MeitY’s Push to Bring India’s Cyber Forensics Home

The Ministry of Electronics and Information Technology (MeitY) recently asked cyber forensic laboratories across India to evaluate and adopt indigenous cyber forensics tools, either in place of or alongside foreign proprietary software, as the government seeks to reduce external technology dependence and strengthen the country’s digital forensics capabilities.

In an office memorandum dated August 25, MeitY’s Cyber Security Division said cyber forensic laboratories notified under Section 79A of the Information Technology Act, 2000, as Examiners of Electronic Evidence, continue to rely predominantly on foreign proprietary tools for digital forensic examinations.

The ministry said this dependence involves recurring licensing costs and reliance on external vendors for updates and technical support. With the volume and complexity of cybercrime cases increasing, it said there is a need to build long-term indigenous capability and encourage wider adoption of tools developed by Indian institutions, industry and startups.

The memorandum specifically asks cyber forensic labs to evaluate available indigenous tools developed by institutions such as C-DAC, as well as Indian companies and startups, and adopt them wherever they are found suitable.

It also asks laboratories to share feedback and use-case requirements with developers so that the tools can be continuously improved to meet field-level forensic requirements.

MeitY said indigenous cyber forensics tools can provide greater data sovereignty, cost-effectiveness, customisation and freedom from external licensing and support constraints.

The tools developed in India currently cover areas including mobile forensics, memory and disk forensics, network forensics and multimedia and image forensics.

A senior MeitY official tells AIM that the move is aimed at strengthening the country’s cyber resilience while creating a larger market for domestic cybersecurity innovation.

“MeitY’s notification encouraging the adoption and use of indigenous cyber forensics tools is a significant step towards strengthening India’s cyber resilience and advancing the vision of Aatmanirbhar Bharat. Building greater reliance on home-grown capabilities will enhance our ability to investigate cyber incidents, protect critical digital infrastructure and respond swiftly to emerging threats. It will also provide a strong impetus to India’s cybersecurity innovation ecosystem, enabling indigenous technologies to achieve wider adoption across government and law-enforcement agencies,” he states.

Foreign Tools Remain the Global Benchmark

The government’s push comes at a time when foreign proprietary cybersecurity and forensic tools continue to be widely used because of their established capabilities, global threat intelligence networks and extensive testing.

Yajas Setlur, Partner at JSA Advocates and Solicitors, tells AIM that Indian cybersecurity and testing laboratories have historically relied on foreign tools because they are considered the global standard for threat intelligence and vulnerability assessment.

“These tools leverage global scale and compute power to gather and process vast amounts of intelligence. They have a robustness that is still developing in the domestic context,” Setlur says.

He cautions that moving exclusively to domestic tools could also create risks by potentially isolating Indian organisations from international threat intelligence and updates.

“Using exclusively domestic tools or software would isolate these companies and cut their access to international threat updates and increase their exposure to foreign threats,” Setlur states.

However, Setlur said excessive dependence on foreign technology can itself create security, operational and supply-chain risks.

“However, becoming overly reliant on foreign tools can also create material risks for the Indian ecosystem,” he states.

According to him, some tools may involve cross-border data transfers and offshore processing, raising concerns around foreign government access to data, intellectual property theft and data loss.

“Reliance on any one specific jurisdiction or one specific vendor also raises operational and supply-chain risks,” he explains.

The challenge for India, therefore, is to increase domestic capability without disconnecting from the global cybersecurity ecosystem.

“Ultimately, companies and regulators should focus on implementing proportionate guardrails. Development of local capabilities must not come at the cost of decoupling India from the global cybersecurity ecosystem,” Setlur says.

Indian Tools Seek to Close the Credibility Gap

The government’s intervention could also provide domestic cybersecurity companies with a larger opportunity to demonstrate their capabilities in real-world forensic investigations.

Pagilla Manohar Reddy, Threat Researcher at CloudSEK, tells AIM that the historical preference for foreign software was driven as much by credibility and familiarity as by technological capability.

“Foreign tools were the safe choice—the name nobody had to justify. That’s dated now. Indian cybersecurity companies are working with government agencies and law enforcement, and we’re matching the global vendors… because we’re built for the threats that actually hit Indian users. The gap left is credibility, not capability,” Reddy adds.

The distinction could become increasingly important as Indian law enforcement agencies deal with a growing range of digital evidence, including mobile devices, cloud environments, networks, images, memory dumps and other forms of electronically stored information.

For Indian developers, government adoption could provide both a validation mechanism and a testing ground for improving these tools against real-world cases.

A Push for Self-Reliance in Critical Cybersecurity Infrastructure

Dharshan Shanthamurthy, Founder and CEO of SISA, tells AIM that the MeitY move as a major policy intervention for India’s digital security ecosystem.

“The Ministry of Electronics and Information Technology’s notification mandating the adoption of indigenous cyber forensics tools is a landmark move for India’s digital security ecosystem. As we march towards Viksit Bharat, initiatives like these are pivotal in reducing our dependence on foreign technology while strengthening national capabilities in forensic investigation and threat response. This is exactly the kind of policy push that will accelerate self-reliance in critical cybersecurity infrastructure and give Indian innovation the platform it deserves,” Dharshan Shanthamurthy, Founder and CEO, global cybersecurity leader SISA, states.

While the memorandum itself asks laboratories to evaluate and, wherever suitable, adopt indigenous tools rather than imposing an outright replacement of foreign software, the direction is clear: MeitY wants Indian cyber forensic capabilities to become a larger part of the country’s digital evidence and investigation ecosystem.

The policy push also reflects a broader shift in India’s technology strategy. From simply accessing global cybersecurity products to building domestic alternatives for critical functions.

The immediate test, however, will be whether indigenous tools can match global products on accuracy, reliability, threat intelligence, interoperability and forensic defensibility while remaining cost-effective.

For India, the objective may ultimately be less about eliminating foreign cybersecurity technology and more about ensuring that critical investigations do not depend entirely on technologies, vendors or jurisdictions outside the country’s control.