Home › Legal Articles › Digital evidence

Ransomware attack evidence to preserve in the first 48 hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Digital evidence

Ransomware attack evidence to preserve begins with restraint, not recovery: the logs, images and ransom notes you keep in the first forty-eight hours decide whether the crime can ever be proved. Sections 43 and 66 of the IT Act, 2000, sections 318, 336 and 351 of the BNS, 2023, and section 63 of the BSA, 2023 supply the legal frame.

A ransomware attack in India is a criminal offence, not merely an IT incident, and the first forty-eight hours decide whether the crime can ever be reconstructed for a court. The governing provisions are section 43 and section 66 of the Information Technology Act, 2000 for unauthorised access and damage to a computer resource, section 66C for identity theft where credentials are misused, and sections 318, 336 and 351 of the Bharatiya Nyaya Sanhita, 2023 for cheating, forgery and criminal intimidation where a demand for money is made.

The commonest mistake is to clean the infection before anyone has preserved it. You are entitled to get your systems back, but every wipe and reinstall erases the very material an examiner and a court will need. Preserve first, remediate second. Evidence in these cases is fragile, time-limited and easy to destroy by accident, and no amount of later explanation fills the gap left by a machine that was reformatted. This article sets out exactly what to capture, who to call, and what a court, a bank and an insurer will actually weigh.

What the law says

Ransomware sits at the junction of three statutes. Under the IT Act, 2000, section 43 covers unauthorised access, downloading, damage and disruption of a computer resource, and section 66 makes acts done dishonestly or fraudulently under section 43 punishable with imprisonment and fine. Section 66C punishes identity theft, which applies where stolen credentials, passwords or digital signatures are used without consent. Section 66D covers cheating by personation using a computer resource, which is what happens when an intruder impersonates an administrator, a vendor or a colleague. Section 67 concerns publishing obscene material, while section 67B matters in the narrower case where attackers steal intimate images and threaten to publish them.

On the criminal side, the Bharatiya Nyaya Sanhita, 2023 supplies the general offences. Section 318 (cheating) applies where data or money is obtained by deception. Section 316 (criminal breach of trust) applies where an insider, vendor or service provider was entrusted with your systems and betrayed that trust. Section 336 (forgery) applies where records, invoices or certificates are falsified. Section 351 (criminal intimidation) is squarely engaged when the attacker threatens to release your data or to keep systems locked unless a ransom is paid. Where several people acted together, the conspiracy provisions of the BNS apply in addition.

Procedure matters as much as the offence. A cyber offence is cognizable, so information must be recorded and an FIR registered under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, and the zero-FIR facility lets you give information at any police station. If a station refuses, section 175(3) of the BNSS allows you to approach the jurisdictional Magistrate, who can direct investigation. For your logs, backups and forensic images to be admissible, section 63 of the Bharatiya Sakshya Adhiniyam, 2023 governs electronic records, and the accompanying certificate is not optional — an image produced without it can be challenged at trial.

The financial limb runs alongside the criminal one. If a payment, transfer or account was named in the demand, the RBI's directions on unauthorised electronic transactions and customer protection govern how your bank must handle the complaint, the timeline for redressal, and the extent of your liability where you reported promptly. For a business, the same circulars shape how the bank responds to a request to freeze or flag an account, and they are the first thing a lawyer reads when a bank says the loss was your fault.

How the attack usually runs

Most ransom cases reach the victim in a recognisable sequence, and knowing the sequence tells you where the evidence sits. An entry point is opened by a phishing email, an exposed remote-desktop service or stolen credentials bought elsewhere. The attackers then move sideways, create accounts of their own, and steal data before locking anything — which is why the threat to publish is credible. Encryption is the last stage, not the first, so the intrusion logs and the data-exfiltration records predate the visible crisis and are the most valuable material you hold. Where an employee or a vendor account was the entry point, the same logs become the centre of the criminal case under sections 318 and 316 of the BNS. This is why the timeline you keep must start well before the day the files were locked.

The first forty-eight hours, step by step

Isolate without destroying. Disconnect affected machines from the network. Power down only if the attack is actively spreading. Before any wipe, take a memory image and a disk image. Never delete the ransom note — it is the single most useful exhibit.
Fix the basic facts. Note the exact detection time, systems affected, file extensions changed, any wallet address or UPI ID shown, and the ransom message in full. A contemporaneous note carries weight that a reconstruction made later never will.
Preserve the money trail. If an account, UPI handle or crypto wallet was named, record it precisely and ask your bank to flag or freeze it at once. A fast freeze decides most recoveries.
Call 1930. The national cyber-crime helpline logs the complaint and can initiate a transaction hold through the payment system. Keep transaction references, account numbers and timestamps ready.
File on cybercrime.gov.in. The National Cyber Crime Reporting Portal accepts your evidence and issues an acknowledgement number that binds the case together.
Write to the bank. Send a written complaint to your branch and to the bank nodal officer, asking for reversal and preservation of the trail, invoking the RBI directions on unauthorised electronic transactions.
Register the FIR. Give a chronological complaint at the jurisdictional police station and seek registration under section 173 of the BNSS. Attach the portal acknowledgement and an evidence index.
Tell the right third parties. Where personal data of employees or customers was exposed, the Digital Personal Data Protection Act, 2023 and sectoral rules apply; a business should also notify its insurer and, where relevant, report to its sectoral regulator.

The evidence that actually decides cases

Not every artefact matters equally. Courts and investigators respond to a small set of items, and it is worth knowing which ones carry weight before you spend money on an expensive forensic exercise.

