Centre for Police Technology (CPT) presents a 31-Day Cybersecurity Knowledge Series for police personnel, law enforcement agencies (LEAs), corporate investigators, digital forensics professionals and cybersecurity practitioners.
A WhatsApp conversation, CCTV recording, email, UPI transaction or photograph recovered from a mobile phone can become a crucial part of a criminal investigation. But how does such digital information become evidence that a court can legally consider?
In India, the Bharatiya Sakshya Adhiniyam, 2023 (BSA) provides the legal framework governing evidence in judicial proceedings to which it applies. It replaced the Indian Evidence Act, 1872, and came into force on 1 July 2024.
For police officers, forensic examiners, prosecutors and investigators, understanding the BSA is essential. Discovering digital evidence is only one part of the process. Establishing its relevance, authenticity, integrity and admissibility is equally important.
What Is the Bharatiya Sakshya Adhiniyam, 2023?
The Bharatiya Sakshya Adhiniyam is India’s evidence law, setting out rules and principles governing the proof and relevance of facts in judicial proceedings.
Its provisions address documentary evidence, electronic and digital records, expert opinions, witness testimony and other matters relevant to establishing facts before a court.
The law is particularly significant in an era when criminal activity increasingly involves smartphones, online platforms, digital payments, cloud services and electronic communications.
Electronic evidence is not treated as legally irrelevant simply because it exists in digital form. However, its admissibility and evidentiary value depend on the applicable legal requirements and the circumstances of the case.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Sections 61, 62 and 63: The Digital Evidence Framework
Three provisions are especially important when examining electronic and digital records.
Section 61 — Electronic or digital records
Section 61 establishes that an electronic or digital record cannot be denied admissibility merely because it is electronic or digital. Its legal effect, validity and enforceability are subject to the provisions of the Act, including Section 63.
Section 62 — Special provisions relating to electronic records
Section 62 provides that the contents of electronic records may be proved in accordance with Section 63.
Section 63 — Admissibility of electronic records
Section 63 sets out conditions governing the admissibility of specified electronic records produced as computer output. It addresses matters such as the regular use of the relevant computer or communication device, the supply of information to the system, its proper operation and the relationship between the information produced and the information supplied.
The section also contains requirements concerning certificates for the relevant electronic records. The applicable requirements must be examined in the context of the particular record and proceeding.
The practical lesson: A screenshot or digital file may be relevant to an investigation, but investigators must still address the applicable requirements for proving its contents and establishing its reliability.
What Counts as Electronic or Digital Evidence?
Digital evidence can originate from a wide range of devices, platforms and systems.
Common examples include:
- Mobile phones: Messages, call logs, photographs, videos and relevant application data.
- Computers and laptops: Documents, files, browsing artefacts and system records.
- CCTV systems: Video recordings that may establish movements, timelines or events.
- Email and messaging platforms: Communications, attachments and available account-related records.
- Digital payments: Bank records, UPI transaction references, payment confirmations and related financial data.
- Cloud services: Stored files, account activity and synchronised information.
- Network infrastructure: Server logs, connection records and relevant network traffic.
- Connected devices: GPS information, smart-device logs and other relevant sensor data.
The importance of any particular record depends on the allegation being investigated. Investigators must also consider whether the record is complete, authentic, relevant and capable of being reliably connected to the facts in question.
How the BSA Applies to a Real Investigation
Consider a case in which a victim reports losing money through an online investment scam.
The victim provides WhatsApp conversations with the suspected fraudster, screenshots of an investment dashboard and bank transaction details.
Each item may provide a different investigative lead. The conversations may show how the victim was approached, the dashboard may illustrate the representations made by the suspect, and the bank records may establish the movement of funds.
Investigators must then establish what each record actually proves.
They may need to preserve the original communications where available, obtain relevant records from financial institutions or service providers through lawful procedures, document how copies were produced, and examine the material for signs of alteration or inconsistency.
Where Section 63 applies to the electronic record being tendered, its applicable conditions and certificate requirements must also be addressed.
Even when the records are properly produced, they do not necessarily establish the identity of the person who controlled an account or sent a message. That conclusion may require corroborating evidence.
The BSA provides the evidentiary framework; the investigation must establish the facts.
Electronic Evidence Certificates: Why Documentation Matters
One of the most important practical considerations for investigators is the documentation required when electronic records are produced as computer output.
Section 63 sets out certificate requirements for the relevant category of electronic evidence. Its framework includes identifying the electronic record, describing how it was produced, providing appropriate details of the devices involved and addressing the statutory conditions.
The certificate provisions also refer to signatures by the person in charge of the relevant computer or communication device, or the management of the relevant activities, as appropriate, and by an expert.
The Act’s Schedule provides a prescribed certificate format.
Investigators and legal teams should therefore identify the source of the record early and determine who can provide the information and certification required by law. Requirements should not be treated as a last-minute formality before a hearing.
