Digital Evidence under the IT Act: Collection, Chain of Custody and Proof

Topic 9 explained the law of admissibility: Sections 61 to 63 of the BSA and the certificate cases from Anvar to Arjun Panditrao. But a certificate is only as good as the investigation behind it. Digital evidence can be altered with a click, lost when a phone is switched on, or held by a company in another country. This note covers the practical and procedural side: what digital evidence is, how it moves from crime scene to courtroom, the legal powers to collect it, how its integrity is preserved, how data is obtained from platforms and from abroad, the rights of the accused, and how it is finally proved.

1. Fingerprints That Can Be Wiped Remotely

A fingerprint on a glass stays until someone wipes it. Digital traces are more fragile: a phone can be wiped remotely, cloud data deleted from anywhere, and a file's timestamp changed simply by opening it. That is why digital evidence demands special care at every stage. The investigator must capture it quickly, freeze it in its original state, prove that nobody has changed it since, and explain it to a court that may never have seen the technology before.

2. Types of Digital Evidence

Figure 1: Common sources of digital evidence

• Volatile and non-volatile. Data in a running device's memory disappears when it is switched off; data on storage and in the cloud persists but can be deleted. The order of collection matters.
• Content and metadata. The message itself, and the data about it: who sent it, when, from where and on what device. Metadata often proves more than content.

3. The Forensic Lifecycle

Figure 2: Five stages from scene to court

• Identify. Recognise where evidence may lie: devices at the scene, accounts, cloud storage, call records, CCTV, bank trails.
• Collect. Seize devices or obtain data under legal authority, recording the process.
• Preserve. Compute hash values, use write-blockers so that examination does not alter the original, isolate phones in Faraday bags to prevent remote wiping, and seal and record every handover.
• Analyse. Work on a forensic copy, never the original, in a laboratory; recover deleted data and interpret metadata.
• Present. Produce the record with the certificate under Section 63 BSA, including hash values, supported by expert evidence where needed.

4. Legal Powers of Collection

Figure 3: The legal source for each step

• Production (s.94 BNSS). A court or police officer may summon any document or electronic communication, including a communication device likely to contain digital evidence.
• Search and seizure (ss.105 and 185 BNSS). The process of search and seizure, including the list of seized items, must be recorded by audio-video electronic means, preferably a mobile phone, and the recording sent promptly to the Magistrate. The e-Sakshya app was introduced with the new criminal laws to capture such recordings with time stamps and location data.
• Forensics at the scene (s.176(3) BNSS). For offences punishable with seven years or more, a forensic expert must visit the crime scene to collect evidence, and the process must be videographed.
• IT Act powers. Interception and decryption (s.69) and traffic data (s.69B) under their safeguards; preservation duties of intermediaries (s.67C); and investigation of IT Act offences by an Inspector or above (s.78)

5. Chain of Custody and Integrity

Figure 4: The chain of custody for a seized device

• Hash values. A hash function such as SHA-256 produces a unique digital fingerprint of the data. If the hash computed at seizure matches the hash computed in the lab and in court, the data is unaltered. The Schedule to the BSA requires hash values in the certificate.
• Chain of custody. A documented record of who held the evidence, when and why, from seizure to court. Gaps invite the argument that the evidence was tampered with.
• Expert examination. Under Section 79A of the IT Act, the Central Government notifies Examiners of Electronic Evidence, and their opinion is relevant under Section 39(2) BSA.
• CCTV. In Paramvir Singh Saini v. Baljit Singh, (2021) 1 SCC 184, the Supreme Court directed installation of CCTV cameras in all police stations and in the offices of central investigating agencies, with footage to be preserved, strengthening both evidence and accountability.

6. Data from Platforms and from Abroad

• Platforms in India. Under Rule 3(1)(j) of the IT Rules, 2021, an intermediary must provide information to an authorised government agency for verification of identity or for prevention, detection, investigation or prosecution of offences within 72 hours of an order, and under Rule 3(1)(g) must preserve removed content and records for 180 days.
• Logs. CERT-In's 2022 Directions require logs to be kept in India for 180 days, which often supplies the IP address and time needed to trace an offender.
• Data held abroad. Where a provider stores data outside India, investigators rely on letters of request to foreign authorities (s.112 BNSS) and mutual legal assistance treaties, which are slow; many providers also respond voluntarily to lawful requests for non-content data.
• Payment trails. Banks, payment aggregators and the 1930 helpline's fund-freezing system help trace and freeze money in cyber fraud.

7. Rights of the Accused

Figure 5: Constitutional limits on digital evidence gathering

• Self-incrimination. Selvi v. State of Karnataka, (2010) 7 SCC 263 bars involuntary narco-analysis and polygraph tests. In Virendra Khanna v. State of Karnataka (Karnataka High Court, 2021), the Court held that directing an accused to provide a phone password or biometrics is not testimonial compulsion under Article 20(3), but laid down safeguards: the search must be authorised, conducted with an expert present, and the data must not be shared with third parties.
• Privacy. After Puttaswamy (2017), search of a phone, which holds a person's entire private life, must be lawful and proportionate. The Supreme Court has asked the Central Government to frame guidelines on seizure of digital devices in a pending case concerning journalists.
• Fair trial. In P. Gopalkrishnan @ Dileep v. State of Kerala, (2020) 9 SCC 161, the Court held that the contents of a memory card are a document and the accused is entitled to a copy, subject to conditions protecting the victim's privacy.
• Adverse inference. Failure of the prosecution to produce available electronic evidence, such as CCTV footage, can lead to an adverse inference (Tomaso Bruno v. State of U.P., (2015) 7 SCC 178)

8. Proof in Court

• Original device. If the original device is produced and proved by its owner or operator, it is primary evidence and no certificate is required (Arjun Panditrao, 2020; s.57 BSA)
• Copies. Printouts, CDs, pen drives and forensic images require the two-part certificate under Section 63(4) BSA, signed by the person in charge and an expert, with hash values, at each instance of submission.
• Weight. Admissibility is not the end: the court weighs reliability, integrity, chain of custody and expert evidence before relying on the record.

9. Quick Revision and Memory Aids

• 'Fingerprints that can be wiped remotely'. Why digital evidence is fragile.
• 'Identify, collect, preserve, analyse, present'. The forensic lifecycle.
• '94 produce, 105 record, 176(3) forensic'. BNSS powers.
• '72 hours, 180 days'. Platform assistance and preservation.
• 'Hash at seizure = hash in court'. Proof of integrity.
• 'Khanna: password yes, with safeguards'. Rights of the accused.

10. Frequently Asked Questions

What is the chain of custody and why does it matter?

It is the documented record of every person who handled the evidence from seizure to court. Together with matching hash values, it shows that the digital evidence has not been altered; a broken chain can make otherwise admissible evidence unreliable.

Can the police compel an accused to unlock a phone?

The Karnataka High Court in Virendra Khanna (2021) held that a direction to provide a password or biometrics does not violate Article 20(3), subject to safeguards on how the search is conducted and the data is used.

11. Related Topics

• Topic 9: Electronic Evidence and IT Act. Admissibility and the certificate cases.
• Topic 18: IT Act and Right to Privacy. Privacy limits on investigation.