Evidence	What it proves	How to preserve it
Disk and memory image	The payload, the attacker's tools and the timeline	Forensic copy, hashed, with a chain-of-custody note
Ransom note and headers	Links the demand to cheating and criminal intimidation	Photograph the screen and export the raw message file
Server, VPN and email logs	Entry point and the account used	Export raw logs, unedited, with the time zone stated
Bank, UPI or wallet details	Enables freezing and recovery	Share with bank and 1930 in the same hour
Incident timeline	Anchors the whole case	One dated, signed log kept in one place

What actually decides the outcome

Four things move a ransomware matter. The first is speed of freezing: money stopped inside the payment chain is recoverable, money already layered through accounts usually is not. The second is the quality of preservation — a hashed forensic image with a proper section 63 certificate is attacked far less successfully than screenshots alone. The third is whether you paid. Payment is not illegal, but it funds the offence, frequently invites a second demand, and does not reliably end the attack. The fourth is traceability: if the attack can be linked to a known account, an internet address or a person inside your organisation, an investigation has somewhere to go; if it leads only to an anonymous wallet, the criminal side becomes hard, and the civil and insurance routes carry the recovery. A related factor is how early you informed your insurer and whether the policy required you to notify before you took remediation steps.

Where the intrusion came through an insider, a vendor or a neglected service contract, section 316 of the BNS and ordinary contractual liability may both be available. Where a cloud or IT provider failed to meet a security obligation it took on, the civil route and an arbitration or consumer forum may be the practical remedy, running parallel to the police case. Where the attacker threatens to publish stolen data, the threat itself is a separate offence under section 351 and, in the narrow intimate-image case, section 67B of the IT Act applies. Where personal data was exfiltrated, a regulator may take an independent view of whether your own safeguards were reasonable, so the answer you give the regulator and the answer you give the police should be prepared together, not separately.

What to hand over, and in what form

The way evidence is packaged matters almost as much as what it contains. Investigators and courts work from an index, not from a folder of loose files. Prepare a short covering note that states who collected each item, when, from which machine, and how it was hashed. Keep the original media sealed and hand over working copies. Where the material includes personal data of employees or customers, do not redact it yourself before the police see it; instead flag the sensitive categories and let the investigating officer decide how to handle them. If an external forensic firm is engaged, confirm in writing that it will produce a section 63 certificate under the BSA, 2023 and will preserve its own working notes, because those notes become disclosable material. Where the matter later goes to a civil suit or an insurance claim, the same index and certificate serve all three proceedings, so building it once, properly, saves months later.

Common mistakes

Rebooting or reinstalling before imaging the machine.
Paying the ransom to "buy time" and thereby losing both leverage and evidence.
Deleting the ransom note or the phishing email because it looks frightening.
Reporting only to 1930 and never filing the FIR, so no investigating officer owns the case.
Editing log files "to make them readable" before handing them over.
Delaying the bank complaint until the internal IT review is finished.
Telling the insurer what happened only after remediation is complete.
Assuming a small business is too minor to report — the same account may be used against others.

Where a lawyer fits

A ransomware matter is rarely only a police complaint. It can involve the FIR, an insurer who wants the loss documented in a particular way, a vendor whose contract limits liability, and regulator or data-protection obligations that run on their own clock. A cyber crime lawyer in Kolkata can prepare the complaint so that it pleads the correct sections from the outset, keep the forensic and legal strands from contaminating each other, and handle the escalation if the police station declines to register or the bank refuses to reverse. For matters that end in a contested complaint or in bail after an FIR names an employee, the practical next steps are set out at criminal defence. If the dispute is contractual and the loss is being recovered from a service provider, civil litigation explains the parallel track. Where a West Bengal business needs a local point of contact, the state page at cyber crime lawyer West Bengal sets out how jurisdiction works.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Is a ransomware attack a criminal offence in India?

Yes. Unauthorised access and damage to a computer resource are offences under sections 43 and 66 of the IT Act, 2000, and a ransom demand engages cheating and criminal intimidation under sections 318 and 351 of the BNS, 2023. Where credentials are misused, section 66C of the IT Act applies, and the offence is cognizable, so an FIR can be registered.

Should I shut down the infected computer?

Isolate it from the network rather than wiping it, and power it down only if the attack is still spreading. A forensic image of memory and disk taken before any reboot or reinstall preserves the malware, the ransom note and the attacker's tools. Cleaning the machine first is the single most damaging mistake a victim can make.

Should I pay the ransom?

Payment is not itself unlawful in India, but it funds the offence, often triggers a second demand, and does not guarantee that stolen data will be released. It also complicates your insurance claim and can be viewed as a loss you chose to incur. The stronger route is to freeze the trail, report at once, and preserve evidence.

How quickly can a ransom payment be frozen?

Reaction time matters more than anything else. Reporting on 1930 and writing to your bank nodal officer within hours gives the payment chain a real chance of a hold. Once funds have been layered through multiple accounts or converted, recovery becomes very unlikely, so the first day is decisive. Time decides the case.

What evidence should I keep for a ransomware case?

Keep hashed forensic images of disk and memory, the ransom note in its original form, server, VPN and email logs, bank, UPI or wallet details named in the demand, and one dated incident timeline. All of it is electronic evidence under section 63 of the BSA, 2023, and needs the accompanying certificate to be relied on in court.

Can a ransomware victim file an FIR outside their own city?

Yes. A cyber offence is cognizable and the zero-FIR facility allows information to be given at any police station, even outside the district where the offence occurred. The station records it and forwards it to the competent police station. If registration is refused, section 175(3) of the BNSS lets a Magistrate direct investigation.

Does a business have to notify anyone after a ransomware attack?

Where personal data of employees or customers has been exposed, notification obligations arise under the Digital Personal Data Protection Act, 2023 and any sectoral rules that apply to the business. Insurers must usually be told promptly as well. Regulated entities may also owe their sectoral regulator a report, so the legal and IT timelines run together.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact