Answer By law4u team
In cyber crime cases under Indian law, particularly under the Information Technology Act, 2000 (IT Act) and the Bharatiya Nyaya Sanhita (BNS), collecting and preserving digital evidence is of paramount importance to establish guilt or liability beyond a reasonable doubt. Because digital data is inherently volatile, easily altered, and susceptible to fabrication, the Indian Evidence Act, 1872, and the Bharatiya Sakshya Adhiniyam (BSA) lay down strict protocols and requirements for admitting electronic records in a court of law. 1. Electronic records and digital footprints form the bedrock of any cyber crime investigation. This includes server logs, router logs, internet protocol (IP) logs, firewall logs, and proxy server details. These records help cyber cell investigators and forensic experts trace the origin of a cyber attack, unauthorized access, data breach, or distributed denial of service attack. When an offense involves hacking under Section 66 of the IT Act or identity theft under Section 66C of the IT Act, system generated logs showing timestamps, source IP addresses, and destination ports are critical to link a specific device or network to the illegal activity. 2. Devices such as smartphones, laptops, hard drives, flash drives, servers, and routers seized from the scene or from the suspect are primary sources of physical and digital evidence. Under Section 65B of the Indian Evidence Act read with corresponding provisions of the BSA, any electronic record printed on paper, stored, recorded, or copied in optical or magnetic media is deemed to be a document and is admissible in proceedings without further proof, provided certain conditions are met. Crucially, a certificate under Section 65B must accompany the electronic evidence. This certificate must be signed by a person in charge of the computer or device, certifying the authenticity of the digital record, describing the manner in which it was produced, and verifying the proper functioning of the computer system at the material time. Without this certificate, primary electronic records such as emails, hard disk data, and mobile chat exports face severe admissibility hurdles in Indian courts. 3. Financial and transactional evidence is indispensable in cyber financial frauds, phishing, online banking scams, and ransomware attacks prosecuted under Section 420 or related fraud provisions of the BNS. This evidence includes bank statements, transaction reference numbers, Unified Payments Interface (UPI) logs, electronic wallet statements, merchant gateway logs, and Know Your Customer (KYC) details obtained from banks and digital payment intermediaries. Rapid preservation requests and Section 91 of the Code of Criminal Procedure, 1973 (CrPC) or corresponding Bharatiya Nagarik Suraksha Sanhita (BNSS) notices sent to financial institutions help freeze fraudulent accounts and secure transaction trails that lead directly to the beneficiaries or money mules. 4. Communication records play a pivotal role in establishing intent, conspiracy, and execution of cyber crimes such as cyberstalking, online harassment, extortion, and dissemination of obscene material under Section 67 of the IT Act. These records include emails complete with full internet headers, Short Message Service (SMS) logs, call detail records (CDRs), tower location data, and chat histories from platforms like WhatsApp, Telegram, or social media applications. Full internet headers are particularly vital for emails because they reveal the exact routing path, original sender IP, and timestamps, bypassing superficial sender spoofing. 5. Malware analysis reports and forensic disk images are essential when dealing with sophisticated cyber attacks, ransomware, or intellectual property theft. Forensic experts create bit-by-bit forensic clones or images of compromised storage media to preserve the original evidence integrity. They then analyze the image for malicious executables, trojans, spyware, registry modifications, deleted files recovered through data carving, and hidden partitions. The expert opinion of a certified cyber forensic examiner, along with reports from authorized forensic laboratories like the Central Forensic Science Laboratory, carries significant evidentiary weight under Section 45 of the Indian Evidence Act or its BSA equivalent regarding scientific evidence. 6. Audio, video, and image files often serve as direct evidence in cases involving deepfakes, morphing, cyberbullying, or copyright infringement. To be legally effective, these multimedia files must be accompanied by metadata analysis showing creation dates, device camera signatures, and GPS coordinates if applicable. Furthermore, forensic verification must rule out digital tampering or manipulation, ensuring that the digital media presented before the magistrate or judge reflects the unadulterated reality of the occurrence. 7. Witness testimony and documentary proof of reporting are equally critical procedural elements. This includes the initial cyber crime complaint filed on the national cyber crime reporting portal or at the local cyber cell, acknowledgment receipts, non-encumbrance certificates, and statements of victims, system administrators, and network engineers. Investigators must strictly maintain a documented chain of custody form detailing every person who handled the physical electronic device or digital storage media, recording dates, times, and the purpose of transfer. A broken chain of custody can give defense counsel grounds to argue that the electronic evidence was tampered with or contaminated after seizure. In summary, successful prosecution of cyber crimes depends on a seamless combination of technical digital extractions, rigorous adherence to procedural certification requirements under the law, and an unbroken chain of custody.
