Cyber Laws, Ethics and Digital Forensics
Domain focus
Cyber Laws, Ethics and Digital Forensics tests lawful and ethical handling of cyber incidents and evidence, including key Indian legal provisions, authorisation, privacy and forensic process.
Core rules and concepts
- The Information Technology Act, 2000, as amended, covers offences such as identity theft, cheating by personation, privacy violation, cyber terrorism and obscene material. Sections 66C, 66D, 66E, 66F and 67 are commonly cited.
- Ethical work requires written authorisation, defined scope, privacy protection and responsible disclosure. Unauthorised scanning or access is not testing.
- Forensic evidence must be admissible and trustworthy: document the scene, maintain chain of custody, use write blockers, image media, and hash before and after acquisition.
- Follow order of volatility: collect memory and live network data before powering down, then disks, then archival backups.
- Work on copies; preserve the original device and record every transfer and action.
Worked example
A college laptop is suspected of hosting illegal files. The investigator photographs the device, records serial numbers, uses a write blocker to image the drive, computes a cryptographic hash of the image, documents the chain of custody, and analyses only the copy. Reasoning: the original remains unaltered; matching hashes support integrity; documented custody supports admissibility.
Traps that cost marks
Do not boot or browse the original evidence device. Do not assume deleting a file removes all traces. Do not omit hashes or custody records. Do not investigate personal data without legal authority. Do not cite a section without knowing its offence category.