Most organizations treat digital forensics as an afterthought, turning to it only after a breach, when critical evidence may already be lost or corrupted, according to experts speaking on CISONow.
“Digital forensics readiness is their last thought,” said Dr. Gaurav Gupta, Director and Scientist ‘F’ in MeitY’s Cybersecurity R&D Division. Organizations can recover from incidents and be cybersecurity ready, he noted, but without forensic readiness, evidence may not be admissible in court.
Lt. Col. Santosh Khadsare, Founder and CEO of iDEFENCE, said the first response after an incident decides whether evidence stays legally viable. “The first hour is… considered as the golden hour to collect evidence,” he said, adding that teams must document every action they take during that time so they can account for their activities later.
In this video interview, Gupta and Khadsare also discuss:
- Regulatory pressure: Balancing the 6-hour incident reporting requirement with careful evidence preservation
- Legal compliance: How the Bharatiya Sakshya Adhiniyam (BSA) affects the certification and court admissibility of electronic evidence
- AI as a double-edged sword: Using AI for automated triage and timeline reconstruction, while guarding against deepfakes, AI hallucinations and fabricated evidence
- The road to 2030: Building indigenous forensic tools, adding forensic SLAs to cloud contracts, and scaling specialized talent across India
Gupta has extensive experience in digital forensics and cybersecurity research, driving national R&D initiatives, standards evaluation and lab accreditation frameworks under MeitY.
Khadsare is a decorated veteran and former Additional Director at CERT-In, specializing in incident response, electronic evidence handling and defense against emerging cyber threats.
