Opinion of the Examiner of Electronic Evidence under Section 39(2) of the Bharatiya Sakshya Adhiniyam, 2023 and Section 79A of the Information Technology Act, 2000

Electronic evidence raises two questions that are constantly confused. The first is whether a record may be received at all, which is governed by Sections 61 and 63 and the certificate in the Schedule. The second is what the record means — whether it was altered, where it came from, what a deleted file contained, whether a device was used at a particular time — and that is a question of expert opinion under Section 39(2). A record may be perfectly admissible and wholly unexplained, or expertly analysed and inadmissible.

1. The Two Provisions

Section 39(2), BSA

When in a proceeding, the Court has to form an opinion on any matter relating to any information transmitted or stored in any computer resource or any other electronic or digital form, the opinion of the Examiner of Electronic Evidence referred to in Section 79A of the Information Technology Act, 2000, is a relevant fact.

Section 79A, Information Technology Act, 2000 — Central Government to notify Examiner of Electronic Evidence

The Central Government may, for the purposes of providing expert opinion on electronic form evidence before any court or other authority, specify, by notification in the Official Gazette, any department, body or agency of the Central Government or a State Government as an Examiner of Electronic Evidence.

Explanation. — For the purposes of this section, 'electronic form evidence' means any information of probative value that is either stored or transmitted in electronic form and includes computer evidence, digital audio, digital video, cell phones and digital fax machines.

Section 39(2) corresponds to Section 45A of the Indian Evidence Act, which was inserted by the Information Technology (Amendment) Act, 2008 alongside Section 79A. The Adhiniyam has placed it as a sub-section of the general expert provision rather than as a separate section, and that placement has produced a question of construction the Supreme Court has now answered.

2. Who May Give the Opinion

Read in isolation, Section 39(2) appears to confine expert opinion on electronic evidence to a notified Examiner. That reading raised a serious practical problem, because the number of notified Examiners is small relative to the volume of electronic evidence now tendered, and it raised a question of principle as well, because it would have meant that a person of undoubted skill in cyber forensics could not give an opinion merely because his employer had not been notified.

📖 Pune Bar Assn. v. Union of India, 2026 SCC OnLine SC 1297 (decided 22 May 2026)

Facts: A writ petition challenged the constitutional validity of Section 63(4) of the Adhiniyam read with the Schedule, contending that the requirement of a hash value in Part A and a signed expert declaration in Part B made electronic evidence practically unavailable to ordinary litigants, particularly if Part B could be signed only by an Examiner of Electronic Evidence notified under Section 79A, of whom very few exist.

Held: A three-Judge Bench (Surya Kant, CJI, Joymalya Bagchi and Vipul M. Pancholi, JJ.) upheld Section 63(4). Electronic records are a species of evidence liable to continuous mutation, and the requirements of hash-value disclosure and expert certification bear a rational nexus with the object of securing authenticity and integrity. Reading Sections 39(1) and 39(2) harmoniously, the Court held that the expert who signs Part B is not confined to an Examiner of Electronic Evidence notified under Section 79A. Any person possessing special skill and expertise in computer science or cyber forensics may sign, provided the court is satisfied of the credentials on unimpeachable material. The contrary view of the Madras High Court in R. v. B. was held not to operate as binding precedent, and the question of the scope of Part B certification was expressly left open.

Ratio: Section 39(2) does not create a monopoly. The residuary words 'or in any other field' in Section 39(1) keep the general category of expert open, and a person skilled in cyber forensics is an expert whether or not he holds a notification.

The reasoning is straightforward once stated. Section 39(1) makes relevant the opinion of persons specially skilled in any field, and cyber forensics is plainly such a field. Section 39(2) does not say that only a notified Examiner may give an opinion; it says that the opinion of a notified Examiner is relevant. It confers a status, not an exclusive licence, and to read it otherwise would be to construe a facilitating provision as a disabling one.

⚠ Two consequences of the decision

The first is practical: a party may retain a competent cyber forensic examiner and rely on his opinion, and the absence of a notification is not an answer to it. The second is that the court must still be satisfied of the credentials, and the material establishing them must be unimpeachable. A witness described as a cyber expert, with no demonstrated training, no relevant experience and no explanation of method, is not an expert under either sub-section.

3. What the Examiner Does

The work covered by Section 39(2) is wider than the phrase 'expert opinion on electronic evidence' suggests, and it is useful to see the range.

