28. Introduction to Digital Forensics
28.6 Forensics, Incident Response and the Law
Forensics ekta chalat nahi – to incident response cha bhag aahe (Part 11 madhe purna baghu). Breach zalyavar order asa:
- Detect the incident (SOC, alerts – Part 11).
- Contain it (isolate the affected machine).
- Preserve evidence – image disks, capture memory, save logs (this chapter).
- Analyse – what happened, how, what was taken.
- Report and recover – fix, restore, and improve.
A note on Indian law: digital evidence is admissible under the Indian Evidence Act with a proper Section 65B certificate for electronic records (verify the current provisions yourself). CERT-In requires certain incidents to be reported. This is why chain of custody and integrity hashing matter so much – without them, good evidence can be thrown out.
Why this matters for security
After an attack, forensics answers the questions that stop the next one: how did they get in, what did they touch, and is it fully cleaned up? Done properly, it also turns an incident into evidence that can support legal action.
Ravindra Bagale's Tip
Interview madhe "breach zala, pahila kay karshil?" vichartat. Uttar: ghaburun sagla delete/reboot karne nahi! Aadhi containment ani evidence preserve (image + memory + logs). Reboot kela tar RAM madhla purava kayamcha jato. Shant dokyane process follow kara.
Practice task
Write the six incident-response steps in order and mark which one this chapter covered. In one line, explain why rebooting a compromised machine immediately can destroy evidence.