Electronic Evidence: Admissibility, Certificates & Chain of Custody

The Bharatiya Sakshya Adhiniyam (BSA) refreshes the law of evidence for a digital world. Chats, emails, CCTV, server logs, and phone dumps routinely decide cases. Courts increasingly look for authenticity, integrity, and a clear chain of custody rather than mere printouts. This guide breaks down what that means in practice.

What counts as an “electronic record”?

Any data stored, recorded, or transmitted in digital/electronic form—documents, images, video, audio, logs, metadata, computer outputs. Think: WhatsApp exports, email headers, CCTV footage, GPS logs, cloud backups, and invoices from ERPs.

Admissibility vs. weight

• Admissibility asks: can the court receive this piece of evidence?
• Weight asks: how much value should the court give it?

BSA continues the approach that electronic records are admissible when authenticity and integrity are shown. The court then decides weight based on reliability: creation context, device control, alterations, and corroboration.

The role of certificates

Courts often require a certificate to establish that the electronic output was produced by a computer/device in the ordinary course of activity, and that the process reliably reproduced the data. Typically, the certificate states:

• details of the device/system (IDs, OS, storage),
• the manner/time of creation,
• that the output is a faithful reproduction, and
• identifying particulars of the person responsible.

Tip: Keep a concise template and fill it contemporaneously (near the time you extract the record). Late, back-filled certificates look suspect.

Chain of custody for digital evidence

A clean chain documents every handover—from seizure to analysis to production in court. It should include:

• Seizure memo with device details, hash values (e.g., SHA-256), and seal numbers.
• Imaging/forensics memo: who created the image, which tool/version, hash of image, and verification logs.
• Access logs: who examined the image and when.
• Output generation: how exports/screenshots were created, with hashes where feasible.
• Storage & transfer: how you secured the original and working copies.

Hash values are your best friend. If the hash of the seized device and the forensic image match—and the hash of the export matches the image source—you’ve given the court a straight line of integrity.

Practical playbook by evidence type

Chats & messaging apps

• Export chats using the app’s native export (include media if size permits).
• Capture headers (participants, timestamps, numbers/usernames).
• Avoid editing; if redaction is necessary, create a redaction log.
• Certificate should mention app/version, device details, and export method.
• Preserve device for cross-verification; get a mirror image if possible.

Email

• Print headers (From, To, CC, Date, Message-ID).
• Retrieve from server with full headers; avoid screenshots alone.
• Certificate should identify the mail server/account and export process.

CCTV

• Extract the original clip in native format; avoid only-screen recordings.
• Note camera ID, DVR/NVR model, time sync method; record hash of the original file.
• Maintain a copy of the player if a proprietary format is used.

Server logs / ERP

• Export within retention windows; note version and system time settings.
• Avoid CSV tampering—use signing or hash the export file.

Common objections & how to neutralize them

• “Anyone could have edited this.” → Show hash continuity, system logs, and a clear certificate.
• “Timestamps don’t match.” → Explain time zone/clock drift; show NTP settings or device offsets.
• “This is just a screenshot.” → Pair a screenshot with the native export and certificate; screenshots alone have little weight.
• “Chain of custody broken.” → Fill the missing link: produce the memo/person responsible and re-hash the current media.

For law enforcement / corporates

• Build a digital evidence SOP: seizure → imaging → analysis → reporting → storage.
• Maintain a register for device intake and a vault/locker with controlled access.
• Standardize tools (write blockers, forensic suites) and retain validation logs.

For defence

• Ask for cloned images and hash values; test for gaps/alterations.
• Challenge late or generic certificates; insist on device availability for independent verification.
• Look for metadata inconsistencies: EXIF vs. narrative, message IDs vs. alleged time.