The exact procedure depends on the record, how it was obtained and the applicable law. Legal practitioners should assess the requirements for the particular proceeding rather than assume that one documentation approach fits every situation.
Electronic Evidence Must Be Authentic and Reliable
Legal compliance is only one part of sound digital evidence handling. Investigators must also consider whether the material is authentic and whether it accurately represents the information it claims to contain.
Several risks can undermine reliability:
- Manipulated screenshots: Images can be edited to change names, amounts, messages or timestamps.
- Incomplete conversations: Selected messages may omit context that changes their interpretation.
- Altered recordings: Audio and video files can be edited or manipulated.
- Account impersonation: A message sent from an account does not automatically establish who operated it.
- Incorrect timestamps: Device settings, clock differences and time zones can complicate timelines.
- Data modification: Files may change during handling, transfer or conversion.
- AI-generated content: Synthetic images, audio and video can imitate real people or events.
Investigators should preserve original files where possible, document the source and method of acquisition, record relevant metadata, and use appropriate forensic techniques to assess integrity.
Cryptographic hashes, such as SHA-256, can help establish whether a file or forensic image has changed between comparison points. However, a matching hash alone does not prove that the original material was genuine or that its contents are true.
The Role of Police, Forensic Examiners and Prosecutors
Effective electronic evidence handling requires coordination between several roles.
Police investigators identify relevant evidence, document its collection, maintain records of handling and pursue appropriate legal requests for information.
Digital forensic examiners acquire and analyse data using suitable methods, document technical findings, assess potential alteration and explain the limitations of their examination.
Prosecutors and legal practitioners assess relevance, admissibility, statutory compliance and the manner in which evidence should be presented in court.
Financial institutions and service providers may hold records relevant to transactions, communications or account activity and respond to lawful requests under applicable procedures.
Clear communication between these stakeholders can reduce delays and help ensure that important evidence is not lost or inadequately documented.
Chain of Custody and the Integrity of Evidence
The chain of custody records the history of evidence from collection through handling, transfer, storage and examination.
Although the concept is central to good forensic practice, investigators should distinguish between maintaining evidence integrity and satisfying the specific legal rules governing admissibility.
Good practice includes:
- Recording when, where and by whom evidence was collected.
- Assigning unique identifiers to devices, files or evidence items.
- Documenting transfers between authorised personnel.
- Restricting access and using secure storage.
- Recording forensic acquisition and examination methods.
- Preserving original material where possible.
- Documenting any necessary changes, conversions or processing.
These records help investigators explain how the evidence was handled and enable others to assess its reliability.
What Ordinary People Should Know
Digital evidence is not limited to police laboratories. Individuals may possess important records immediately after a cybercrime, financial fraud or online threat.
If an incident occurs:
- Preserve relevant messages, emails, transaction details and original files.
- Avoid editing screenshots or altering recordings that may be relevant.
- Keep transaction IDs, dates, times and complaint acknowledgements.
- Report incidents promptly and follow instructions from authorised investigators.
- Avoid accessing another person’s device or account without permission.
- Do not assume that a screenshot alone will meet every legal requirement for proving an electronic record.
For suspected financial cyber fraud in India, victims should contact their bank or payment provider promptly and call 1930. Complaints can also be submitted through the official National Cyber Crime Reporting Portal.
The BSA in the Age of AI and Digital Manipulation
Artificial intelligence is making it easier to generate realistic images, clone voices and produce synthetic videos. These developments create new challenges for investigators who must distinguish genuine records from fabricated or manipulated material.
A convincing video is not necessarily authentic evidence, just as an unusual-looking recording is not automatically fake.
Investigators may need to examine the source of a file, available metadata, encoding characteristics, signs of manipulation and consistency with independent evidence. Expert analysis may be necessary, depending on the case.
The legal framework and technical examination serve complementary purposes: forensic analysis helps assess what a record is and how it may have been created or altered, while the court determines its admissibility and evidentiary significance under the applicable law.
As digital evidence becomes more complex, investigators will need both legal awareness and technical competence.
Conclusion: Digital Evidence Must Stand Up to Legal Scrutiny
The Bharatiya Sakshya Adhiniyam, 2023, is an important part of India’s evolving criminal justice framework. Its provisions concerning electronic and digital records are especially relevant as investigations increasingly depend on data from phones, computers, financial platforms and online services.
For investigators, the responsibility extends beyond finding a digital clue. They must preserve the material, document its handling, address the applicable statutory requirements and establish its reliability through appropriate examination and corroboration.
Digital evidence can reveal what happened, but sound investigation and legal compliance determine how reliably those findings can be presented in court.
Day 25 — Bharatiya Sakshya Adhiniyam, 2023
31 Days | 31 Key Topics | October 2026
Follow Centre for Police Technology (CPT) for the complete 31-Day Cybersecurity Knowledge Series.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
