Mobile Phone Data as Evidence under the Bharatiya Sakshya Adhiniyam, 2023: Seizure, Extraction, Access and Attribution

A phone is not a document; it is a repository of thousands of them. Messages, call logs, photographs with embedded location data, browsing history, application data, location history, deleted material still present in storage — a single device may hold more about a person's movements and communications than every other source in a case combined. The Adhiniyam accommodates all of it without difficulty. The difficulties lie in seizing the device without altering it, in getting into it, and in showing who was holding it.

1. What a Phone Holds

The illustrations to Section 2(1)(d) name 'documents on computers, laptops or smartphones', 'messages', 'locational evidence' and 'voice mail messages stored on digital devices'. Each of these is a document, and the apparatus of Part III applies to each.

The material ordinarily recoverable from a device falls into recognisable classes.

• Communications — messages, call logs, application chats, email stored locally, voice mail.
• Media — photographs and videos, each ordinarily carrying embedded metadata recording the device that created it, the date and time, and frequently the location.
• Location history — where the device has been, recorded by the operating system and by applications, often in considerable detail and over long periods.
• Application data — the working databases of messaging, banking, transport, payment and social applications, which hold far more than the applications display.
• System records — installation and uninstallation logs, connection records, device pairing, network connections, power events.
• Deleted material — messages, files and fragments that persist in databases and in unallocated space after the user has deleted them.

2. Seizure

More evidence is destroyed in the first minutes after a phone is seized than at any later stage, and the reasons are technical rather than deliberate.

A device left connected continues to operate. Messages arrive and overwrite older material. Applications synchronise. Backups run. Location is recorded. And a device connected to a network may be remotely wiped by a person with access to the associated account, which is a real and not a theoretical risk.

Three steps at the point of seizure preserve what is there.

1. Isolate the device. Switch to flight mode, or place it in a shielded bag, so that it can neither receive nor be commanded remotely. Record that this was done and when.
2. Do not switch it off if it is on, and do not switch it on if it is off — the first may engage encryption requiring credentials to unlock, the second alters the device. Where a decision must be made, it should be made on advice and recorded.
3. Record the state — whether it was on, whether it was locked, what was displayed, the battery level, and any visible damage.

The seizure memo should describe the device by make, model, equipment identifier and the identity of any module in it, and should record the hash value where a digest can be computed at the scene. Under Section 105 of the Bharatiya Nagarik Suraksha Sanhita, 2023 the search and seizure is to be audio-video recorded, which provides a contemporaneous account of the device's condition at the moment it was taken.

3. Extraction

Examination is not conducted on the device. A forensic image is taken, and all work is done on a working copy of the image.

Extraction from a phone is conventionally described at three levels, and what each yields differs greatly.

A write blocker is used so that the act of imaging does not write to the source, and hash values are computed for the source and the image and shown to match. These steps are what allow the examiner to say that the material he examined is the material seized.

Where the level of extraction matters — as it will where deleted material is relied upon — the examiner should state which level was achieved and why. An examiner who obtained only a logical extraction and asserts that nothing was deleted has not looked in the places where deleted material survives.

4. Getting Into the Device

Modern devices are encrypted by default, and access requires either credentials or a technical route around them. This raises a constitutional question on which there is no settled Indian authority, and the applicable principles must be worked out from the decisions on self-incrimination.

4.1 Applying the principle

Applying Kathi Kalu Oghad and Selvi to device access produces a distinction that is easy to state and has not yet been authoritatively resolved in India.

A passcode exists only in the person's mind. Compelling him to disclose it compels him to communicate the contents of his mind, which is what Selvi identifies as testimonial compulsion. On that reasoning Article 20(3) is engaged.

A fingerprint or facial scan used to unlock a device is identificatory material of precisely the kind Kathi Kalu Oghad placed outside the protection, and the Criminal Procedure (Identification) Act, 2022 expressly provides for the taking of measurements including finger impressions and biometric scans. On that reasoning the protection is not engaged.

Two practical routes avoid the question. Where the device is unlocked at seizure, access is obtained without compulsion, which is one reason the state of the device at seizure should be recorded. And where a technical extraction is possible without credentials, no compulsion arises at all.

5. Photographs and Embedded Metadata

A photograph taken on a phone ordinarily carries embedded metadata recording the make and model of the device, the date and time of capture, the camera settings, and frequently the location at which it was taken.

This makes photographs unusually valuable. A photograph is relevant as a document showing what it depicts; the embedded data is relevant under Section 7 as fixing the time and place, and under Section 5 as establishing the state of things.

Three cautions apply. Embedded metadata can be edited, and an examiner should be asked whether he verified it against the file structure and the device's own records. Metadata is stripped when an image is shared through most messaging applications, so an image received through a chat carries none, and the original from the capturing device is what must be obtained. And the location recorded is the location of the device, not of the person — the same attribution problem as everywhere else.

