Legal Basis:
* Information Technology Act, 2000 (IT Act)
* IPC Section 499-502 (Defamation, contempt)
* BNS Sections for applicable crimes
* Punishment: 3-10 years depending on severity
* Category: Mostly cognizable
* Mandatory Forensic: YES (for serious cyber crimes)
INVESTIGATION CHECKLIST:
STEP 1: RECEIVE COMPLAINT (BNSS Section 173)
* Register FIR immediately
* Record exact details of cyber crime
* Record date and time of incident
* Record description of cybercriminal
* Record platform used (social media, email, website, etc.)
* Record screenshots/evidence provided
* Record victim’s account details
* Document financial loss (if any)
STEP 2: PRESERVE DIGITAL EVIDENCE
CRITICAL – Must do immediately:
* Ask complainant NOT to delete anything
* Take screenshots of all offensive content
* Save URLs of problematic websites
* Screenshot offender’s social media profiles
* Save emails/messages (do not forward)
* Note date, time, and source of all evidence
* Request platform provider to preserve data (send formal request)
STEP 3: IDENTIFY THE CYBERCRIMINAL
* Trace social media account
* Check account creation date
* Review profile information for clues
* Look for IP address information
* Request platform for user information
* Check for pattern of similar crimes
* Prepare suspect profile
STEP 4: REQUEST DIGITAL DATA FROM PLATFORMS
Send official letter to platform (Google, Facebook, etc.):
* Request user account information
* Request IP address logs
* Request location data (if available)
* Request email address verified with account
* Request payment information (if applicable)
* Request metadata of posts/messages
* Request all communications
STEP 5: TRACE IP ADDRESS & LOCATION
* Obtain IP address of offender
* Trace IP to internet service provider (ISP)
* Contact ISP with legal notice
* Get location details from ISP
* Identify city/area of offender
* Get subscriber information from ISP
STEP 6: ARREST CYBERCRIMINAL
When offender identified:
* Prepare arrest warrant
* Raid suspect’s location
* Seize all devices (computer, laptop, phone, tablet)
* Seize internet router
* Look for backup storage devices
* Seize all electronic equipment
* Document all seized items
STEP 7: DIGITAL FORENSIC EXAMINATION (BNSS Section 176)
* Call digital forensics expert (MANDATORY)
* Examine suspect’s devices for:
* Evidence of crime on hard drive
* Deleted files (can be recovered)
* Browser history
* Email accounts accessed
* Social media accounts accessed
* Photos and videos stored
* Communication records
* Financial transactions
* Prepare detailed forensic report
STEP 8: DEVICES TO SEIZE
Seize all digital devices:
* Desktop computers
* Laptops
* Mobile phones/smartphones
* Tablets
* USB drives
* Memory cards
* External hard drives
* Internet routers
* Webcams
* Printers with hard drives
STEP 9: CHAIN OF CUSTODY FOR DIGITAL EVIDENCE
* Document all devices seized
* Seal devices in evidence bags
* Take photographs of seized items
* Create hashes of digital devices (unique digital fingerprint)
* Maintain custody record
* Keep devices in secure location
* Do NOT plug devices to internet
STEP 10: WITNESS STATEMENTS (BNSS Section 180)
Record statements of:
* Victim of cyber crime
* Person who filed complaint
* Witnesses who saw offensive content
* Family members of victim
* Any others affected
* Cybersecurity experts (if consulted by victim)
STEP 11: FINANCIAL INVESTIGATION
If cyber fraud involved:
* Trace bank accounts used
* Identify banks and branches
* Get transaction records
* Identify beneficiary accounts
* Trace flow of money
* Contact banks for account holder information
* Prepare financial timeline
* Identify accomplices if any
STEP 12: EVIDENCE COLLECTION
Collect:
* Screenshots of offensive content
* URLs of problematic websites
* Emails/messages
* Social media conversations
* Transaction records
* Account access logs
* IP address records
* Device forensic report
STEP 13: INVESTIGATION DIARY (BNSS Section 192)
Maintain detailed record:
* Date/time of complaint
* All actions taken
* All digital evidence collected
* All statements recorded
* All forensic findings
* Timeline of events
* Identification of suspect
* Devices seized and examined
STEP 14: CHARGESHEET (BNSS Section 193)
* Complete investigation
* Prepare detailed chargesheet
* Include all screenshots/evidence
* Include forensic report
* Include witness statements
* Include platform data
* Include financial trail (if applicable)
* Submit within 60 days
TYPES OF CYBER CRIMES TO INVESTIGATE:
* Online Defamation: False posts damaging reputation
* Cyber Harassment: Threatening messages/posts
* Cyber Fraud: Fake websites, phishing, scams
* Identity Theft: Using someone else’s personal information
* Online Sexual Abuse: Explicit content, grooming
* Hacking: Unauthorized access to accounts
* Malware Distribution: Spreading viruses
* Extortion: Demanding money online
CRITICAL PROCEDURES:
✓ Preserve all digital evidence IMMEDIATELY
✓ Do NOT alter or forward evidence
✓ Request platform data officially
✓ Trace IP address to location
✓ Seize ALL digital devices
✓ Maintain chain of custody
✓ Use digital forensics expert
✓ Do NOT plug seized devices to internet
