Chain of Custody of Digital Evidence under the Bharatiya Sakshya Adhiniyam, 2023: The Statutory Gap and How It Is Filled

The Adhiniyam tells a court when an electronic record may be received. It says nothing about how the record is to be kept between the moment it is seized and the moment it is produced, and the Standing Committee said so while the Bill was before it. The gap has not been filled by amendment. It is filled, imperfectly, by the hash requirement in the Schedule, by the recording obligations in the criminal procedure legislation, and by ordinary evidence of what happened to the material — and cases are decided on it every day.

1. The Gap

The Standing Committee on Home Affairs, examining the Bharatiya Sakshya Bill, observed that it contained no provision securing the chain of custody of material and digital records collected during investigation. The observation was made, the Bill was passed substantially as introduced, and the position remains as the Committee described it.

What the Adhiniyam does contain is a set of provisions about admissibility — Section 61 removing the objection that a record is electronic, Section 63 setting out four conditions and requiring a certificate, and the Explanations to Section 57 deeming certain outputs to be primary evidence. None of these addresses what happens to a device between seizure and trial, who may access it, how transfers are recorded, or what follows from a break in the record.

This is not an oversight peculiar to electronic material. The Adhiniyam says nothing about the custody of a weapon or a viscera sample either. The difference is that physical evidence can be sealed and its condition observed, whereas an electronic record can be altered without any visible trace, and a broken chain therefore matters more.

2. What a Chain of Custody Consists Of

The chain is an unbroken account of the material from the moment it comes into the hands of the investigating agency or the party to the moment it is produced in court. Each link must be established by evidence, and a gap anywhere destroys the value of everything downstream of it.

2.1 Seizure

What must be proved is where the device was found, when, from whom, and in what condition. The seizure memo or panchnama should describe the device with identifying particulars — make, model, serial number, IMEI where applicable — and should record its physical state, whether it was switched on, and whether it was connected to a network.

The state of the device at seizure matters technically as well as evidentially. A phone left connected can receive messages, synchronise, or be remotely wiped; a computer left running continues to write to its storage. Isolation at the point of seizure — switching to flight mode, disconnecting from the network, or placing the device in a shielded bag — should be recorded, because a party who did not isolate the device will be asked what changed after he took it.

2.2 Hashing

The digest should be computed at the earliest possible moment and recorded in the seizure memo, attested by the witnesses to the seizure. This is the single most valuable step in the whole chain, because it fixes the state of the material at a point independently established by other evidence.

The Schedule to Section 63(4) requires the hash value to appear in Part A of the certificate. A digest appearing there for the first time, with no contemporaneous record of when it was computed, is an assertion rather than a verification.

2.3 Sealing and storage

The device or storage medium should be sealed, the seal described, and a specimen preserved. It should then be entered in the appropriate register and kept in secure custody, with the register available to show that it remained there and who had access.

2.4 Imaging

Examination should not be conducted on the original. A forensic image — a bit-for-bit copy including unallocated and slack space — is taken using a write blocker, which prevents any write operation to the source. The source and the image are both hashed and shown to match, and all subsequent work is done on a working copy of the image.

Where no write blocker was used, the source will have been altered by the act of examination, timestamps and indexes will have changed, and the party will be unable to explain why the digest of the source no longer matches what was recorded at seizure.

2.5 Transfer

Each movement of the material — from the police station to the laboratory, from one officer to another, from the laboratory back — should be recorded, with the person carrying it identified and available to be examined, and the digest verified at each end.

2.6 Examination

The examiner should record what he received, in what condition, whether the seals were intact and matched the specimen, what he did, with which tools and versions, and what he found. The digest should be verified on receipt and on return.

2.7 Production

The output tendered should be identified by its own digest, and the certificate under Section 63(4) should make clear what the disclosed hash is the hash of — the source, the image, or the output. These are different values, and a certificate that does not say which is being given is ambiguous at the point where clarity matters most.

3. What the BNSS Supplies

The Bharatiya Nagarik Suraksha Sanhita, 2023 does not create a chain-of-custody regime either, but two of its provisions produce material that supports one.

Section 105 requires the audio-video recording of search and seizure. Where a search is recorded, the circumstances in which a device was found, its condition, and the manner of its taking become verifiable, and the recording is a contemporaneous account of the first and most contested link in the chain.

Section 176(3) requires, for offences punishable with seven years or more, that a forensic expert visit the scene of crime to collect forensic evidence and that the process be videographed. This brings technical competence to the point of collection, which is where most damage to digital material is done, and it produces a visual record of what was collected and how.

4. Where Chains Break

Breaks recur at predictable points, and each has a characteristic consequence.

1. No digest at seizure. The state of the material at the moment it was taken cannot be established, and no subsequent step can supply it. This is the most serious and the most common failure.
2. No isolation. The device continued to receive data after seizure, so its contents at examination differ from its contents at seizure, and the difference cannot be attributed.
3. No write blocker. The source was altered by the examination itself, and the digest recorded at seizure no longer matches.
4. Examination of the original rather than an image. Every step of the examination has written to the source, and the original is no longer in the state in which it was seized.
5. A gap in the register. The material cannot be accounted for over a period, and during that period it was accessible to persons unknown.
6. Seals not described, or specimen not preserved. It cannot be shown that the parcel opened at the laboratory is the parcel sealed at the police station.
7. The carrier not examined. Nobody can say the material that left one place is the material that arrived at another.
8. Ambiguous hash in the certificate. A digest is given without identifying what it is the hash of, so it verifies nothing in particular.

