Digital Evidence Collection and Chain of Custody
Evidence that cannot be shown unchanged is evidence a court may reject. Here is how it is kept clean.
Digital evidence is easy to change and hard to prove unchanged. A CCTV clip copied to a pen drive, a log file opened and saved, a phone switched on and off: each can alter the record or give the defence a reason to doubt it. Chain of custody is the written trail that shows who collected each item, when, how it was stored and who handled it at every step until it reached court.
Courts accept electronic records, but only on conditions. Since 1 July 2024 those conditions are in section 63 of the Bharatiya Sakshya Adhiniyam (BSA), which replaced the Indian Evidence Act. A bank that hands over logs or footage without following them can weaken its own case.
You save ₹300
- Full 120-question mocks
- Cyber law coverage
- Module-wise practice
One payment, no subscription · Valid for 2 months
Collecting Digital Evidence Correctly
The principle at each step: preserve the original, work on a verified copy, and record everything.
- 1
Secure and preserve
Stop routine deletion: CCTV overwrite cycles, log rotation, mailbox purges. Do not browse the affected device or run tools on it out of curiosity.
- 2
Document the scene
Note the date, time, location, device make, model and serial number, and who was present. Under the BNSS, police searches and seizures are recorded on video.
- 3
Make a forensic copy
Trained staff or examiners take a bit-for-bit image of the storage. Analysis is done on the copy; the original is sealed.
- 4
Compute and record the hash value
A hash is a fixed-length code calculated from the data, like a fingerprint. If even one bit changes, the hash changes. Recording it at collection proves later that the copy is unaltered.
- 5
Seal, label and log every handover
Each transfer is signed with date, time, reason and the receiver's name. A gap in this log is what defence lawyers look for.
- 6
Produce it with the BSA certificate
The electronic record goes to court with the certificate in the BSA Schedule, including the hash value.
Old Law and New Law
The courseware and older questions use the left column. Cases started after 1 July 2024 use the right.
Admissibility of electronic records and the certificate
Indian Evidence Act, 1872
Section 65B
Bharatiya Sakshya Adhiniyam, 2023
Section 63, with a certificate in the Schedule
Opinion of the Examiner of Electronic Evidence
Indian Evidence Act, 1872
Section 45A
Bharatiya Sakshya Adhiniyam, 2023
Section 39(2)
Electronic records as primary evidence
Indian Evidence Act, 1872
Not expressly stated
Bharatiya Sakshya Adhiniyam, 2023
Section 57, Explanations 4 to 7
| Subject | Indian Evidence Act, 1872 | Bharatiya Sakshya Adhiniyam, 2023 |
|---|---|---|
| Admissibility of electronic records and the certificate | Section 65B | Section 63, with a certificate in the Schedule |
| Opinion of the Examiner of Electronic Evidence | Section 45A | Section 39(2) |
| Electronic records as primary evidence | Not expressly stated | Section 57, Explanations 4 to 7 |
The Section 63 Certificate
The BSA certificate has two parts, which is new compared with the old section 65B certificate.
- Part A (filled by the party)
- The person in charge of the device or record states the device details (make, model, serial number, IMEI or cloud ID), that it was in lawful control and working properly in the ordinary course of business, and the hash value with the algorithm used.
- Part B (filled by the expert)
- An expert separately confirms the source device and the hash value of the record produced.
- Hash algorithms named
- The Schedule lists SHA1, SHA256 and MD5, or another legally acceptable standard. A hash report is enclosed with the certificate.
- When it is needed
- At each instance the electronic record is submitted for admission, under section 63(4).
Quick practice on banking operations. No signup.
Proper Custody Now Makes a Record Primary Evidence
Under section 57 of the BSA, an electronic or digital record produced from proper custody is primary evidence unless it is disputed. Each file of a record stored in several places, including temporary files, is also primary evidence. Good custody records are what let a bank rely on this.
How the IIBF Exam Tests This
Questions ask what chain of custody proves (integrity and continuity of evidence, not the guilt of the accused), why a hash is computed, and which section governs admissibility. The common trap is the old section number: 65B is the answer only if the question is about the Indian Evidence Act. Another trap offers encryption as the way to prove evidence is unchanged; the answer is hashing.
FAQs
What is chain of custody in cyber crime?expand_more
The documented record of who collected, handled, transferred and stored each item of digital evidence, and when, from seizure to court. It shows the evidence was not altered or swapped.
Which section replaced Section 65B of the Evidence Act?expand_more
Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, in force from 1 July 2024. It keeps the certificate requirement and adds a Part B by an expert and a hash value.
What is a hash value in digital evidence?expand_more
A fixed-length code calculated from a file's contents. Any change to the file changes the hash, so matching hash values show the evidence is unchanged since collection.
Is a printout of an email admissible in court?expand_more
A computer output, including a printout, is treated as a document if the section 63 BSA conditions are met and the required certificate accompanies it.
Next steps
Take a full IIBF Cyber Crimes mock test120 questions, 2 hours, scored instantly.