Internal and Forensic Audit · Cyber Forensics

Digital Evidence and Its Collection in Cyber Forensics

Updated 11 October 2026 · Fact-checked

Digital evidence is any information of probative value stored or transmitted in electronic form. You collect it by identifying sources, securing them, acquiring a forensic copy without altering the original, documenting every handover (chain of custody), and preserving it so a court can accept it as reliable.

Understand Digital Evidence and Its Collection

Digital evidence is information that helps prove or disprove a fact and exists only in electronic form. Section 79A of the IT Act, 2000 describes "electronic form evidence" as any information of probative value that is stored or transmitted in electronic form. It includes computer evidence, digital audio, digital video, cell phones and digital fax machines.

Its nature creates the forensic challenge. It is easy to copy, easy to alter and easy to delete. It can sit in many places at once. A careless step, such as switching on a seized laptop, can change timestamps and damage its value in court.

The law accepts it. Section 61 of the Bharatiya Sakshya Adhiniyam, 2023 says an electronic or digital record cannot be denied admissibility only because it is electronic. It has the same legal effect, validity and enforceability as other documents, subject to section 63. Section 62 says the contents of electronic records may be proved as per section 63.

Sources are wide: computers, servers, mobile phones, emails, chat logs, cloud accounts, ERP and accounting data, CCTV, system logs, and network traffic. For a forensic auditor, ERP audit trails, bank portal logs and email trails are common.

Collection follows four stages: identify what may hold evidence, acquire it without changing the original, preserve it with integrity checks, and document it through the chain of custody. The aim is that the evidence is genuine, complete and can be shown to be untampered.

Key rules to remember

Meaning of electronic form evidence (IT Act, s 79A): Electronic form evidence = information of probative value, stored or transmitted in electronic form; Includes computer evidence, digital audio, digital video, cell phones, digital fax machines. Central Government may notify an Examiner of Electronic Evidence to give expert opinion.
Admissibility (BSA, s 61): Electronic or digital record = same legal effect, validity and enforceability as other documents, subject to s 63; Cannot be rejected merely because it is electronic.
Primary evidence (BSA, s 57, Explanations 4, 5 and 7): Each file of an electronic record stored in multiple files, or in multiple storage spaces including temporary files, is primary evidence; a record from proper custody is primary evidence unless disputed; Explanation 5 makes the proper custody point important.
Proper custody (BSA, s 81 Explanation): Proper custody = in the place and with the person where it is required to be kept; not improper if legitimate origin is proved or probable; Also applies to s 93.
Presumption for five-year-old records (BSA, s 93): Record purporting or proved to be 5 years old + proper custody → Court may presume electronic signature was affixed by the person or one authorised by him; It is a discretionary presumption (may), not mandatory.
Proving contents: Contents of electronic records may be proved in accordance with s 63 (BSA, s 62); Section 63 text is not reproduced here; state only that its conditions must be met.

How to solve Digital Evidence and Its Collection questions

Use this order for any question on identifying, collecting or preserving digital evidence, or on its legal acceptance.

1Read the facts and list the possible sources: devices, accounts, logs, backups, cloud, ERP.
2Classify the evidence: stored data, transmitted data, volatile or non-volatile.
3Say how you would secure the scene or system and stop changes, for example isolating devices and not working on the original.
4Describe acquisition: a forensic image or copy, with a hash value recorded to prove the copy matches the original.
5Describe preservation and the chain of custody: who handled it, when, where, why, with sealed storage and logs.
6Link to law: s 61 admissibility, s 57 primary evidence, proper custody under s 81 and s 63 proof of contents.
7Note expert help, such as an Examiner of Electronic Evidence under s 79A, if opinion is needed.
8Conclude: is the evidence reliable and admissible, and what gap, if any, must be fixed?

Quickest way: I-A-P-D-L method

When to use it: Use it when time is short and the question asks you to explain the collection process or comment on a case.

I - Identify sources.
A - Acquire a forensic copy; never work on the original.
P - Preserve with hash values and secure storage.
D - Document each step and each handover (chain of custody).
L - Law: s 61 admissibility, s 57 primary evidence, proper custody, s 63 proof.