Forensic imaging and preservation. Making a bit-for-bit copy of a storage device using a write blocker, so that the original is not altered by the examination, and generating a hash value for the image so that any subsequent change can be detected. This is the foundation of everything else.

Hash verification. Computing and comparing cryptographic digests to establish that a record produced is identical to the record seized. This is the technical operation the Schedule to Section 63(4) requires to be disclosed in Part A.

Recovery of deleted data. Retrieving files, messages and fragments that remain on a device after deletion, and reporting what was recovered and from where — allocated space, unallocated space or slack space, which bears on whether the data was deliberately deleted.

Metadata analysis. Examining creation, modification and access times, authorship fields, device identifiers, and the internal structure of a file, which is how alteration and back-dating are ordinarily detected.

Authentication and tamper detection. Establishing whether a document, image, audio or video file bears signs of editing, and whether an image or recording is internally consistent.

Source and attribution analysis. Examining logs, headers, device identifiers and network records to establish which device or account generated or transmitted a record.

Mobile device examination. Extraction of call records, messages, application data, location history and deleted content from phones, which now accounts for a very large share of the work.

4. The Certificate and the Opinion Are Different Things

This is the distinction the whole topic turns on, and it is worth setting out with care because the two requirements are constantly run together.

The certificate under Section 63(4) and the Schedule is a condition of admissibility. It is required where an electronic record is tendered as secondary evidence, and its function is to establish that the record produced corresponds to the record in the device. Part A is completed by the person in charge of the device and discloses the hash value; Part B carries the declaration of an expert.

The opinion under Section 39(2) is evidence about content and interpretation. It tells the court what the record shows, whether it has been altered, what a deleted fragment contained, or which device produced it. It is not a condition of admissibility of anything.

	Certificate under Section 63(4)	Opinion under Section 39(2)
Function	A condition of admissibility of the record	Evidence about what the record means
When required	Where an electronic record is tendered otherwise than as primary evidence under the Explanations to Section 57	Whenever the court has to form an opinion on a matter relating to information in electronic form
What it establishes	That the output corresponds to the record in the device	Authenticity, alteration, recovery, attribution, interpretation
Who signs or gives it	Part A — the person in charge of the device; Part B — an expert	An Examiner of Electronic Evidence, or any person skilled in the field
Effect of absence	The record is inadmissible as secondary evidence	The record may be admissible but stands unexplained

The practical consequence is that a party may need both, one, or neither. A record produced from the original device by its owner is primary evidence under the Explanations to Section 57 and needs no certificate; if its meaning is contested, an expert opinion is still required. A printout of a message tendered by a third party needs the certificate; if its meaning is obvious, no expert is required. A recovered deleted file needs both, because the recovery itself is expert work and the output is not primary evidence.

5. The Line of Authority on Electronic Evidence

Section 39(2) operates within a framework built by a well-known sequence of decisions, and the sequence is worth having in mind because it explains why the certificate requirement is as strict as it is.

📖 Anvar P.V. v. P.K. Basheer, (2014) 10 SCC 473

Held: Electronic records constitute a special class of evidence. Sections 65A and 65B of the Indian Evidence Act together formed a complete code, and compliance with Section 65B(4) was mandatory for the admission of secondary electronic evidence. The maxim generalia specialibus non derogant was applied. State (NCT of Delhi) v. Navjot Sandhu, (2005) 11 SCC 600, which had permitted proof under the general provisions without a certificate, was overruled to that extent.

Ratio: The certificate is a condition precedent to admissibility of secondary electronic evidence, and the corresponding provision in the Adhiniyam is Section 63.

📖 Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1

Held: A three-Judge Bench restored and clarified Anvar P.V. The certificate is mandatory where secondary electronic evidence is relied upon, but is not required where the original device is itself produced by its owner. Where a party is unable to obtain the certificate because the device is in the control of another, the court may compel its production. Shafhi Mohammad v. State of H.P., (2018) 2 SCC 801 was held not to be good law, and Tomaso Bruno v. State of U.P., (2015) 7 SCC 178 was declared per incuriam.

Ratio: The distinction between a record produced from the device and a copy tendered as secondary evidence, now reflected in Sections 57 and 63 of the Adhiniyam.

