Criminal investigations have traditionally relied on physical evidence, eyewitness testimony, documentary records and forensic material. With widespread use of smartphones, computers, cloud platforms, social media, digital payments and connected devices, an increasing part of the factual trail in criminal cases now exists electronically.
Conversations may take place through messaging applications, financial transactions can leave digital records, and CCTV, location data and call records can help establish a sequence of events. Digital evidence has therefore become an important part of modern criminal investigations. Properly collected electronic records can establish chronology, corroborate witness statements, trace transactions and reconstruct events. However, electronic records can also be copied, altered, deleted or manipulated, making authenticity and integrity essential considerations.
Digital evidence refers to information stored, transmitted or generated through electronic systems which may be relevant to an investigation or criminal proceeding. Sources include mobile phones, computers, CCTV systems, servers, cloud accounts, vehicle tracking systems and digital payment platforms.
Emails, text messages, WhatsApp conversations, photographs, videos, audio recordings, call detail records, IP records, browser history, GPS information, location data and financial transaction records may all become relevant. Metadata can provide information concerning the creation, modification, transmission or storage of a digital file.
The evidentiary value of such material depends on relevance, authenticity, integrity and lawful collection. A screenshot, for example, may raise questions concerning the identity of participants, original device, completeness, alteration and method of acquisition. Digital evidence must therefore be examined as forensic material rather than simply as information displayed on a screen.
India's evidentiary framework changed significantly when the Bharatiya Sakshya Adhiniyam, 2023 came into force on July 1, 2024 and repealed the Indian Evidence Act, 1872, subject to its savings provision for pending proceedings.
Section 61 of the Bharatiya Sakshya Adhiniyam recognises an electronic or digital record as having the same legal effect, validity and enforceability as other documents, subject to Section 63. Section 62 addresses proof of the contents of electronic records through Section 63.
Section 63 establishes the framework for electronic records and deals with conditions for admission, including certification in specified circumstances. The Schedule contains particulars concerning the source device, relevant identifiers and hash values, along with certification by appropriate persons.
Electronic evidence therefore requires careful handling from collection through presentation. Its creation, extraction, preservation and presentation can affect its evidentiary value.
Authenticity is a central concern because digital files can be duplicated without changing their visible appearance. Photographs can be edited, audio recordings manipulated and messages presented without surrounding conversations.
The Supreme Court addressed the special evidentiary treatment of electronic records in Anvar PV v. PK Basheer & Ors. The Court held electronic records relied upon as secondary evidence were governed by special statutory requirements under Sections 65A and 65B of the Indian Evidence Act. The judgment also overruled the earlier approach in State (NCT of Delhi) v. Navjot Sandhu, insofar as it permitted electronic records to be proved through general provisions governing secondary evidence.
The Supreme Court further clarified the position in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal & Ors. A three-judge Bench reaffirmed the principles in Anvar P.V. concerning certification requirements for secondary electronic evidence under Section 65B of the Indian Evidence Act.
Under the current framework, Section 63 of the Bharatiya Sakshya Adhiniyam provides for certification of electronic records in specified circumstances. The Schedule requires information concerning the device or source, relevant identifiers and the hash value of the electronic or digital record.
Digital devices may pass through several hands during an investigation. A mobile phone can be seized by an investigating officer, transferred to a forensic laboratory, examined by a technical expert and later produced before a court. Each stage can raise questions concerning access, alteration or contamination.
The Bharatiya Nagarik Suraksha Sanhita, 2023 recognises this concern. Section 193, dealing with the police report upon completion of investigation, requires the report to state the sequence of custody in cases involving an electronic device.
Proper documentation can help establish whether material produced during trial corresponds with material originally seized. Records concerning seizure, custody, forensic extraction, storage, transfer and production may become relevant when evidence integrity is challenged.
CCTV footage is increasingly relevant in criminal cases involving offices, commercial establishments, residential buildings, roads and public spaces. It can establish movements before, during and after an alleged offence.
The Supreme Court considered CCTV footage and other electronic evidence in Tomaso Bruno & Anr. v. State of Uttar Pradesh. The Court examined the failure to produce relevant CCTV footage and considered the implications of withholding potentially material evidence.
