CHAPTER 7

• INVESTIGATING CYBERCRIME INVOLVES ANALYZING DIGITAL EVIDENCE,

TRACING ONLINE ACTIVITIES, AND COLLABORATING WITH CYBERSECURITY
EXPERTS. COMMON STEPS INCLUDE IDENTIFYING THE BREACH, PRESERVING
EVIDENCE, AND WORKING WITH LAW ENFORCEMENT TO APPREHEND
OFFENDERS. CYBER FORENSIC TOOLS, NETWORK ANALYSIS, AND DIGITAL
FORENSICS PLAY CRUCIAL ROLES IN THIS PROCESS.
 MALICIOUS APPLICATION

• IF YOU SUSPECT A MALICIOUS APPLICATION, CONSIDER UNINSTALLING IT

IMMEDIATELY AND RUNNING A REPUTABLE ANTIVIRUS SCAN ON YOUR
DEVICE. BE CAUTIOUS OF GRANTING UNNECESSARY PERMISSIONS TO APPS
AND DOWNLOAD ONLY FROM TRUSTED SOURCES LIKE OFFICIAL APP STORES.
IF ISSUES PERSIST, SEEK PROFESSIONAL ASSISTANCE OR CONSULT YOUR
DEVICE’S SUPPORT RESOURCES
INVESTIGATING A MALICIOUS APPLICATION IN CYBERSECURITY INVOLVES A SYSTEMATIC
APPROACH. HERE’S A SIMPLIFIED GUIDE:

ISOLATION: QUARANTINE THE AFFECTED SYSTEM OR DEVICE TO PREVENT FURTHER

DAMAGE. DISCONNECT IT FROM THE NETWORK TO CONTAIN THE THREAT.

IDENTIFICATION: GATHER INFORMATION ABOUT THE SUSPICIOUS APPLICATION. NOTE ITS

NAME, FILE PATH, AND ANY ASSOCIATED PROCESSES.
• ANALYSIS: USE SECURITY TOOLS TO ANALYZE THE APPLICATION’S BEHAVIOR. THIS MAY
INVOLVE EXAMINING NETWORK TRAFFIC, SYSTEM LOGS, AND RUNNING THE
APPLICATION IN A CONTROLLED ENVIRONMENT (SANDBOX) TO OBSERVE ITS ACTIONS.
REVERSE ENGINEERING: IF POSSIBLE, REVERSE ENGINEER THE APPLICATION TO UNDERSTAND ITS
CODE AND FUNCTIONALITY. TOOLS LIKE DISASSEMBLERS AND DEBUGGERS CAN BE HELPFUL.

HASH AND SIGNATURE ANALYSIS: CALCULATE THE HASH OF THE MALICIOUS FILE AND CHECK IT
AGAINST KNOWN MALWARE DATABASES. INVESTIGATE IF SECURITY VENDORS HAVE SIGNATURES
FOR THIS SPECIFIC THREAT.

BEHAVIORAL ANALYSIS: UNDERSTAND THE APPLICATION’S BEHAVIOR—HOW IT INTERACTS WITH THE

OPERATING SYSTEM, WHAT FILES IT ACCESSES, AND ANY NETWORK COMMUNICATIONS IT INITIATES.
• MEMORY ANALYSIS: EXAMINE THE SYSTEM’S MEMORY FOR SIGNS OF MALICIOUS ACTIVITY. SOME
MALWARE MAY RESIDE ONLY IN MEMORY TO AVOID DETECTION ON DISK.
TIMELINE ANALYSIS: CREATE A TIMELINE OF EVENTS LEADING UP TO THE DISCOVERY OF THE
MALICIOUS APPLICATION. THIS CAN HELP IDENTIFY THE ENTRY POINT AND UNDERSTAND THE
PROGRESSION OF THE ATTACK.

VICTIMOLOGY: IDENTIFY POTENTIAL TARGETS AND AFFECTED USERS. UNDERSTAND THE IMPACT
ON THE ORGANIZATION AND PRIORITIZE RESPONSE ACTIONS.