The Adhiniyam absorbed these holdings. The Explanations to Section 57 deem specified electronic outputs to be primary evidence, which is the statutory form of the Arjun Panditrao exception. Section 61 provides that admissibility shall not be denied merely because a record is electronic. Section 63 and the Schedule prescribe the certificate. And Pune Bar Assn. has now settled who may sign it.

6. Chain of Custody for Digital Material

Digital evidence presents a custody problem of a particular kind. Physical evidence can be sealed and its condition observed; electronic data can be altered without any visible trace, and merely switching a device on changes it. The discipline has developed its own answers, and a party relying on such evidence should be able to demonstrate each.

Seizure and isolation. When and where the device was seized, and what was done to prevent it from receiving or transmitting data thereafter.
Imaging with a write blocker. That a forensic image was taken using a device or process that prevents any write operation to the original.
Hashing at the point of imaging. That a hash value was computed for the original and for the image, and that they matched.
Examination on the image, not the original. That the analysis was conducted on a working copy, leaving the original untouched.
Hash verification at each subsequent stage, so that the record produced in court can be shown to be identical to what was seized.
Storage of the original in secure custody, sealed and accounted for throughout.

⚠ The hash value is the whole answer to tampering

A cryptographic hash is a digest of a file such that any alteration, however small, produces an entirely different value. Where the hash computed at seizure is disclosed and the hash of the record produced in court matches it, the objection that the record has been altered is answered conclusively. This is why the Schedule to Section 63(4) requires the hash value in Part A, and why the requirement was upheld in Pune Bar Assn. as bearing a rational nexus with the object of securing integrity. Where no hash was taken at seizure, the objection cannot be answered at all, and the record is worth much less.

7. Limitations

Four limitations recur and should be put to any examiner in a contested case.

Attribution is to a device or account, not a person. An examiner can establish that a message was sent from a particular phone or account. He cannot establish who was holding the phone or who had the password, and that must come from other evidence entirely. This is the single largest gap in most electronic evidence cases.

Metadata can be manipulated. Creation and modification times can be altered by changing a system clock or by using readily available tools. An examiner who relies on metadata should be asked whether he verified it against independent sources such as server logs.

Recovered fragments may be incomplete or out of context. A deleted message recovered from unallocated space may be a fragment, may be undated, and may have been part of a longer exchange. Section 33 of the Adhiniyam applies here: enough of the record must be produced for its meaning to be understood.

Cloud and third-party data raises its own problems. Where the data resides on a server controlled by a service provider, questions arise about who is the person in charge of the device for the purposes of Part A of the certificate, about the location of the record, and about how the extraction was made. The absence of an express extent clause in Section 1 of the Adhiniyam is read by commentators as removing a textual obstacle to receiving evidence originating outside India, but the practical difficulties of obtaining and proving such records remain.

8. The Position Stated Shortly

Section 39(2) makes the opinion of a notified Examiner relevant, and Section 79A of the IT Act is the provision under which such Examiners are notified.
Section 39(2) does not create a monopoly. Read with the residuary words in Section 39(1), any person skilled in computer science or cyber forensics may give an opinion — Pune Bar Assn.
The same decision settles who may sign Part B of the certificate under Section 63(4), and it is not confined to notified Examiners.
The certificate and the opinion are different things. One is a condition of admissibility; the other is evidence about meaning.
A record produced from the original device by its owner is primary evidence under the Explanations to Section 57 and needs no certificate.
The hash value is the answer to tampering, and its absence at the point of seizure cannot be cured afterwards.
Attribution is to a device or account, not to a person, and who was operating it must be established by other evidence.
The credentials of the expert must rest on unimpeachable material, and a witness described as an expert without demonstrated skill is not one.

9. Related Topics and Provisions

Topic or provision	Connection
Forensic Evidence	Chain of custody and the framework for collection
Nature and Evidentiary Value of Expert Evidence	The advisory character of the opinion and the requirement of reasons
Expert and Opinion Evidence — Sections 39 to 45	The statutory scheme in full
Kinds of Evidence	Electronic and digital evidence within the wider classification
Sections 57, 61 and 63 and the Schedule, BSA	Primary evidence of electronic records, non-discrimination, and the certificate
Section 33, BSA	How much of an electronic record must be produced for its meaning to be understood
Section 41(2), BSA	Opinion of the Certifying Authority as to an electronic signature
Sections 105 and 176(3), BNSS, 2023	Audio-video recording of search and seizure, and compulsory forensic investigation