Day 24 | Electronic Evidence: The Digital Clues That Can Make or Break a Case

Centre for Police Technology (CPT) presents a 31-Day Cybersecurity Knowledge Series for police personnel, law enforcement agencies (LEAs), corporate investigators, digital forensics professionals and cybersecurity practitioners.

A criminal investigation may begin with a phone call, a suspicious bank transaction, a threatening message or footage from a surveillance camera. Behind each of these events, electronic devices and digital systems may contain information that helps investigators reconstruct what happened.

In modern investigations, evidence is no longer limited to fingerprints, physical documents and eyewitness statements. Smartphones, computers, CCTV systems, cloud accounts, emails, messaging applications, GPS records and digital payment platforms can all contain valuable investigative clues.

But collecting digital information is only the beginning. Electronic evidence must be preserved, authenticated, examined and presented properly before it can reliably support a case.

What Is Electronic Evidence?

Electronic evidence is information or data stored, transmitted or generated through electronic devices and digital systems that may be relevant to an investigation or legal proceeding.

It can exist as text, images, audio, video, metadata, system logs, transaction records or other digital information.

Common examples include:

• Mobile phone evidence: Call logs, messages, photographs, videos, contacts and relevant application data.
• Computer evidence: Documents, browsing history, downloaded files, system logs and other artefacts.
• CCTV and surveillance footage: Recordings that may help establish movements, timelines or events.
• Communication evidence: Emails, messaging records, relevant account information and available communication metadata.
• Financial evidence: Bank statements, UPI transaction records, payment references and relevant digital receipts.
• Location evidence: GPS records and other location-related information, where available and lawfully obtained.
• Cloud evidence: Files, account activity and synchronised data stored on remote services.
• Network evidence: Relevant server logs, connection records and network traffic captures.

Electronic evidence may support investigations into cybercrime, financial fraud, stalking, harassment, organised crime, corruption and many other offences. Its relevance depends on the facts of the particular case.

FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders

Why Electronic Evidence Matters in Criminal Investigations

Digital evidence can help investigators answer fundamental questions: What happened? When did it happen? Which accounts or devices were involved? How did the events unfold? And what information supports or contradicts a suspect’s account?

For example, in an online payment fraud case, transaction records may establish when money was transferred, while messages may show how the victim was persuaded to make the payment. CCTV footage or other records may provide additional context about a relevant event.

In a cyberstalking investigation, preserved messages, account records and relevant timestamps may help establish a pattern of contact. In a corporate data-theft investigation, access logs and file activity may help identify how information was accessed or transferred.

However, a digital record does not automatically prove who performed an action or why it occurred. A device may be shared, an account may be compromised, a timestamp may reflect a different time zone, or a record may be incomplete. Investigators must interpret evidence in context and corroborate it with other reliable information.

How Electronic Evidence Can Be Altered or Lost

Unlike many physical objects, electronic evidence can be changed, overwritten, deleted or rendered inaccessible without obvious physical signs.

Several risks can affect its reliability:

• Accidental modification: Opening, editing or resaving a file may alter relevant information.
• Data deletion: Messages, files or logs may be removed, while some records may be recoverable depending on the device and circumstances.
• Automatic overwriting: CCTV systems and other devices may overwrite older recordings when storage fills up.
• Remote changes: Data stored in cloud accounts or connected systems may change after the incident.
• Metadata loss: Copying, converting or sharing a file can remove or alter information about its origin or history.
• Clock discrepancies: Devices and systems may have incorrect times or use different time zones, complicating timeline reconstruction.
• Encryption and access restrictions: Investigators may be unable to examine certain data without appropriate access, credentials or lawful authority.

These risks make early identification and appropriate preservation essential.

The Electronic Evidence Investigation Process

1. Identify and secure potential evidence

Investigators identify relevant devices, accounts, storage media, surveillance systems and service providers. They must consider the possibility of remote access, automatic deletion or overwriting while following applicable legal procedures.

2. Document the original condition

The device, its location, connections and visible condition should be documented where relevant. Investigators should record who collected it, when it was collected and how it was handled.

3. Acquire data appropriately

Where feasible and appropriate, forensic examiners create a forensic image or other verified acquisition of the relevant data. The method depends on the device, operating system, encryption, available tools and circumstances of the case.

Live systems, cloud accounts and mobile devices may require different acquisition methods. Investigators should avoid unnecessary actions that could alter or destroy evidence.

4. Verify integrity

Cryptographic hash values, such as SHA-256, can be calculated for acquired files or forensic images to help verify that the data has not changed between comparison points.