MITIGATION AND REMEDIATION: DEVELOP A PLAN TO MITIGATE THE THREAT. THIS MAY INVOLVE
REMOVING THE MALICIOUS APPLICATION, PATCHING VULNERABILITIES, AND IMPLEMENTING
SECURITY MEASURES TO PREVENT FUTURE INCIDENTS.
• INCIDENT DOCUMENTATION: DOCUMENT YOUR FINDINGS, ACTIONS TAKEN, AND LESSONS
LEARNED. THIS DOCUMENTATION IS CRUCIAL FOR FUTURE REFERENCE AND ANALYSIS.
 AGENCIES FOR INVESTIGATION OF CYBER
CRIME IN INDIA
• IN INDIA, THE PRIMARY AGENCY RESPONSIBLE FOR INVESTIGATING CYBER
CRIMES IS THE CYBER CRIME UNIT OF THE CENTRAL BUREAU OF
INVESTIGATION (CBI). ADDITIONALLY, EACH STATE HAS ITS OWN CYBER
CRIME CELL OR UNIT THAT HANDLES SUCH CASES AT THE STATE LEVEL. THE
NATIONAL CYBER CRIME REPORTING PORTAL (WWW.CYBERCRIME.GOV.IN)
ALLOWS INDIVIDUALS TO REPORT CYBER CRIMES ONLINE.
WHILE GOVERNMENT AGENCIES LIKE THE CBI AND STATE CYBER CRIME CELLS PRIMARILY HANDLE CYBER CRIME
INVESTIGATIONS IN INDIA, THERE ARE PRIVATE CYBERSECURITY FIRMS THAT PROVIDE SERVICES SUCH AS DIGITAL
FORENSICS, INCIDENT RESPONSE, AND SECURITY CONSULTING. SOME NOTABLE PRIVATE CYBERSECURITY FIRMS
OPERATING IN INDIA INCLUDE:

KASPERSKY LAB INDIA

SYMANTEC (NOW PART OF BROADCOM)

QUICK HEAL TECHNOLOGIES

LUCIDEUS TECH
• TATA CONSULTANCY SERVICES (TCS) – CYBER SECURITY SERVICES
• IT’S IMPORTANT TO NOTE THAT PRIVATE CYBERSECURITY FIRMS TYPICALLY FOCUS ON PREVENTIVE MEASURES,
CONSULTING, AND SUPPORTING ORGANIZATIONS RATHER THAN ACTING AS LAW ENFORCEMENT AGENCIES FOR
CRIMINAL INVESTIGATIONS. FOR LEGAL ACTION, INVOLVEMENT OF LAW ENFORCEMENT AGENCIES IS ESSENTIAL.
 POWER OF CYBER CRIME AGENCY

• THE POWER OF CYBERCRIME AGENCIES IN INDIA, SUCH AS THE CYBER CRIME

CELL OF THE POLICE AND ORGANIZATIONS LIKE THE NATIONAL CYBER CRIME
REPORTING PORTAL, IS PRIMARILY FOCUSED ON INVESTIGATING AND
PREVENTING CYBERCRIMES. THEY HAVE AUTHORITY TO PROBE OFFENSES
UNDER THE INFORMATION TECHNOLOGY ACT, 2000, AND RELATED LAWS.
THESE AGENCIES COLLABORATE WITH INTERNATIONAL COUNTERPARTS AND
EMPLOY VARIOUS TOOLS TO COMBAT CYBER THREATS, ENSURING A SAFER
DIGITAL ENVIRONMENT
CYBERCRIME AGENCIES IN INDIA DERIVE THEIR POWERS FROM VARIOUS PROVISIONS OF THE INDIAN
CONSTITUTION AND SPECIFIC LEGISLATIONS, PRIMARILY THE INFORMATION TECHNOLOGY ACT, 2000. THE
RELEVANT CONSTITUTIONAL PROVISIONS INCLUDE:

ARTICLE 21 – RIGHT TO LIFE AND PERSONAL LIBERTY: AGENCIES OPERATE WITHIN THE FRAMEWORK OF
PROTECTING CITIZENS’ FUNDAMENTAL RIGHTS, AND INVESTIGATIONS MUST ADHERE TO DUE PROCESS,
ENSURING THE RIGHT TO PRIVACY AND LIBERTY.
• ARTICLE 19(1)(A) – FREEDOM OF SPEECH AND EXPRESSION: WHILE INVESTIGATING CYBERCRIMES,
AGENCIES BALANCE THE NEED FOR ADDRESSING OFFENSES WITH THE CONSTITUTIONAL RIGHT TO
FREEDOM OF SPEECH AND EXPRESSION.
• ARTICLE 300A – RIGHT TO PROPERTY: IN CASES INVOLVING FINANCIAL CYBERCRIMES OR THEFT,
AGENCIES ACT WITHIN THE CONSTITUTIONAL PROVISIONS RELATED TO PROPERTY RIGHTS.
 CONTINUE...

