How should I preserve digital evidence before filing a cybercrime FIR?

Question

I am a victim of an online fraud and want to file an FIR. What digital evidence should I preserve and how do I make it admissible in court? Before I spend money on it, I want to know whether Indian Evidence Act 1872, Section 65B gives me a remedy here and what proof I would need. Any Section numbers I can quote when I write to them would be useful.

MyVakeel Legal Desk · Accepted Answer

Indian Evidence Act 1872, Section 65B, Bharatiya Sakshya Adhiniyam 2023, Section 63, Bharatiya Nagarik Suraksha Sanhita 2023, Section 173 and Information Technology Act 2000, Section 79A is what decides this question in India. Read it alongside the provisions named, because the relief available to you turns on the facts you can prove on paper.

Electronic records such as screenshots, chat logs, call recordings, and transaction receipts are admissible only if accompanied by a certificate under Section 65B of the Indian Evidence Act 1872, or its equivalent Section 63 of the Bharatiya Sakshya Adhiniyam 2023, identifying the device and process used to generate the record.

The certificate must be signed by a person occupying a responsible official position in relation to the device from which the electronic record was produced.

Section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023 allows an FIR for a cognizable cyber offence to be lodged electronically, and the police are required to register it and investigate without insisting on a physical visit for the initial complaint.

For complex digital evidence, courts may rely on examiners of electronic evidence notified under Section 79A of the Information Technology Act 2000 to certify the authenticity and integrity of the data.

Original devices such as phones or laptops used in the fraud should be preserved unaltered wherever possible, since a forensic hash value comparison is often needed to prove the evidence was not tampered with.

What this means for you: 1) Take timestamped screenshots and export chat or call logs without editing them; 2) Obtain a Section 65B certificate from the person who has custody of the device or server; 3) Do not factory reset or reuse the device involved; keep it as-is for forensic imaging if needed; 4) File the FIR on cybercrime.gov.in or at the local police station attaching all preserved evidence.

Where the facts are disputed, what usually decides a digital evidence cybercrime fir matter is the paper trail — dated complaints, acknowledgments and written replies under Indian Evidence Act 1872, Section 65B. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in cyber law.