A matching hash supports the integrity of the compared data, but it does not by itself prove that the original information was authentic, accurate or lawfully obtained.

5. Examine and reconstruct events

Examiners analyse relevant files, logs, metadata, communications and other artefacts. They may reconstruct timelines, identify relationships between events and test competing explanations.

6. Corroborate findings

Investigators compare digital records with witness statements, financial transactions, CCTV footage, service-provider records and other available evidence. Conflicts and limitations should be documented rather than ignored.

7. Prepare findings for legal proceedings

A forensic report should clearly explain the methods used, the material examined, the findings, limitations and relevant technical details. The evidence and associated records must be handled in accordance with applicable law and procedural requirements.

Chain of Custody: Protecting Evidence from Collection to Court

The chain of custody is the documented history of evidence from its collection through handling, transfer, examination, storage and production in legal proceedings.

It helps establish what was collected, who had access to it, where it was stored and whether its integrity was maintained.

A reliable chain of custody generally requires:

• Unique identification and clear labelling of evidence.
• Records of collection, date, time and location.
• Documentation of every transfer between authorised personnel.
• Secure storage with appropriate access controls.
• Records of forensic acquisition, examination and verification.
• Preservation of original evidence and documentation of any necessary changes.

A gap in documentation does not automatically determine the outcome of a case, but unexplained gaps can raise questions about the integrity, reliability or handling of the evidence.

Electronic Evidence Under Indian Law

In India, the Bharatiya Sakshya Adhiniyam, 2023 (BSA) governs the admissibility and proof of evidence in judicial proceedings to which it applies. It came into force on 1 July 2024 and includes provisions addressing electronic and digital records.

Sections 61 to 63 address electronic or digital records and their evidentiary treatment, including conditions relevant to their admissibility. The requirements applicable to a particular record depend on the circumstances and the relevant legal provisions.

Investigators and legal practitioners must identify the applicable requirements for the specific proceeding, including any certificate or other documentation required under the law. They should not assume that a screenshot, recording or exported file will automatically satisfy every evidentiary requirement.

Proper collection, documentation, preservation and authentication remain essential to presenting electronic evidence reliably.

What Ordinary People Should Do to Preserve Digital Evidence

Individuals may possess important evidence before a formal investigation begins. Their actions can help preserve it.

• Keep original messages and files: Avoid editing, cropping or altering potentially relevant material.
• Preserve context: Record relevant dates, times, account details and the circumstances in which the material was received.
• Retain transaction records: Save payment references, bank notifications and complaint acknowledgements.
• Avoid deleting or resetting devices: Factory resets, app removal and unnecessary cleanup can destroy useful information.
• Preserve CCTV footage quickly: If a recording may be relevant, contact the owner or operator promptly because systems may overwrite older footage.
• Do not circulate sensitive material unnecessarily: Share evidence with authorised investigators or legal advisers through appropriate channels.
• Report incidents promptly: For cybercrime or online financial fraud, use the appropriate official reporting channels. In India, suspected financial cyber fraud can be reported through helpline 1930 and the National Cyber Crime Reporting Portal.

Individuals should not attempt to access another person’s accounts or devices without authorisation. When a device may contain important evidence, seek appropriate professional or investigative guidance before taking actions that could alter it.

The Future of Electronic Evidence

Investigations increasingly involve data spread across smartphones, cloud services, connected devices, digital payment systems and international platforms. Artificial intelligence can assist with tasks such as sorting large datasets, transcribing audio and identifying patterns, but its outputs require verification.

Investigators must also address encryption, privacy, cross-border data access, deepfakes and manipulated media. Establishing whether a recording is authentic may require examining its provenance, metadata, technical characteristics and consistency with independent evidence.

As digital investigations become more complex, forensic competence, lawful access, transparent methods and careful interpretation will remain as important as the tools themselves.

Conclusion: Digital Evidence Is Only as Strong as Its Integrity

Electronic evidence can help investigators reconstruct events, expose fraud, connect related incidents and test claims. But its value depends on more than the discovery of a message, file or transaction record.

Proper preservation, documented handling, reliable examination and independent corroboration turn digital information into evidence that can be meaningfully assessed.

In digital investigations, finding the evidence is the first step. Preserving its integrity is what gives it value.

Day 24 — Electronic Evidence

31 Days | 31 Key Topics | October 2026

Follow Centre for Police Technology (CPT) for the complete 31-Day Cybersecurity Knowledge Series.