3.1 Introduction
3.2 What is CERT-In?
3.3 CERT-In Services
3.4 CERT-In Guidelines (2022 Mandatory Reporting)
3.5 Incidents That MUST Be Reported to CERT-In
3.6 How to Report to CERT-In
3.7 National Cyber Crime Reporting Portal
3.8 Types of Complaints on the Portal
3.9 How to File a Complaint
3.10 What Happens After You Report?
3.11 What is Digital Evidence?
3.12 Legal Status of Digital Evidence in India
3.13 Principles of Digital Evidence Handling
3.14 Digital Forensics Process
3.15 Types of Digital Forensics
3.16 Common Digital Forensics Tools
3.17 Chain of Custody
3.18 What is an Incident?
3.19 Types of Security Incidents
3.20 Incident Response Lifecycle
3.21 Incident Severity Classification
3.22 Incident Report Template

3.1 Introduction

When a cyber crime occurs, two critical actions follow:

Incident Reporting — Notifying the appropriate authorities
Digital Evidence Collection — Preserving proof of the crime

This tutorial covers CERT-In, Cyber Crime Reporting, Digital Evidence, and Incident Reporting in detail.

Part A: CERT-In

3.2 What is CERT-In?

CERT-In stands for Indian Computer Emergency Response Team.

It is the national nodal agency for cyber security incident response in India
Functions under the Ministry of Electronics & Information Technology (MeitY)
Established in 2004
Operates 24×7

Mandate

Respond to cyber security incidents
Issue guidelines, advisories, and vulnerability notes
Coordinate cyber incident response activities
Promote awareness and research in cyber security
Collaborate with international CERTs

3.3 CERT-In Services

Service	Description
Incident Response	Handle and coordinate response to cyber incidents
Advisories & Alerts	Publish timely warnings about vulnerabilities and threats
Vulnerability Management	Track, analyse, and coordinate disclosure of vulnerabilities
Malware Analysis	Analyse malware samples to understand behaviour
Forensic Support	Assist law enforcement with digital forensics
Training & Workshops	Conduct cyber security training programs
Security Audit	Empanel security auditors for government organisations
Information Sharing	Maintain early warning systems and share threat intelligence

3.4 CERT-In Guidelines (2022 Mandatory Reporting)

In April 2022, CERT-In issued directions under Section 70B of the IT Act making cyber incident reporting mandatory.

Key Requirements:

Requirement	Detail
Who must report	Service providers, intermediaries, data centres, VPN providers, cloud providers, government agencies
Timeline	Report within 6 hours of noticing or being notified of an incident
What to report	All incidents listed in the directive (see 3.5)
Log retention	Maintain ICT logs for 180 days
Sync clocks	Systems must sync with NTP servers (National Time Protocol)
VPN providers	Must maintain customer details (name, IP, purpose, dates) for 5 years

3.5 Incidents That MUST Be Reported to CERT-In

S.No.	Incident Type
1	Targeted scanning or probing of networks/systems
2	Compromise of critical systems / data breach
3	Unauthorised access to IT systems
4	Malware / ransomware attacks
5	Denial of Service (DoS) / Distributed DoS (DDoS) attacks
6	Website defacement or malicious redirect
7	Phishing attacks and phishing hosting sites
8	Identity theft or identity fraud
9	Data exfiltration
10	Attacks on IoT devices, SCADA, or OT systems
11	Attacks on servers (email, DNS, web, database)
12	Any incident affecting national security or critical infrastructure

3.6 How to Report to CERT-In

Web Portal

Visit cert-in.org.in → Report Incident
Sign up / Log in
Fill the incident reporting form with:
- Organisation details
- Incident type and category
- Date/time of occurrence
- Systems affected (IP addresses, hostnames)
- Impact assessment (data lost, systems compromised, financial loss)
- Technical details (logs, screenshots, malware samples)
Submit and note the Incident Reference Number
CERT-In will acknowledge and may request further information

Email

incident@cert-in.org.in

Phone

+91-11-24368571 (24×7 helpline)

Part B: Cyber Crime Reporting

3.7 National Cyber Crime Reporting Portal

Website: www.cybercrime.gov.in

This is the centralised portal for reporting all types of cyber crimes in India.

Features

Available 24×7
Anonymous reporting option available
Citizen-friendly interface
Track complaint status online
Dedicated portal for Women & Child related crimes

Helpline

1930 — National Cyber Crime Helpline (especially for financial frauds)
Call immediately after a financial cyber fraud, within the golden hour (first 60 minutes)

3.8 Types of Complaints on the Portal

Category	Examples
Financial Fraud	UPI fraud, credit/debit card fraud, net banking fraud, online shopping fraud
Social Media Crime	Fake profiles, harassment, impersonation, bullying
Cyber Stalking	Online tracking and harassment
Identity Theft	Someone using your Aadhaar/PAN/photo/name
Online Defamation	False/defamatory content posted about you
Ransomware	Files locked and ransom demanded
Child Pornography	Any content involving minors
Cryptocurrency Crime	Crypto fraud or scams
Hacking	Email hacked, website defaced, account compromised

3.9 How to File a Complaint (Step by Step)

Online:

Go to cybercrime.gov.in
Click "File a Complaint"
Read the information and click "Accept"
Fill in your details (name, phone, email, address)
Describe the incident (what happened, when, how much loss)
Upload evidence (screenshots, transaction IDs, chat logs)
Select the type of crime
Submit

Offline:

Visit your nearest Police Station
For serious cases, visit the District Cyber Crime Police Station
File an FIR / complaint
The police will investigate under relevant IT Act / IPC sections

3.10 What Happens After You Report?

Complaint Filed
      ↓
Verification by Cyber Cell
      ↓
Registration of FIR (if cognisable offence)
      ↓
Investigation Begins
      ↓
Digital Forensics (if required)
      ↓
Evidence Collection & Preservation
      ↓
Arrest / Notice to Accused (if identified)
      ↓
Charge Sheet Filed in Court
      ↓
Trial

Timelines (Approximate)

Acknowledgement: Immediate (online) / 24 hours (offline)
FIR registration: Within 7 days of complaint
Investigation: 60–90 days typically
Trial: Varies (several months to years)

Part C: Digital Evidence

3.11 What is Digital Evidence?

Digital evidence (or electronic evidence) is any probative information stored or transmitted in digital form that a party may use in a court of law.

Examples:

Emails, chat messages, SMS
Log files (server logs, firewall logs, access logs)
Documents (PDF, Word, Excel)
Images, videos, audio recordings
Metadata (EXIF data, document properties)
Internet history, cookies, cache
Database records
Network traffic captures (PCAP files)
Memory dumps
Social media posts / messages

Forensic Image vs File Copy (Important)

File Copy	Forensic Image
Copies only visible files	Copies every bit including free space, slack space, deleted files
Does not capture metadata	Captures metadata (timestamps, permissions, partition table)
Modifies file access times	Hashes (MD5/SHA256) are generated to verify integrity
Can be easily altered	Uses a write-blocker so original data is never modified
Not considered reliable evidence in court	Considered legally admissible with proper chain of custody

The most common forensic image format is DD (raw) or E01 (EnCase). A forensic image is verified by comparing hash values — if even one bit changes, the hash changes.

3.12 Legal Status of Digital Evidence in India

Indian Evidence Act, 1872 — Sections 65A & 65B

Section 65A: Special provisions for electronic records
Section 65B: Admissibility of electronic records as evidence
- The person producing the evidence must provide a certificate stating:
  - The computer was used regularly
  - The computer was operating properly
  - The information is a reproduction of the original

IT Act, 2000 — Section 79A

Section 79A: The government may designate any agency as an Examiner of Electronic Evidence

Bhartiya Sakshya Adhiniyam, 2023 (BSA)

Replaced the Indian Evidence Act (relevant provisions in effect from July 2024)
Electronic records continue to be admissible
Updated provisions for modern digital evidence

Key Rulings:

Anvar P.V. v. P.K. Basheer (2014): Supreme Court held that electronic evidence without a Section 65B certificate is inadmissible
Shafhi Mohammad v. State of Himachal Pradesh (2018): Relaxed the requirement in certain cases

3.13 Principles of Digital Evidence Handling

The forensic soundness of digital evidence depends on following these principles:

The ACPO Principles (Association of Chief Police Officers):

Principle	Description
1. No action should change evidence	The investigator must not alter original data
2. Competence	Only trained persons should handle digital evidence
3. Audit trail	Every action must be documented and repeatable
4. Case officer responsibility	The case officer is responsible for the integrity of evidence
5. Compliance with law	All actions must follow legal requirements

In Simple Terms: Do's & Don'ts

Do's	Don'ts
Create a forensic image (bit-by-bit copy)	Don't work on the original device
Use write-blockers when connecting devices	Don't turn on the computer to "check" data
Maintain chain of custody	Don't delete or modify anything
Document every step thoroughly	Don't use the suspect's device casually
Use hash values (MD5/SHA256) to verify integrity	Don't store evidence on the same device
Secure the scene (photograph, label cables)	Don't boot from the suspect's hard drive