ARTICLE 22 – PROTECTION AGAINST ARREST AND DETENTION IN CERTAIN CASES:

AGENCIES MUST FOLLOW CONSTITUTIONAL SAFEGUARDS WHEN MAKING ARRESTS IN
CONNECTION WITH CYBERCRIMES, RESPECTING THE RIGHTS OF THE ACCUSED.

ARTICLE 73 – EXTENT OF EXECUTIVE POWER OF THE UNION: THE UNION EXECUTIVE,

THROUGH VARIOUS AGENCIES, EXERCISES POWERS RELATED TO CYBERSECURITY,
AND THE STATES COOPERATE IN MATTERS FALLING UNDER THE CONCURRENT LIST.
• THESE CONSTITUTIONAL PROVISIONS, COMBINED WITH SPECIFIC LEGISLATION,
EMPOWER CYBERCRIME AGENCIES TO ADDRESS DIGITAL OFFENSES WHILE
UPHOLDING THE CONSTITUTIONAL RIGHTS OF CITIZENS.
CONSTITUTION ACCORDING TO INDIAN LAW
PROCEDURE
THE INDIAN LEGAL PROCEDURE FOR CYBERCRIME INVESTIGATION INVOLVES ADHERENCE TO THE INFORMATION
TECHNOLOGY ACT, 2000, AND THE CODE OF CRIMINAL PROCEDURE (CRPC). HERE’S A GENERAL OVERVIEW OF
THE PROCESS:

FIR REGISTRATION: A CYBERCRIME INVESTIGATION USUALLY BEGINS WITH THE FILING OF A FIRST INFORMATION
REPORT (FIR) WITH THE LOCAL POLICE. THE COMPLAINANT PROVIDES DETAILS OF THE ALLEGED CYBERCRIME,
AND THE FIR OFFICIALLY INITIATES THE INVESTIGATION.
• JURISDICTION: DETERMINING THE JURISDICTION IS CRUCIAL IN CYBERCRIME CASES. THE CRIME MAY BE
INVESTIGATED BY THE CYBERCRIME CELL OF THE STATE POLICE OR SPECIALIZED AGENCIES LIKE THE CYBER
CRIME UNIT OR THE CYBER CRIME CELL.
• PRESERVATION OF EVIDENCE: PRESERVING DIGITAL EVIDENCE IS VITAL. INVESTIGATORS MUST TAKE
IMMEDIATE STEPS TO ENSURE THE INTEGRITY OF ELECTRONIC EVIDENCE, INCLUDING SECURING SERVERS,
COMPUTERS, AND OTHER DIGITAL DEVICES INVOLVED IN THE ALLEGED OFFENSE.
 CONTINUE.....

FORENSIC ANALYSIS: DIGITAL FORENSICS PLAYS A CRUCIAL ROLE. INVESTIGATORS ANALYZE

SEIZED ELECTRONIC DEVICES TO EXTRACT INFORMATION AND GATHER EVIDENCE. THIS
PROCESS INCLUDES RECOVERING DELETED DATA, EXAMINING LOGS, AND IDENTIFYING THE
ORIGIN OF CYBER THREATS.

IDENTIFICATION AND TRACKING: INVESTIGATORS WORK ON IDENTIFYING THE INDIVIDUALS OR

ENTITIES INVOLVED IN THE CYBERCRIME. THIS MAY INVOLVE TRACKING IP ADDRESSES,
TRACING DIGITAL FOOTPRINTS, AND COLLABORATING WITH INTERNET SERVICE PROVIDERS.
• ARREST AND LEGAL PROCEEDINGS: IF SUFFICIENT EVIDENCE IS FOUND, ARRESTS MAY BE
MADE. LEGAL PROCEEDINGS FOLLOW THE REGULAR CRIMINAL JUSTICE SYSTEM, WITH THE
ACCUSED BEING PRESENTED BEFORE A MAGISTRATE AND CHARGES BEING FRAMED.
 CONTINUE....