6. Location History

Operating systems and applications record location far more precisely and far more often than a call detail record does. Where a call record places a device within a cell sector at the moment of a call, a location history may place it within metres, continuously, over months.

The evidentiary value is correspondingly higher and the privacy intrusion correspondingly greater. Two consequences follow.

On relevance and proof, location history is a document like any other, relevant under Sections 5 and 7, and recovered as part of a forensic extraction. Where recovered from the device it is ordinarily primary evidence under Explanation 6 to Section 57, being material in automated storage.

On privacy, the reasoning in K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1 applies with particular force. A nine-Judge Bench held that informational privacy is a facet of the fundamental right, and that an invasion must satisfy legality, necessity and proportionality. The extraction of a person's entire location history in an investigation about a single incident invites the objection that the intrusion exceeds what the investigation requires, and the authority under which the extraction was conducted is answerable.

Admissibility is a separate question. On the general Indian position in Pooran Mal v. Director of Inspection (Investigation), (1974) 1 SCC 345, the test is relevancy, and material is not excluded because of the manner in which it was obtained unless a statute so provides. The privacy objection therefore goes to the propriety of the exercise and to the conduct of the agency rather than to the reception of the material.

7. Cloud Data and Backups

A great deal of what appears to be on a phone is not on the phone. Messages, media, contacts and application data are synchronised to accounts held by service providers, frequently on servers outside India, and a device examined in isolation may show only what has been retained locally.

Three consequences follow.

A backup may hold what the device no longer holds. Material deleted from the device may persist in a backup, and where the account credentials are available the backup may be far more productive than the handset.

The provider is the custodian, not the party. Obtaining material from a foreign provider ordinarily requires a request through the channels the provider recognises, and in a criminal matter frequently a request under a mutual legal assistance arrangement. This is slow, and it is a further reason to move early.

The certificate is a problem. A certificate under Section 63(4) requires a person in charge of the device or of the relevant activities. Where the record is held by a foreign provider, obtaining such a certificate is often impracticable, and the party is thrown back on Explanation 4 to Section 57 — proper custody, unless disputed — or on an application to the court to compel production, which Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1 permits where the system is in another's control.

The absence of an express extent clause in Section 1 of the Adhiniyam is read by commentators as removing a textual obstacle to receiving evidence originating outside India. Removing an obstacle to admissibility does nothing about the practical difficulty of obtaining the record and the certificate.

8. Attribution

The recurring problem is sharper with a phone than anywhere else, because a phone is a personal object that other people handle.

What must be established is not merely that the device belonged to the person, but that he was operating it at the material time. The material available includes exclusive possession, the security configuration and who knew the credentials, contents known only to him, the continuity of use across a period, biometric records where the device logs which biometric unlocked it, corroborative location data from another source, conduct afterwards, and admission.

Section 90 forbids any presumption as to who sent an electronic message, and the reasoning extends to device data generally. That material was created on a device says nothing about whose hands were on it.

A phone does, however, offer something other sources do not: volume and pattern. A single message may be attributable to anybody with access; a pattern of use running over months, consistent with the person's known movements, habits, contacts and activities, is very difficult to attribute to somebody else. The attribution case in a phone matter is ordinarily built from the pattern rather than from any single item.

9. A Practical Checklist

1. Isolate the device at seizure, and record that it was done.
2. Record the state — on or off, locked or unlocked, what was displayed — because it bears on the access question.
3. Describe the device fully in the seizure memo, with make, model, equipment identifier and module.
4. Compute a hash as early as possible, and record it contemporaneously.
5. Image with a write blocker, and examine the image rather than the device.
6. Establish the level of extraction achieved, and say so, particularly where deleted material is relied upon.
7. Obtain original media from the device, not copies received through messaging applications, because metadata is stripped in transit.
8. Consider the cloud account early, and start the process of obtaining provider records at once.
9. Confine the extraction to what the investigation requires, and be ready to justify its scope under Puttaswamy.
10. Build the attribution case from the pattern, not from a single item.

10. The Position Stated Shortly

1. A phone is a repository of documents, and its contents fall within Section 2(1)(d) by name.
2. Explanation 6 to Section 57 makes recovered fragments primary evidence, including material in caches, temporary files and unallocated space.
3. Isolation at seizure is the critical step, because a connected device continues to change and may be wiped remotely.
4. Examination is conducted on a forensic image, taken with a write blocker and verified by hash.
5. The level of extraction determines what is recovered, and only a physical extraction reaches most deleted material.
6. Compelling a passcode probably engages Article 20(3); compelling a biometric probably does not — the point is unsettled and should not be assumed either way.
7. Embedded metadata in photographs is valuable but is stripped in transit, so the original from the capturing device is what matters.
8. Attribution is built from the pattern of use, since no provision connects device data to a person.

11. Related Topics and Provisions