CERT-In becomes India’s first cyber forensic lab under IT Act

The Indian Computer Emergency Response Team's (CERT-In) Cyber Forensic Laboratory (CFL) has become the first government agency to be officially recognized as an “examiner of electronic evidence” under Section 79A of the Information Technology Act. This designation allows CERT-In’s CFL to offer expert opinions on electronic evidence derived from drones, CCTV systems, and cloud platforms, in addition to computers and mobile devices. Previously, other notified agencies could only serve as experts for evidence obtained from computers and mobile devices.

The IT Ministry expanded CERT-In’s CFL mandate through a gazette notification issued on December 2, which was originally published on November 27. The updated scope includes computer (media) forensics, drone storage media (excluding floppy disk drives), mobile device forensics, CCTV media recovery (excluding video authentication and enhancement), and cloud forensics. Cloud forensics must be conducted at the CFL's CGO Complex in New Delhi, using access tokens and credentials recovered from seized items.

This expansion supersedes an October 2020 notification that limited the CFL’s scope to computer forensics and mobile device forensics, excluding floppy disk drives.

Under the Ministry of Electronics and Information Technology’s (MeitY) “Scheme for Notifying Examiner of Electronic Evidence,” agencies must apply to MeitY for notification. MeitY evaluates the applicant’s technical capabilities, equipment, skilled manpower, and experience in digital forensics. Notified labs are required to submit annual reports detailing the number of cases handled, reports filed, and other relevant activities.

In addition to CERT-In’s CFL, three other agencies were notified in the same gazette. However, their scope is limited to computer (media) forensics, excluding floppy disk drives and mobile forensics. Among them, the Cyber Forensic Laboratory of the Army Cyber Group has replaced a previous notification from 2018, reflecting its updated role in forensic examination.