A. Service Scope and Client Fit
A1We have a SOC. Why do we need forensics?
A SOC detects and contains incidents. Forensics answers the questions that follow: how the attacker got in, what they did, what data was affected, who was responsible and whether the evidence will hold up. Codec Networks' forensic team uses SOC data as one of its sources.
A2What should we do in the first hour of an incident?
Contain without destroying evidence: isolate affected systems from the network rather than switching them off or reimaging them, preserve logs, note what you see and call your forensic partner. A readiness playbook sets this out in advance.
A3Can you investigate an employee we suspect of taking data?
Yes, under the direction of your counsel and HR, respecting the employee's rights and personal data. Codec Networks preserves devices and accounts, analyses activity and reports facts.
A4Do you only work after an incident?
No. Forensic readiness work before an incident makes investigations faster and evidence stronger, and an incident retainer ensures help is available quickly.
A5Can you tell whether a voice note or video is a deepfake?
Codec Networks examines audio, video and images for signs of synthesis and manipulation and checks provenance and metadata, then reconstructs how the fraud was carried out. Findings are expressed with the confidence the evidence supports.
A6Can stolen cryptocurrency be recovered?
Sometimes. Blockchain transactions are public, so funds can often be traced to exchanges where they may be frozen if action is quick. Recovery depends on where funds went and the cooperation of exchanges and authorities.
A7Do you work with law firms and insurers?
Yes. Codec Networks often works under the instruction of a client's counsel and alongside insurers and their panel firms, providing independent facts.
A8Can you analyse a malware sample we found?
Yes. Codec Networks analyses samples statically and in an isolated sandbox to identify capabilities, persistence and indicators of compromise, and advises on detection and removal.
B. Laws, Evidence and Regulatory Alignment
B1How is electronic evidence proved in India now?
As general information: since 1 July 2024, the Bharatiya Sakshya Adhiniyam 2023 governs evidence. Section 63 sets the conditions for admitting electronic records, with a certificate in the Schedule that includes hash values. The Supreme Court upheld the Section 63(4) certificate requirement in May 2026.
B2What is a hash value and why does it matter?
A hash value is a digital fingerprint of a file or disk image. If even one bit changes, the hash changes. Recording hashes at acquisition shows that evidence has not been altered.
B3How long must we keep logs?
As general information: CERT-In's Directions of 28 April 2022 require service providers, intermediaries, data centres, body corporates and government organisations to maintain ICT system logs for 180 days within India. Sector rules and contracts may require longer.
B4Must we report a cyber incident to CERT-In?
As general information: CERT-In's 2022 Directions require specified types of cyber incidents to be reported within six hours of noticing them. Codec Networks provides the facts for the report; the client files it.
B5Does the DPDP Act affect investigations?
Yes, in two ways. A personal data breach found in an investigation may need intimation to the Data Protection Board and affected individuals, and personal data handled during an investigation must be processed lawfully.
B6What did the 2026 IT Rules amendment change for deepfakes?
As general information: amendments notified on 10 February 2026 require intermediaries to label synthetically generated information and remove flagged unlawful content within shorter timelines. Codec Networks uses these routes when supporting takedown requests.
B7Which standards do your investigations follow?
ISO/IEC 27037 for identifying, collecting and preserving digital evidence, ISO/IEC 27042 for analysis, ISO/IEC 27043 for investigation processes, NIST SP 800-86 and RFC 3227 for the order of volatility.
B8Who is an Examiner of Electronic Evidence?
Section 79A of the IT Act allows the Central Government to notify agencies as Examiners of Electronic Evidence to give expert opinion to courts. Codec Networks' findings can support such examination where a matter requires it.
C. Engagement Approach and Delivery
C1How quickly can you respond?
Clients on an incident retainer get assured response within agreed hours, often remotely within the first hours. Others are supported as quickly as the team is available.
C2Do you need to come on site?
Not always. Many acquisitions and analyses can be done remotely using secure tools. Codec Networks comes on site for devices, data centres or sensitive interviews.
C3How do you protect privilege?
Where the client wants privilege, Codec Networks works under the instruction of its counsel, with communications and reports routed through counsel as agreed.
C4What is chain of custody?
A record of who collected each item of evidence, when, how it was stored and who accessed it. It lets a court or regulator trust that evidence was not altered.
C5Will the investigation disrupt our business?
Codec Networks plans acquisitions to minimise disruption, imaging systems in place where possible and coordinating with IT on restoration.
C6How do you handle encrypted or locked devices?
Codec Networks uses lawful methods available for the device and the client's credentials or recovery keys. Some devices cannot be accessed; the report says so.
C7How do you trace crypto funds?
Using transaction identifiers and wallet addresses, Codec Networks traces funds across wallets, mixers and bridges with blockchain analysis tools, and identifies exchanges that received them.
C8What happens after the investigation?
Codec Networks presents findings, supports any recovery, disciplinary, civil or criminal action and runs a lessons-learned review to close the gaps found.
D. Commercials, Timelines and Effort
D1How is a case priced?
By the level (Basic, Medium or Advanced) and scope drivers such as devices, hosts, accounts, data volume, parties and urgency. Document 7 gives indicative bands; a written proposal confirms them.
D2What does an incident retainer cost?
Typically from ₹5 lakh to ₹50 lakh a year, depending on assured hours, response times and the size of the estate.
D3How long does a ransomware investigation take?
Triage usually takes 24–72 hours; a full root-cause investigation usually takes two to six weeks, depending on the number of systems and the evidence available.
D4How long does crypto tracing take?
A focused case usually takes one to three weeks. Urgent freezing requests can be supported within days if funds are traced to an exchange.
D5Are tool and data costs included?
Standard tools are included. Specialist blockchain data, third-party lab work or travel are listed separately in proposals.
D6Does a readiness project reduce later costs?
Usually, yes. Investigations are faster and cheaper when logs, procedures and contacts are in place, and retainer clients get lower per-case rates.
D7Can we pay per case without a retainer?
Yes. Insider, fraud, crypto and deepfake cases are commonly engaged per case.
D8Do you charge for expert testimony?
Expert reports and testimony are charged at agreed daily or hourly rates, set out in the engagement terms.
E. Reporting, Evidence and Ongoing Support
E1What will we receive at the end?
A forensic report with findings, a timeline and an evidence index; a Board summary; inputs for regulators and insurers; and, where needed, information for a Section 63 certificate.
E2Can the report be used in court?
Codec Networks prepares reports to evidential standards and can provide expert statements. Whether and how they are used is decided by counsel and the court.
E3How do you present findings to the Board?
In a short summary: what happened, how it happened, what was affected, what it cost, who was responsible where known and what is being done.
E4How do you confirm an attacker has gone?
By threat hunting across the affected estate for the indicators and techniques found in the investigation, and by checking that the entry point is closed.
E5Will you help us improve after an incident?
Yes. The lessons-learned review sets out control fixes, logging improvements, policy updates and awareness actions, and Codec Networks can help implement them.
E6Do you support insurance claims?
Yes. Codec Networks provides insurers with independent facts on cause, scope and impact, in the format their claims process needs.
E7How is evidence stored after the case?
In Codec Networks' certified evidence environment for the agreed period, then returned or securely destroyed as instructed.
E8How often should readiness be reviewed?
At least once a year and after major changes such as cloud migrations, acquisitions or new regulations, ideally with a short first-responder refresher.
