Professional & investigative
Evidence that was handled badly on day one cannot be fixed on the day of the hearing
A screenshot without a hash, a phone that was "just checked" by a constable, an email printed without headers: these are how cyber cases are lost. This course covers the basics that matter most often: acquiring evidence from phones and email without altering it, hashing and documenting it, examining it for what the case needs, and writing the report and the Section 63 certificate correctly.
- Duration
- 2 days
- Format
- Online / Onsite
- Language
- English
- Level
- Intermediate
- Group size
- 8 to 25
- Certificate
- Completion certificate
- For
- Investigators, lawyers, IT teams
What participants can do afterwards
- Seize and handle a phone or laptop so the evidence is preserved: isolation, power state, documentation, and what never to do
- Acquire data from Android and iOS devices using logical and backup methods, and know when a full lab extraction is needed
- Analyse email headers to establish origin, spoofing and the path a message took, and preserve mail with full headers
- Hash, label and track evidence with a chain-of-custody record that answers every question a defence lawyer will ask
- Examine chats, call logs, images and UPI app data for the facts a case needs, and document the method
- Write a forensic report and a Section 63 BSA 2023 certificate that a court will accept, and explain both under cross-examination
Modules
Day 1: principles and seizure
What makes evidence admissible, the order of volatility, seizure of phones and laptops, isolation, documentation, and the first mistakes that cannot be undone.
Day 1: phone acquisition and examination
Logical and backup acquisition from Android and iOS, hashing, timelines, chats, calls, images, deleted data, and the limits without a lab.
Day 1: email and account evidence
Full headers, spoofing and lookalike domains, preserving mail and account data, platform downloads, and what to request from providers.
Day 2: chain of custody and reporting
The custody record, hashing at every transfer, storage, the forensic report structure, and the Section 63 BSA certificate line by line.
Day 2: courtroom
How evidence is challenged, Section 63 and related BSA provisions, examining the examiner, and a mock cross-examination.
Day 2: case exercise
Teams acquire, examine and report on a prepared device image and mailbox, and present the report for review.
Who should attend
- Police investigators and cyber cell staff who handle seized devices
- Lawyers and prosecutors who present or challenge electronic evidence
- Corporate IT and security staff who preserve evidence for internal investigations
- Private investigators and forensic trainees
- Compliance and fraud teams at banks, NBFCs and fintechs
Included
- Two days of hands-on instruction with prepared device images and mailboxes
- Seizure checklist, chain-of-custody form and evidence labels
- A forensic report template and a Section 63 BSA certificate template with guidance notes
- A list of free and low-cost tools used in the course, with set-up instructions
- Completion certificate
Frequently asked questions
Do participants need forensic hardware or licensed software?
No. The course uses free and low-cost tools for logical acquisition, hashing, header analysis and examination, running on an ordinary laptop. Where a commercial extraction tool or a lab is needed, the course explains what it adds and when to send the device to a forensic science laboratory. Participants should bring a laptop with admin rights; test devices and images are provided.
Is Section 63 BSA covered in enough depth for lawyers?
Yes. Half a day is spent on the certificate, the related BSA provisions on electronic records, how the certificate is drafted for different sources (phone, email, server, CCTV), who signs it, and how courts have treated defects. The mock cross-examination is built around a flawed certificate so participants see exactly where a case can fall apart.
Can this be run for a corporate IT team that handles internal investigations?
Yes, and the emphasis shifts. For corporate teams, the seizure and preservation material covers employee devices and company accounts, the legal basis for examining them, the evidence an HR or legal process needs, and how to hand evidence to the police or a court without breaking the chain. We add a short segment on insider data theft cases.
What is the difference between this course and the investigation fundamentals course?
The investigation course is about running the case: complaint, money trail, requests, sections and charge sheet. This course is about the evidence itself: acquiring, examining and reporting it so it holds up. Investigators benefit from both; lawyers often take this one first. The two can be run back to back as a five-day programme.
Request this program
Tell us the audience, headcount, city and preferred dates. We reply with an outline and quote.