3.14 Digital Forensics Process

The standard Digital Forensics Framework has four phases:

1. Collection — Gather & Preserve

Order of Volatility

Data must be collected from most volatile to least volatile:

Priority	Data Type	How to Collect
1 (Highest)	CPU registers, cache	Immediate dump
2	RAM (running processes, open connections)	Memory dump tool
3	Network connections, active sessions	`netstat`, network capture
4	Temporary files, swap/page files	Forensic copy
5	Hard drive data (deleted files, logs)	Forensic image
6 (Lowest)	Backups, archived data	Physical copy

Why? RAM data is completely lost when power is cut. Always collect volatile data before shutting down.

Collection Steps:

Identify digital devices (computers, phones, servers, USB drives)
Secure the scene (photograph, label, document cables and connections)
Decide: Power off (may lose RAM data) or leave running (risks data modification)
Collect volatile data first (RAM, running processes, network connections)
Create forensic images of storage devices (write-protected)

2. Examination

Recover deleted files
Extract metadata
Analyse logs
Decrypt encrypted data (if possible)
Search for keywords
Timeline analysis

3. Analysis

Correlate findings across multiple sources
Identify patterns
Reconstruct events
Attribute actions to specific users
Draw conclusions

4. Reporting

Document findings in layman's terms
Include tools used and methodology
Include hash values and chain of custody
Present conclusions and recommendations
Be ready for cross-examination

3.15 Types of Digital Forensics

Type	Focus
Computer Forensics	Hard drives, laptops, desktops
Mobile Forensics	Smartphones, tablets, SIM cards
Network Forensics	Logs, packets, firewall traces
Cloud Forensics	AWS, Azure, Google Cloud, SaaS data
Memory Forensics	RAM, running processes
Database Forensics	Database records, SQL logs
Email Forensics	Headers, attachments, metadata
Social Media Forensics	Posts, messages, timelines, friend lists

3.16 Common Digital Forensics Tools

Tool	Type	Purpose
FTK (Forensic Toolkit)	Commercial	Hard drive analysis, email analysis, password recovery
EnCase	Commercial	Full forensic imaging and analysis (industry standard)
Autopsy / Sleuth Kit	Open-source	File system analysis, deleted file recovery, timeline analysis
dd / Guymager	Open-source	Creating forensic disk images
Volatility	Open-source	Memory (RAM) forensics — analyse running processes, network connections
Wireshark	Open-source	Network packet capture and analysis
Cellebrite / UFED	Commercial	Mobile device forensics — extract data from phones
Magnet AXIOM	Commercial	Multi-device forensics (computer, mobile, cloud)
X-Ways Forensics	Commercial	Disk cloning, data recovery, analysis
Paladin / CAINE	Linux distro	Bootable forensic environment with pre-installed tools

Free vs Paid: For learning, start with Autopsy (GUI) or Volatility (memory). For professional work, FTK and EnCase are industry standards.

3.17 Chain of Custody

The chain of custody documents every person who handled the evidence, when, and why.

Sample Chain of Custody Form:

Date/Time	Evidence Item	From	To	Purpose	Signature
01-Jan-25 10:30	Laptop HP SN123	Crime Scene	Investigating Officer	Collected	A. Kumar
01-Jan-25 14:00	Laptop HP SN123	IO	Forensic Lab	Analysis	B. Singh
03-Jan-25 18:00	Laptop HP SN123	Forensic Lab	Evidence Room	Storage	C. Patel

Why it matters: If the chain is broken, the evidence may be declared inadmissible in court.

Part D: Incident Reporting

3.18 What is an Incident?

A cyber security incident is any event that:

Threatens the confidentiality, integrity, or availability (CIA) of information
Violates security policies
Indicates a compromise or attempted compromise

Incident vs Event

Event	Incident
Any observable occurrence	An event that harms or threatens security
User logging in successfully	A user logging in from an unknown country at 3 AM
System reboot	System reboot followed by unknown data transfer

3.19 Types of Security Incidents

Type	Example
Data Breach	Customer database exfiltrated
Malware Infection	Ransomware encrypting files
Phishing Attack	Employees receiving fraudulent emails
DoS/DDoS Attack	Website unavailable to customers
Insider Threat	Employee stealing data
Unauthorised Access	Hacker gaining admin privileges
Policy Violation	Employee sharing credentials
Physical Theft	Laptop with sensitive data stolen

