Section 3(2)(g) in The Information Technology (Procedure And Safeguard For Monitoring And Collecting Traffic Data Or Information) Rules, 2009
(g)undertaking forensic of the concerned computer resource as a part of investigation or internal audit of information security practices in the computer resource;