COURT PROCEEDINGS: CYBERCRIME CASES ARE USUALLY TRIED BY SPECIAL COURTS

DESIGNATED UNDER THE INFORMATION TECHNOLOGY ACT. THESE COURTS FOLLOW THE
STANDARD LEGAL PROCEDURES, ENSURING A FAIR TRIAL FOR THE ACCUSED.

PENALTIES: IF THE ACCUSED IS FOUND GUILTY, THE COURT IMPOSES PENALTIES AS PER THE
PROVISIONS OF THE INFORMATION TECHNOLOGY ACT. PENALTIES CAN INCLUDE IMPRISONMENT,
FINES, OR BOTH, DEPENDING ON THE NATURE AND SEVERITY OF THE OFFENSE.
• THROUGHOUT THIS PROCESS, INVESTIGATORS MUST ADHERE TO THE PRINCIPLES OF
NATURAL JUSTICE AND RESPECT THE CONSTITUTIONAL RIGHTS OF THE ACCUSED. THE LEGAL
FRAMEWORK ENSURES A SYSTEMATIC AND LAWFUL APPROACH TO CYBERCRIME
INVESTIGATIONS IN INDIA.
 THE PROCEDURE FOR SEARCH AND
SEIZURE OF DIGITAL EVIDENCE IN A
CYBERCRIME INCIDENT TYPICALLY INVOLVES
THE FOLLOWING STEPS:
LEGAL AUTHORIZATION: OBTAIN A SEARCH WARRANT OR OTHER LEGAL
AUTHORIZATION FROM A COMPETENT AUTHORITY, SPECIFYING THE SCOPE AND
LOCATION OF THE SEARCH.

DIGITAL FORENSIC TEAM: ASSEMBLE A TRAINED DIGITAL FORENSIC TEAM WITH

EXPERTISE IN HANDLING ELECTRONIC EVIDENCE.

SECURE THE SCENE: SECURE THE PHYSICAL LOCATION WHERE THE DIGITAL EVIDENCE
IS LOCATED TO PREVENT TAMPERING.
• IDENTIFY AND DOCUMENT: IDENTIFY THE DEVICES OR SYSTEMS CONTAINING
POTENTIAL EVIDENCE AND DOCUMENT THEIR STATE BEFORE ANY ACTION IS TAKEN
 CON...

POWER PRESERVATION: ENSURE THAT ELECTRONIC DEVICES ARE POWERED OFF

OR PUT IN A FORENSICALLY SOUND STATE TO PRESERVE THEIR CURRENT STATE.

COLLECTION OF EVIDENCE: USE FORENSICALLY SOUND TOOLS AND METHODS TO

COLLECT DIGITAL EVIDENCE, ENSURING PROPER CHAIN OF CUSTODY.

ANALYSIS AND DOCUMENTATION: ANALYSE THE COLLECTED DATA, DOCUMENTING

RELEVANT INFORMATION AND MAINTAINING THE INTEGRITY OF THE EVIDENCE.
• DATA PRESERVATION: PRESERVE ORIGINAL EVIDENCE AND CREATE FORENSIC
COPIES TO AVOID ANY CHANGES TO THE ORIGINAL DATA DURING ANALYSIS.
 CON...

LEGAL COMPLIANCE: ADHERE TO LEGAL AND PROCEDURAL REQUIREMENTS,

ENSURING THE COLLECTED EVIDENCE IS ADMISSIBLE IN COURT.

REPORT GENERATION: PREPARE A DETAILED REPORT OUTLINING THE FINDINGS,

METHODOLOGIES, AND CONCLUSIONS DRAWN FROM THE DIGITAL EVIDENCE.