Digital evidence should therefore be identified and preserved promptly. CCTV systems may automatically overwrite earlier footage once storage capacity is reached, making delayed collection capable of causing permanent loss of relevant material.
Electronic evidence can provide useful chronological information. Call records may establish communication, location data can assist in reconstructing movement, and transaction records may demonstrate the timing of financial transfers.
Digital evidence does not automatically establish guilt. Its value must be assessed alongside the complete evidentiary record. It may corroborate testimony, reveal inconsistencies or provide investigative leads requiring further verification.
A message concerning a meeting may acquire greater significance when supported by CCTV footage, location information and independent witness testimony. Conversely, an isolated screenshot without reliable proof of origin may have limited evidentiary weight.
Modern smartphones can contain communications, photographs, videos, location information, application data and financial records. Investigators must distinguish relevant material from unrelated personal information while ensuring forensic acquisition does not compromise original data.
Privacy and constitutional considerations remain relevant where investigators seek information extending beyond the immediate subject matter of an offence. Financial investigations increasingly rely on online banking, UPI transactions, card payments, digital wallets, trading platforms and electronic accounting systems. Such records can assist in tracing funds and establishing relationships between accounts. They may be particularly relevant in fraud, cheating, corruption, money laundering and cybercrime investigations.
Digital evidence often requires technical interpretation. A forensic expert may examine a device, recover deleted material, analyse metadata, identify relevant files or explain the extraction methodology. Expert evidence assists the court in understanding technical matters beyond ordinary knowledge. Lawyers handling criminal proceedings may need to examine whether a device was properly seized, whether extraction preserved original data, whether certification requirements were fulfilled and whether evidence establishes a reliable connection with the accused. Legal teams working with digital evidence may require assistance from the criminal lawyer alongside appropriate forensic expertise.
In cybercrime matters, digital evidence may form the core of the allegation. Phishing emails, fraudulent websites, manipulated documents, access logs, IP records, social media accounts and digital payment trails can form part of the evidentiary chain. Attribution can be difficult. An IP address does not necessarily identify the person operating a device, while social media accounts and devices may be shared, compromised or remotely controlled.
Investigators should therefore avoid treating a single technical indicator as conclusive proof of identity. Stronger attribution may require correlation between device records, subscriber information, transaction data, communications, forensic findings and witness testimony. Legal professionals dealing with data breaches, cybercrime allegations and digital investigations may require support from cybersecurity lawyers who understand the legal and technical aspects of electronic evidence.
Digital evidence can disappear quickly. Cloud accounts may be deleted, CCTV systems may overwrite footage, mobile devices may be reset and online accounts may become inaccessible. Early preservation is therefore important. Investigators should identify relevant devices and accounts, preserve original material, document seizure circumstances and ensure forensic examination does not compromise evidentiary integrity. Investigators should be able to establish where material originated, how it was obtained, how it was preserved and whether material produced before the court corresponds with the original source.
Digital evidence has become critical in modern criminal investigations because criminal conduct increasingly leaves an electronic trail. Smartphones, CCTV systems, online communications, digital transactions, cloud platforms and connected devices can provide evidence concerning identity, chronology, communication, movement and financial activity.
The Bharatiya Sakshya Adhiniyam, 2023, provides a statutory framework for electronic evidence under Sections 61 to 63, while the Bharatiya Nagarik Suraksha Sanhita places emphasis on recording the sequence of custody of electronic devices. The central issue is not simply whether digital evidence exists, but whether its authenticity, integrity, provenance and legal admissibility can be established. Proper collection, preservation, forensic examination and presentation are therefore essential for electronic records to assist the court in determining the facts of a criminal case.
About the authors: Aditya Raj and Harsh Nath Tiwari is Clarvis Legal LLP.
Disclaimer: The opinions expressed in this article are those of the author(s). The opinions presented do not necessarily reflect the views of Bar & Bench.
If you would like your Deals, Columns, Press Releases to be published on Bar & Bench, please fill in the form available here.