3.20 Incident Response Lifecycle

The standard NIST Incident Response Lifecycle (SP 800-61):

         ┌─────────────────────────────────┐
         │       1. Preparation             │
         └────────────┬────────────────────┘
                      ↓
         ┌─────────────────────────────────┐
         │   2. Detection & Analysis        │
         └────────────┬────────────────────┘
                      ↓
         ┌─────────────────────────────────┐
         │     3. Containment               │
         │    Eradication & Recovery        │
         └────────────┬────────────────────┘
                      ↓
         ┌─────────────────────────────────┐
         │     4. Post-Incident Activity    │
         │     (Lessons Learned)            │
         └─────────────────────────────────┘

Phase 1: Preparation

Create an Incident Response Plan (IRP)
Form an Incident Response Team (IRT)
Deploy monitoring tools (SIEM, IDS/IPS, antivirus)
Conduct training and drills
Define communication channels and escalation paths

Phase 2: Detection & Analysis

Monitor alerts from security tools
Collect logs and data
Analyse indicators of compromise (IoCs)
Determine the scope and impact
Classify the severity (Low/Medium/High/Critical)

Indicators of Compromise (IoCs):

Unusual outbound network traffic
Anomalies in privileged user accounts
Geographic irregularities (login from unusual location)
System log entries showing unexpected reboots
Unknown files or processes

Phase 3: Containment, Eradication & Recovery

Short-term containment:

Isolate affected systems from the network
Disable compromised accounts
Block malicious IPs

Long-term containment:

Apply patches
Change all passwords
Rebuild compromised systems from clean backups

Eradication:

Remove malware
Close vulnerabilities
Remove backdoors

Recovery:

Restore from clean backups
Monitor for signs of re-infection
Gradually return systems to production

Phase 4: Post-Incident Activity

Conduct a post-mortem meeting
Document the lessons learned
Update policies, procedures, and tools
Create a final report (executive summary + technical details)
Timeline: What happened → When → How → What was affected → What was done → What should be improved

3.21 Incident Severity Classification

Level	Colour	Definition	Response Time
Level 1	🔴 Critical	Major data breach, ransomware, large-scale DoS, critical infrastructure affected	Immediate (< 1 hour)
Level 2	🟠 High	Targeted attack, confirmed data loss, DDoS affecting services	Within 2–4 hours
Level 3	🟡 Medium	Malware detected, phishing campaign, unauthorised access attempt	Within 24 hours
Level 4	🟢 Low	Single user phishing, policy violation, scan attempts	Within 48–72 hours

3.22 Incident Report Template

A professional incident report should include:

INCIDENT REPORT

1. Report Metadata
   - Report ID: IR-2025-001
   - Date of Report: 20-Jul-2026
   - Reporter Name: [Name]
   - Reporter Role: [Role]
   - Organisation: [Org Name]

2. Incident Overview
   - Incident Type: [Malware / Phishing / Data Breach / DDoS / etc.]
   - Date/Time Detected: [DD-Mon-YYYY HH:MM]
   - Date/Time Occurred: [DD-Mon-YYYY HH:MM]
   - Severity Level: [Critical / High / Medium / Low]
   - Status: [Open / In Progress / Resolved / Closed]

3. Systems Affected
   - Hostnames: [List]
   - IP Addresses: [List]
   - Operating Systems: [List]

4. Description
   [Detailed narrative of what happened, how it was detected,
    and initial observations]

5. Indicators of Compromise (IoCs)
   - IP Addresses: [List]
   - Domains/URLs: [List]
   - File Hashes: [List of MD5/SHA256]
   - Email Addresses: [List]

6. Actions Taken
   - [Action 1 with timestamp]
   - [Action 2 with timestamp]
   - [Action 3 with timestamp]

7. Evidence Collected
   - Log files: [Paths]
   - Forensic images: [Paths]
   - Screenshots: [Paths]
   - Other: [Description]

8. Impact Assessment
   - Data compromised: [Yes/No — details]
   - Financial loss: [Amount, if known]
   - Systems impacted: [Count]
   - Users affected: [Count]
   - Regulatory impact: [If any]

9. Recommendations
   - [Short-term fixes]
   - [Long-term improvements]

10. Attachments
    - [List of attached files]

Reported By: ______________     Approved By: ______________
Date: ______________            Date: ______________

Incident Reporting & Digital Evidence