What digital evidence is, and the rules around it
🎯You'll be able to
Explain what makes digital evidence trustworthy, and why investigators work on copies with proper authority.
🏠The everyday picture
At a crime scene, investigators photograph things where they lie, wear gloves, and bag each item with a label. A fingerprint smudged by a curious bystander is useless, however clear it once was.
📘What it really is
-
Digital evidence is any stored or transmitted data that helps show what happened: logs, files, emails, database records, disk images, memory captures, cloud audit trails.
-
It's fragile: opening a file can change its "last accessed" time; running a program on a suspect machine changes its memory and disk.
-
Work on copies: make a verified copy, then examine the copy. Keep the original untouched.
-
Authority: collect only what your role and the organisation's policy allow, and only what's relevant. Staff devices, personal data and private messages need care and often legal advice.
-
Courts in India: electronic records offered as evidence generally need a certificate about how they were produced. Since 1 July 2024, this is under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, which replaced section 65B of the Indian Evidence Act. This is general information, not legal advice; ask a lawyer before any case.
-
Know your limits: serious cases are handled by trained forensic examiners and the police. A first responder's job is to preserve evidence well and hand it over.
📝A worked example
Input: the clinic's two log files from the S04 incident.
Steps:
- Don't edit or re-save the originals on the server.
- Copy them to a separate, access-controlled folder, and note who made the copy, when and from where.
- Work only on a second copy for analysis.
Expected output: originals untouched, one preserved copy, one working copy, and a written note of each step.
🌍Where it's used
- Internal investigations into data misuse by staff.
- Insurance claims after ransomware, which ask for evidence of what happened.
- Police cyber cells that receive evidence from victims.
📝Case scenario
A company suspected an employee of copying customer lists. A manager opened the employee's laptop, browsed folders and forwarded files to himself. When the case reached a tribunal, the other side argued that the manager could have created or changed the files. Proper copying by a trained person would have avoided that argument.
🖱️Try it
On your own computer, find a file's "modified" and "accessed" times (on Linux, stat filename), open it, and check again. Success:
you can say whether opening it changed either time on your system.
⚠️Common mistakes
- Exploring the original. Sign: browsing a suspect machine directly. Fix: copy, verify, then examine the copy.
- Collecting everything. Sign: whole mailboxes copied "just in case". Fix: collect what's relevant and allowed.
- Acting without authority. Sign: no written approval. Fix: get it from the right person, with legal advice where needed.
🛠️For your project
The capstone's incident playbook includes an evidence section based on this module.
✅Quick check
Why should investigators work on a copy?
Show the answer
Examining the original can change it, and the original must stay as it was.
Which law now covers certificates for electronic records in Indian courts?
Show the answer
Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (replacing section 65B of the Indian Evidence Act).