5. Attacking and Defending the Chain

5.1 For the party challenging

The questions are the same in every case and should be asked in sequence.

• When was the device seized, from where, from whom, and who was present?
• Was it isolated from the network, and if so how and when?
• Was a digest computed at seizure? Where is it recorded? Who computed it and with what tool?
• Was the device sealed? Is the seal described? Was a specimen preserved?
• Where was it kept, and does the register account for it throughout?
• Who carried it to the laboratory, and is that person available?
• Were the seals intact on receipt, and did they match the specimen?
• Was a forensic image taken with a write blocker, and do the digests of source and image match?
• Was the examination conducted on the image or on the original?
• Does the digest of the output tendered correspond to anything recorded earlier?

5.2 For the party producing

The defence of a chain is built long before the trial, and by the time an objection is taken it is ordinarily too late to improve it. What can be done at trial is to present the chain as a narrative supported by contemporaneous documents rather than as a series of assertions — the seizure memo with the digest on it, the register, the transfer receipts, the laboratory's receipt note, the examiner's working record — each proved by the person who made it.

Where a link is genuinely weak, the better course is to address it rather than conceal it. A break candidly explained, with evidence that the material could not have been interfered with during the gap, is far more persuasive than a chain presented as unbroken and then shown not to be.

6. The Legal Consequence of a Break

A break in the chain is not, in Indian law, a rule of automatic exclusion. It operates in two ways.

It may defeat admissibility. Where the break is such that the party cannot establish that the output relates to the record seized, the conditions in Section 63(2) cannot honestly be certified — in particular condition (d), that the information reproduces or is derived from what was fed into the device. A certificate that cannot be supported is not cured by being signed.

More usually it destroys weight. The record is received and then found to be worth nothing, because the court cannot exclude the possibility that it was altered during the unaccounted period. This is the ordinary outcome, and it is the reason chain-of-custody objections are taken as questions of fact rather than as preliminary objections to admissibility.

In a case resting on circumstantial evidence, the consequence is more precise. Each circumstance must be fully established, and a forensic finding whose provenance cannot be traced is not fully established. It drops out of the chain of circumstances, and the remaining links must carry the case without it.

7. Custody of Material Not Seized by the Police

A great deal of electronic evidence never passes through an investigating agency at all. A party produces messages from his own phone, a company produces records from its own system, a litigant produces an email from his own account. The chain-of-custody question arises differently but does not disappear.

Where the record comes from the party's own device or system, the questions are: when was the record first preserved, by whom, and what has been done to it since; whether the device has remained in the party's control; and whether a digest was computed when the record was extracted rather than when the certificate was drawn. A party who took a screenshot two years ago and produces it now is in a materially weaker position than one who exported the record and hashed it at the time.

Where the record comes from a third party — a service provider, a bank, a platform — the chain is shorter and stronger, because the record is produced from a system the party has no access to and no ability to alter. What must be established is that the record was in fact obtained from that source, which is ordinarily done by the provider's own certificate or by the officer who obtained it.

Where the record is with a third party who will not produce it voluntarily, the ordinary compulsive machinery applies — a summons to produce a document under Section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023, which corresponds to Section 91 of the Code of Criminal Procedure, 1973, or an application in a civil proceeding. On the authority of Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1, where a party cannot obtain the certificate because the device or system is in the control of another, the court may compel its production.

8. A Working Checklist

1. Record the digest at seizure, on the seizure memo, attested by the seizure witnesses. Nothing else in the chain matters as much.
2. Isolate the device at the point of seizure and record that it was done.
3. Describe the device fully — make, model, serial number, IMEI — so that the article produced can be identified as the article seized.
4. Seal, describe the seal, and preserve a specimen.
5. Image with a write blocker, and hash both source and image.
6. Examine the image, never the original.
7. Verify the digest at every transfer, and keep the receipts.
8. Record the examination — tools, versions, steps, findings — contemporaneously.
9. State clearly in the certificate what the hash is the hash of, and give more than one where more than one stage is being vouched for.
10. Keep the recordings made under Sections 105 and 176(3) of the BNSS, and prove them as electronic records.

9. The Position Stated Shortly

1. The Adhiniyam contains no chain-of-custody provision, as the Standing Committee observed, and the gap has not been filled by amendment.
2. Admissibility and integrity are separate questions. A perfect certificate does not establish what happened to the device before the output was made.
3. The digest at seizure is the anchor, and it must be recorded contemporaneously and independently of the certificate.
4. Write blocking and forensic imaging are what keep the source unaltered, and examination of the original destroys the very thing the digest was taken to protect.
5. Sections 105 and 176(3) of the BNSS produce supporting material, but each recording is itself an electronic record requiring proof.
6. A break ordinarily destroys weight rather than admissibility, but in a circumstantial case it removes the circumstance from the chain altogether.
7. Where the record is with a third party, the court may compel production — Arjun Panditrao — and a party unable to obtain a certificate through no fault of his own has a remedy.
8. A weak link is better addressed than concealed, because a chain presented as unbroken and shown not to be does more damage than the gap itself.

10. Related Topics and Provisions