How should I preserve digital evidence before filing a cybercrime FIR?

Question

I am a victim of an online fraud and want to file an FIR. What digital evidence should I preserve and how do I make it admissible in court? I have been reading conflicting things online and I would like to understand what Indian law actually says about this, which Act and Section applies, what the realistic timelines and costs are, and what I should be doing right now to protect my position. If the matter can be resolved without litigation I would prefer that route, but I want to know what my rights are before I agree to anything or sign any document.

MyVakeel Legal Desk · Accepted Answer

How should I preserve digital evidence before filing a cybercrime FIR? is governed in India primarily by Indian Evidence Act 1872, Section 65B, Bharatiya Sakshya Adhiniyam 2023, Section 63, Bharatiya Nagarik Suraksha Sanhita 2023, Section 173 and Information Technology Act 2000, Section 79A. The short answer is set out below, followed by the practical steps most people in this situation need to take. Read it alongside the specific provisions named, because the exact relief available to you turns on the facts you can prove on paper.

Electronic records such as screenshots, chat logs, call recordings, and transaction receipts are admissible only if accompanied by a certificate under Section 65B of the Indian Evidence Act 1872, or its equivalent Section 63 of the Bharatiya Sakshya Adhiniyam 2023, identifying the device and process used to generate the record.

The certificate must be signed by a person occupying a responsible official position in relation to the device from which the electronic record was produced.

Section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023 allows an FIR for a cognizable cyber offence to be lodged electronically, and the police are required to register it and investigate without insisting on a physical visit for the initial complaint.

For complex digital evidence, courts may rely on examiners of electronic evidence notified under Section 79A of the Information Technology Act 2000 to certify the authenticity and integrity of the data.

Original devices such as phones or laptops used in the fraud should be preserved unaltered wherever possible, since a forensic hash value comparison is often needed to prove the evidence was not tampered with.

What to do next: 1) Take timestamped screenshots and export chat or call logs without editing them; 2) Obtain a Section 65B certificate from the person who has custody of the device or server; 3) Do not factory reset or reuse the device involved; keep it as-is for forensic imaging if needed; 4) File the FIR on cybercrime.gov.in or at the local police station attaching all preserved evidence.

If the other side has already issued a notice, filed a case or set a deadline, treat the matter as time-sensitive — most remedies under Indian Evidence Act 1872, Section 65B carry limitation periods, and a delay you cannot explain weakens an otherwise strong case. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in this practice area.