STORAGE AND RETENTION: SAFELY STORE THE COLLECTED EVIDENCE IN A SECURE

ENVIRONMENT, ADHERING TO RETENTION POLICIES AND LEGAL REQUIREMENTS.
• COURT PRESENTATION: IF NECESSARY, PRESENT THE DIGITAL EVIDENCE IN COURT,
ENSURING PROPER AUTHENTICATION AND COMPLIANCE WITH LEGAL STANDARDS.
PRE SEARCH CONSIDERATIONS IN FORENSIC
INVESTIGATION
• BEFORE CONDUCTING A FORENSIC INVESTIGATION, IT’S CRUCIAL TO
ESTABLISH A CLEAR PLAN AND ADHERE TO ETHICAL STANDARDS. PRE-
SEARCH CONSIDERATIONS INCLUDE DEFINING THE SCOPE OF THE
INVESTIGATION, OBTAINING LEGAL AUTHORIZATION, ENSURING THE
PRESERVATION OF EVIDENCE INTEGRITY, AND IDENTIFYING THE
APPROPRIATE TOOLS AND METHODOLOGIES FOR ANALYSIS. ADDITIONALLY,
IT’S ESSENTIAL TO DOCUMENT THE CHAIN OF CUSTODY, CONSIDER PRIVACY
AND DATA PROTECTION REGULATIONS, AND COLLABORATE WITH RELEVANT
STAKEHOLDERS, SUCH AS LAW ENFORCEMENT OR LEGAL COUNSEL. THESE
MEASURES HELP ENSURE A THOROUGH AND LEGALLY SOUND FORENSIC
INVESTIGATION.
 AQUISITION

• IN FORENSIC INVESTIGATION, ACQUISITION REFERS TO THE PROCESS OF

COLLECTING AND PRESERVING DIGITAL EVIDENCE FROM VARIOUS SOURCES.
THIS INVOLVES CREATING A FORENSIC COPY OF THE DATA WITHOUT
ALTERING THE ORIGINAL, ENSURING ITS INTEGRITY FOR LATER ANALYSIS.
PROPER ACQUISITION PRACTICES INCLUDE IDENTIFYING RELEVANT DEVICES,
USING FORENSICALLY SOUND TOOLS, AND MAINTAINING A DOCUMENTED
CHAIN OF CUSTODY. THE GOAL IS TO RETRIEVE INFORMATION IN A MANNER
THAT IS ADMISSIBLE IN COURT, ADHERING TO LEGAL AND ETHICAL
STANDARDS WHILE MINIMIZING THE RISK OF DATA CONTAMINATION OR LOSS.
 DUPLICATION AND PRESERVATION ARE
CRITICAL STEPS IN THE FORENSIC
INVESTIGATION OF CYBERCRIME
DUPLICATION:

OBJECTIVE: THE PRIMARY GOAL IS TO CREATE AN EXACT, FORENSICALLY

SOUND DUPLICATE OF THE ORIGINAL DIGITAL EVIDENCE.

PROCESS: USE SPECIALIZED TOOLS TO COPY DATA BIT-FOR-BIT, ENSURING THE

INTEGRITY OF THE EVIDENCE.
PURPOSE: DUPLICATE COPIES SERVE AS WORKING COPIES FOR ANALYSIS,
ALLOWING INVESTIGATORS TO EXAMINE AND MANIPULATE DATA WITHOUT
COMPROMISING THE ORIGINAL.
 PRESERVATION

PRESERVATION:

OBJECTIVE: SAFEGUARD THE INTEGRITY OF DIGITAL EVIDENCE TO MAINTAIN ITS ADMISSIBILITY IN

COURT.

METHODS: STORE DUPLICATES IN A SECURE ENVIRONMENT, PROTECTING AGAINST TAMPERING,

UNAUTHORIZED ACCESS, OR DATA DEGRADATION.

IMPORTANCE: PRESERVATION ENSURES THE EVIDENCE REMAINS UNCHANGED FROM THE MOMENT
OF ACQUISITION, MAINTAINING ITS RELIABILITY FOR LEGAL PROCEEDINGS.
• TOGETHER, DUPLICATION AND PRESERVATION FORM THE FOUNDATION FOR A ROBUST AND
DEFENSIBLE FORENSIC INVESTIGATION IN THE REALM OF CYBERCRIME, ALLOWING
INVESTIGATORS TO ANALYZE EVIDENCE WHILE MAINTAINING ITS ORIGINAL STATE.
 EXAMINATION AND ANALYSIS OF DIGITAL
EVIDENCE

EXAMINATION:

OBJECTIVE: SYSTEMATICALLY REVIEW DIGITAL EVIDENCE TO IDENTIFY

RELEVANT INFORMATION AND POTENTIAL LEADS.

PROCESS: USE SPECIALIZED TOOLS TO EXPLORE DATA, UNCOVER ARTIFACTS,

AND UNDERSTAND THE CONTEXT OF THE EVIDENCE.
• PURPOSE: INITIAL EXAMINATION HELPS INVESTIGATORS NARROW DOWN
FOCUS AREAS FOR MORE IN-DEPTH ANALYSIS AND INFORMS THE OVERALL
INVESTIGATION STRATEGY.
 ANALYSIS

OBJECTIVE: DELVE DEEPER INTO THE IDENTIFIED DIGITAL EVIDENCE TO EXTRACT MEANINGFUL
INSIGHTS AND DRAW CONCLUSIONS.

