Cyber Law and Digital Forensics Basics
Cyber Law and Digital Forensics Basics tests Indian IT Act provisions, cybercrime classification, evidence handling and investigation steps. Know section numbers and the order of volatility.
Core rules
- IT Act 2000, amended in 2008: Section 43 covers damage to a computer; Section 65 covers tampering with source code; Section 66 covers computer-related offences; 66C identity theft; 66D cheating by personation; 66E privacy violation; 67 obscene material; 69 interception or monitoring powers; 72 breach of confidentiality.
- Cybercrime examples include phishing, identity theft, ransomware, cyberstalking, credit-card fraud and unauthorised access.
- Digital forensics steps: identify, preserve, acquire, examine, analyse and report. Maintain chain of custody; use a write blocker; image before analysis; hash the image with SHA-256 and verify.
- Order of volatility: CPU registers/cache, RAM, swap, disk, backups and archives. Collect volatile data first.
- Report cyber fraud on helpline 1930; preserve logs, screenshots and devices; avoid booting seized devices unnecessarily.
Worked example
A seized hard disk is imaged and the image hash equals the original hash. Investigators analyse the copy, not the original. Reasoning: a matching hash supports integrity, and a write blocker prevents changes to the source evidence.
Traps
Section 66 is not the obscenity section; 67 is. A hash match does not prove authorship. Do not analyse original evidence directly if a verified copy exists. 1930 is the cyber-fraud helpline, not the unified emergency number 112.