Readiness note. This is a private training programme. It builds knowledge and readiness. It does not grant any official certificate, licence, or government recognition, and it does not create any affiliation with a regulator or an agency. On passing, learners receive a Record of Completion.
Mission briefing
This lesson begins the part of the course on devices and forensic practice. It builds on the foundations. It looks at how complex electronic evidence is handled in practice. The topics are understanding digital crime, collecting evidence safely, and meeting legal tests. The lesson also covers imaging digital media, recovering lost data, and examining mobile devices.
Focus: understand the careful, documented methods used for advanced evidence. These methods keep it reliable and admissible. Admissible means that a court can accept it.
Learning objectives
By the end of this lesson, you will be able to:
- Describe common types of digital crime and cyber threats.
- Explain the best way to collect and preserve electronic evidence.
- Explain why the legal framework decides whether evidence can be used.
- Describe forensic imaging, data recovery, and mobile-device examination in outline.
Why this matters to you. Officers learn what the laboratory does with a seized device. Lawyers learn where to look for weak points, for either side. Students see the method behind an expert report. Company teams use the same steps after an incident. This lesson gives knowledge only: it does not train anyone to operate forensic tools.
1. Digital crime and cyber investigations
Digital crime takes many forms. Examples are hacking, online fraud, identity theft, data breaches, and cyberstalking. A data breach is a leak or theft of data. Electronic evidence is at the centre of every such case.
Those who investigate must be able to:
- Recognise the different types of crime and threat.
- Work out which digital channels and devices may hold evidence.
- Choose the right methods for each case. Work with other agencies where a crime crosses borders.
The goal is to link activity to a person or group. The methods must be sound and documented.
2. Collecting and preserving evidence
How evidence is gathered decides whether it can be trusted later. Two practices are essential:
- Write-blocking. Use tools that let an examiner read a device without changing anything on it. This protects the original from change by mistake. A write-blocker cannot always be used. Most phones are an example. In that case, record exactly what you did and why.
- Chain of custody. Record every step in the evidence's journey from the scene to the court. Record who handled it, when, and why. This shows that nobody tampered with the evidence.
Evidence may come from computers, mobile devices, and cloud storage. Cloud storage is data kept online on a provider's servers. For all of them, the aim is the same. Protect integrity. Integrity means that the evidence stays complete and unchanged. Then the evidence keeps its value and stays admissible.
3. The legal framework
Strong evidence can lose its value if it was gathered unlawfully. Everyone who handles it must know:
- Search-and-seizure rules — the authority needed to access and take devices and data.
- Privacy law — the limits on what may be collected and how.
- Rules of evidence — what a court needs before it will accept an electronic record.
Important. If proper legal procedure is not followed, the evidence may be excluded or given less weight. The officer may also face legal action. The rule differs by country. Admissibility depends on lawful collection and careful documentation. The technical result alone is not enough. Unit K8 (Unlawfully Obtained Evidence and Exclusion) compares the rules.
4. Forensic imaging and analysis
Forensic imaging means making an exact, "bit-by-bit" copy of a storage device. A hard drive and a USB drive are storage devices. Bit-by-bit means that every single unit of data is copied. The investigator then works on the copy. The original stays untouched.
- The copy is called an image. It captures everything. This includes areas that a normal file copy would miss.
- Specialist tools analyse the image. They can reveal deleted files, browsing history, chat logs, metadata, and hidden data. Metadata is data about data, such as the date a file was made.
- The original stays untouched. So another expert can repeat the work and reach the same result.
5. Data recovery
Data recovery gets back deleted, damaged, or hidden data. Useful techniques include:
- File carving — rebuilding deleted files from the fragments left behind.
- Examining unallocated and slack space — the parts of a disk that are marked as free or unused. These parts may still hold data.
Recovery has limits. It depends on the type of storage and on encryption. On many modern phones and solid-state drives, deleted data is erased quickly. It cannot be recovered.
Recovered data can decide a criminal case. It can also bring back lost business data after an incident.
6. Mobile-device forensics
Phones and tablets hold large amounts of personal data. So mobile-device forensics is now central to many cases. Specialists learn to extract and make sense of:
- Call logs and text messages.
- App data and cloud-linked data.
- Location and geolocation data, which show where a device has been.
Phones and tablets also bring special problems. Encryption and passcodes are two of them. This is why specialist tools and lawful authority are both needed. Units 14A to 14D take phones, computers, cloud accounts, and video in turn.
Country note — India
Checked on 7 October 2026.
- Search and seizure. Under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), a search and the seizure list must be recorded by audio-video means, and the recording sent to a Magistrate without delay (sections 105 and 185). For offences punishable with seven years or more, a forensic expert must visit the scene, from a date each State notifies (section 176(3)). The police report must state the sequence of custody of an electronic device (section 193(3)). Unit 7D (India: Recording Search and Seizure) explains these duties.
- Decryption. Under Section 69 of the Information Technology Act, 2000, the government can order interception, monitoring, or decryption. A subscriber, an intermediary, or a person in charge of a computer resource must then give technical assistance. Refusing is an offence. Whether an accused person can be made to give a passcode is a separate and unsettled question: see unit 14A (Mobile Devices: Extraction Levels, Locks and App Data). Do not coerce.
- Personal data. The Digital Personal Data Protection Act, 2023 is coming into force in stages: its Rules were notified in November 2025, and most duties start in May 2027. Section 17(1)(c) exempts processing for the investigation of offences from most of those duties. It is not a blanket exemption: the duty to keep the data secure still applies.
- Unlawfully obtained evidence. Indian courts do not, as a general rule, shut out relevant evidence only because it was obtained unlawfully. That does not make an unlawful act acceptable, and the officer may still face legal action.
- In court. A copy or printout of an electronic record must be accompanied by the certificate under Section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023 (BSA), which replaced Section 65B of the old Indian Evidence Act from 1 July 2024. Unit 1B (India: The Section 63 Certificate) explains it.
- Unit 10B (India: Official Data Systems an Investigator Meets) describes the national cybercrime reporting portal and other official systems.
Activity — keep it admissible
An officer seizes a suspect's laptop and phone at a scene.
- Which tool or practice keeps the laptop's data unchanged while it is examined?
- What record must be kept from the moment the devices are seized, and why?
- Name one reason a court might refuse the evidence, or give it less weight, even though it was technically recovered.
Discuss how each technical step connects to a legal requirement.
Conclusion
You have completed this lesson. You now know:
- The common types of digital crime.
- Best practice for collecting evidence: write-blocking and chain of custody.
- Why the legal framework decides admissibility.
- What forensic imaging, data recovery, and mobile-device forensics involve.
The final lesson looks at IoT evidence, anti-forensics, encryption, ethics, reporting, and emerging technology.
Complete the Learning Check for this lesson before you move on.