PROCESS: EMPLOY FORENSIC TECHNIQUES AND TOOLS TO INTERPRET DATA, RECONSTRUCT

EVENTS, AND ESTABLISH TIMELINES.

PURPOSE: ANALYSIS PROVIDES A DETAILED UNDERSTANDING OF THE EVIDENCE, SUPPORTING

THE INVESTIGATION’S GOALS AND HELPING TO BUILD A COMPREHENSIVE CASE.
• BY COMBINING THOROUGH EXAMINATION AND ANALYSIS, FORENSIC INVESTIGATORS CAN
UNRAVEL COMPLEX DIGITAL SCENARIOS, IDENTIFY PATTERNS, AND PRESENT COMPELLING
FINDINGS THAT CONTRIBUTE TO LEGAL PROCEEDINGS OR CYBERSECURITY EFFORTS.
 STORING

• STORING DIGITAL EVIDENCE IS CRUCIAL FOR LEGAL PURPOSES. IT INVOLVES

PRESERVING ELECTRONIC DATA IN A SECURE, UNALTERED STATE TO
MAINTAIN ITS INTEGRITY AND AUTHENTICITY. BEST PRACTICES INCLUDE
USING WRITE-PROTECTED DEVICES, SECURE STORAGE FACILITIES, AND
MAINTAINING A DETAILED CHAIN OF CUSTODY. ENCRYPTION AND ACCESS
CONTROLS HELP ENSURE CONFIDENTIALITY, WHILE REGULAR BACKUPS
PREVENT DATA LOSS. COMPLIANCE WITH LEGAL STANDARDS AND
DOCUMENTATION OF THE STORAGE PROCESS ARE ESSENTIAL FOR THE
ADMISSIBILITY OF DIGITAL EVIDENCE IN COURT.
 DOCUMENTATION AND REPORTING OF
DIGITAL EVIDENCE

• DOCUMENTATION AND REPORTING OF DIGITAL EVIDENCE ARE VITAL FOR ESTABLISHING THE
CREDIBILITY AND ADMISSIBILITY OF INFORMATION IN LEGAL PROCEEDINGS. THIS PROCESS
INVOLVES CREATING COMPREHENSIVE RECORDS DETAILING THE COLLECTION, PRESERVATION,
AND ANALYSIS OF DIGITAL EVIDENCE. DOCUMENTATION SHOULD INCLUDE SPECIFIC DETAILS
SUCH AS DATE, TIME, LOCATION, AND PERSONNEL INVOLVED IN EACH STEP. CLEAR AND CONCISE
REPORTS SHOULD PRESENT FINDINGS, METHODOLOGIES, AND ANY TOOLS USED. MAINTAINING A
METICULOUS CHAIN OF CUSTODY IS CRUCIAL FOR DEMONSTRATING THE EVIDENCE'S INTEGRITY.
ADHERING TO STANDARD OPERATING PROCEDURES AND LEGAL REQUIREMENTS ENSURES THE
RELIABILITY OF THE DOCUMENTATION, STRENGTHENING THE EVIDENTIARY VALUE IN COURT.
 MAINTAINING THE CHAIN OF CUSTODY

• MAINTAINING THE CHAIN OF CUSTODY FOR DIGITAL EVIDENCE IS CRUCIAL IN

PRESERVING ITS INTEGRITY AND ADMISSIBILITY IN LEGAL PROCEEDINGS.
THIS PROCESS INVOLVES DOCUMENTING THE HANDLING, STORAGE, AND
TRANSFER OF DIGITAL EVIDENCE FROM COLLECTION TO PRESENTATION IN
COURT. PROPER DOCUMENTATION INCLUDES TIMESTAMPS, DETAILS OF
PERSONNEL INVOLVED, AND ANY ALTERATIONS MADE. ADHERING TO A
STRICT CHAIN OF CUSTODY ENSURES RELIABILITY, CREDIBILITY, AND LEGAL
DEFENSIBILITY OF THE DIGITAL EVIDENCE THROUGHOUT THE INVESTIGATIVE
PROCESS.