Section 79A IT Act: Examiner of Electronic Evidence

Electronic evidence reaches court through two gates: the admissibility gate of the s.63 BSA certificate, and the credibility gate of expert examination, and Section 79A builds the institution for the second. Inserted in 2008, it lets the Central Government notify forensic laboratories as Examiners of Electronic Evidence, whose opinions the evidence law then receives through a provision of their own. Topics 9 and 24 used the Examiner in the law of proof and investigation; this note, as asked, is the dedicated study: the provision, the notified agencies, the forensic disciplines behind an opinion, the BSA interface, and the Examiner against the ordinary expert.

1. The Provision

Figure 1: Power, function and subject matter

• Central Government notification. Only the Central Government notifies, but what it notifies may be a department, body or agency of the Centre or a State, so State forensic science laboratories enter the scheme through central notification.
• The notified agencies. MeitY runs a scheme of examination and quality assessment of laboratories, covering competence, tools, standard operating procedures and personnel, and has notified a growing list of central and State forensic science laboratories and specialist bodies as Examiners for stated disciplines, computer forensics, mobile forensics, and storage media among them; a laboratory is an Examiner only for the disciplines its notification covers.
• Electronic form evidence. The Explanation is deliberately wide: any information of probative value stored or transmitted electronically, with an inclusive list running from computer evidence to cell phones. Every artefact of the digital case, disks, phones, servers, recordings, falls within an Examiner's remit.
• Before any court or other authority. The opinion serves criminal and civil courts alike, and equally tribunals, adjudicating officers under s.46 and commissions, wherever electronic evidence is contested.

2. What an Examination Involves

Figure 2: The forensic lifecycle behind an opinion

• Forensic images and hard disk examination. The examiner works on a forensic image, a verified bit-for-bit copy taken through a write blocker so the original is never altered; the sealed original remains available for re-examination. Hard disk examination then recovers live and deleted files, artefacts of use, and the traces of wiping or tampering.
• Mobile forensics. Phones add their own disciplines: isolation from networks so remote wiping cannot reach the device, extraction at logical or deeper levels as the notification and tools permit, and recovery of messages, call records, application data and location artefacts.
• Hash values and integrity. A cryptographic hash value computed at seizure and re-computed at examination and production demonstrates the evidence unchanged: matching hashes are the integrity proof the BSA's certificate schedule itself demands, and a mismatch is the cross-examiner's opening.
• Metadata examination. File system and document metadata, creation, modification and access details, authorship fields, transmission headers, dates the record, links it to devices and users, and exposes backdating and manipulation.
• Chain of custody. Every movement of the exhibit, from the seizure memo through the malkhana to the laboratory and back, is documented and deposed to; the finest analysis fails if the chain leaves a gap through which substitution could have entered (Topic 24)
• Report and testimony. The examination ends in a reasoned report identifying the exhibits by hash, the tools and procedures used, and the findings; the examiner proves it in court and stands cross-examination like any expert.

3. Section 79A and the BSA

• The dedicated relevance provision. The IT Act inserted s.45A into the Evidence Act: when the court has to form an opinion on any matter relating to information transmitted or stored in any computer resource or other electronic or digital form, the opinion of the Examiner of Electronic Evidence referred to in s.79A is a relevant fact, and the Examiner is an expert. The BSA carries this forward as s.39(2), immediately after the general expert provision.
• Alongside the certificate. The s.63 BSA certificate admits the electronic record; the Examiner's opinion speaks to its genuineness, integrity and interpretation once admitted. Arjun Panditrao's discussion of proving electronic records assumes exactly this division of labour (Topic 9)
• In the trial. Prosecution exhibits routinely travel through a notified laboratory; the defence tests the opinion through cross-examination on tools, procedure, hash continuity and custody, and may summon its own expert, whose opinion enters through the general provision.

4. The Examiner Against the Ordinary Expert

Figure 3: The notified channel and the general one

• Electronic evidence expert vs ordinary expert. The Examiner is an institution: notified after capability assessment, working to standard procedures, its opinion received under the provision that names it. The ordinary expert is an individual whose skill must be established witness by witness, received under the general expert clause. Both are experts, both are cross-examinable, and neither binds the court, which weighs the opinion as it does all expert testimony.
• Why the distinction matters. For investigators, routing exhibits through a notified Examiner forecloses the competence objection; for the defence, the absence of notification for the particular discipline, or examination by an un-notified unit, is a weight argument; for examiners themselves, the notification defines the disciplines they may speak to.

5. Frequently Asked Questions

What is an Examiner of Electronic Evidence?

A department, body or agency of the Central or a State Government, notified by the Central Government under Section 79A after assessment of its competence, to provide expert opinion on electronic form evidence before any court or authority. Electronic form evidence means any information of probative value stored or transmitted in electronic form, including computer evidence, digital audio and video, cell phones and digital fax machines. The Examiner's opinion is a relevant fact under Section 39(2) of the BSA, which declares the Examiner an expert.

How does the Examiner's opinion relate to the Section 63 BSA certificate?

They guard different gates. The certificate under Section 63 BSA is the condition of admissibility for an electronic record produced as a copy, given by the person in charge and an expert with hash values. The Examiner's opinion under Section 79A read with Section 39(2) BSA goes to the weight and interpretation of the evidence once admitted: its integrity, recovery, authorship and the meaning of its artefacts, established through forensic imaging, hashing, metadata analysis and a documented chain of custody.

6. Related Topics

• Topic 9: Electronic Evidence. Admissibility and the certificate cases.
• Topic 24: Digital Evidence in Investigation. Collection, custody and proof in practice.