Common mistakes in Digital Evidence and Its Collection

Saying electronic records are inadmissible unless a paper printout is produced.
Old habits from paper-document thinking.
Fix: State s 61: an electronic or digital record cannot be denied admissibility merely because it is electronic, subject to s 63.
Working directly on the original device or data.
Students focus on finding facts, not on keeping evidence intact.
Fix: Always acquire a forensic image, verify with a hash value and analyse the copy.
Ignoring chain of custody in the answer.
It looks like paperwork, not a technical step.
Fix: Record who, when, where and why for every handover. Gaps give the other side grounds to dispute authenticity.
Treating the s 93 presumption as automatic.
Students overlook the word "may".
Fix: Write that the Court may presume, and only for a record purporting or proved to be five years old, from proper custody.
Defining proper custody as only the owner's possession.
Memorising a loose idea of custody.
Fix: Use the Explanation to s 81: the place and person where it is required to be kept, and legitimate origin is not defeated.
Forgetting volatile data.
Focus on hard disks only.
Fix: Mention that live memory, running processes and network connections vanish at shutdown, so capture them first where appropriate.

Worked examples

Example 1

During a forensic audit of Mehta Textiles Ltd, you suspect the accounts manager altered purchase entries in the ERP and sent instructions by email. Explain how you would collect and preserve the digital evidence.

Show the solution

Identify sources: ERP database and audit trail, the manager's computer, email server and mailbox, server logs, backups.
Secure: restrict access and change rights so entries cannot be modified. Do not let the manager handle the systems.
Acquire: take a forensic image of the computer and an export of ERP logs and mailbox, working on copies, not the original.
Verify: compute and record hash values of originals and copies to show they match.
Preserve: store originals sealed and access-controlled; keep working copies separate.
Document: maintain a chain of custody log with date, time, person, purpose for each handover.
Legal: the records are admissible under s 61 of the BSA, subject to s 63. Records kept as required are in proper custody, which supports their reliability.

Answer: Identify ERP, email and device sources, secure them, make hash-verified forensic copies, preserve the originals under controlled access, and maintain a chain of custody log. This supports admissibility under s 61 of the BSA, 2023, subject to s 63.

Example 2

A company produces an electronic record dated seven years ago, with an electronic signature purporting to be of its former director. The record comes from the company's secretarial records. Can the Court presume who affixed the signature? Answer with reference to the law.

Show the solution

Identify the provision: s 93 of the BSA, 2023.
Check the conditions: the record purports or is proved to be five years old. Seven years satisfies this.
Check custody: it must come from custody the Court considers proper. Secretarial records are where such a record is required to be kept, which fits the Explanation to s 81.
Apply the effect: the Court may presume that the electronic signature was affixed by the director or a person authorised by him.
Note the limit: the presumption is discretionary, and the Court decides if the custody is proper.

Answer: Yes. Under s 93 the Court may presume the signature was affixed by the former director or someone authorised by him, provided the Court considers the custody proper. The presumption is not mandatory.

Exam tips

Give a clear sequence (identify, acquire, preserve, document) in every process question; examiners reward structure.
Quote section numbers only where you are sure: ss 57, 61, 62, 81, 93 of the BSA, 2023 and s 79A of the IT Act are safe.
Apply the law to the facts given, such as company names and systems, and end with a conclusion.
Use precise words: "may presume" in s 93, "subject to section 63" in s 61.
Always mention hash values and chain of custody in preservation answers.

Practice questions from Cyber Forensics

Digital Evidence and Its Collection in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Digital Evidence and Its Collection: frequently asked questions

What is digital evidence in cyber forensics?

It is information of probative value stored or transmitted in electronic form. Section 79A of the IT Act, 2000 lists computer evidence, digital audio, digital video, cell phones and digital fax machines as examples.

What is chain of custody?

It is the documented record of who held the evidence, when, where and why, from collection to court. It helps show the evidence was not altered or tampered with.

Is an electronic record admissible in court?

Yes. Section 61 of the Bharatiya Sakshya Adhiniyam, 2023 says it cannot be denied admissibility only because it is electronic, and it has the same legal effect as other documents, subject to section 63.

Why must we use a forensic copy instead of the original?

Opening or running the original can change data and timestamps. A hash-verified copy lets you analyse freely while the original stays intact for proof.