Electronic evidence Section 63 BSA: preserve it step by step

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Digital evidence

Electronic evidence in India is admitted only when it is preserved correctly and backed by the right certificate. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (BSA) controls this. The provision applies to any information contained in an electronic record: chat messages, UPI and bank statements, call recordings, email headers, CCTV files, server logs and photographs. The record must be produced together with a certificate under section 63(4). Preservation is therefore a legal step, not a technical afterthought, and it is the first thing an investigation turns on.

Most digital evidence is lost because nobody secured it in time, not because a court refused it. Cloud backups rotate, phones are reset, screenshots lose their metadata, and an intermediary can remove an account once a request is made. Under the Information Technology Act, 2000, section 65 already treats computer output as a document, while sections 66C and 66D criminalise identity theft and cheating by personation using a computer resource. Those offences become provable only if the underlying electronic record survives intact and can be authenticated.

What Section 63 of the BSA actually requires

Section 63(1) creates a deeming rule. Information contained in an electronic record that is printed, stored, recorded or copied in optical, magnetic or semiconductor form is treated as a document, provided the record is produced by a computer or communication device under lawful control. Section 63(2) lists the conditions that must be shown: that the computer output was produced in the ordinary course of use, that the information fed in was of the kind ordinarily fed into it, and that the device was operating properly during the relevant period.

Section 63(4) adds the step that decides most cases. A certificate must be submitted with the electronic record at each instance it is produced for admission. The certificate identifies the record and describes how it was produced, gives particulars of the device involved, and deals with the conditions in section 63(2). It is signed by the person in charge of the computer or communication device, or the management of the relevant activities, and by an expert. The BSA Schedule prescribes a two-part form: Part A is completed by the party producing the record, Part B by the expert. A single certificate filed once at the beginning of a case will not serve later hearings.

Why the first hours matter more than the trial

Electronic records are volatile. A mobile application can overwrite cached messages within days. Bank portals typically display transaction history for a limited rolling window before older entries require a formal record request. Cloud providers may delete a deactivated account after a fixed retention period. The person who waits for a charge-sheet before collecting material has usually lost it.

There is a second reason for speed. Once a complaint is registered, the investigating officer can use the coercive provisions of the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) to obtain records from a platform, a telecom operator or a bank. Section 94 of the BNSS allows a court or the officer in charge of a police station to require production of any document or electronic communication, including a communication device, likely to contain digital evidence, and the order may be issued in physical or electronic form. Section 105 of the BNSS makes it mandatory to record any search and seizure through audio and video means, preferably on a mobile phone, and to forward the recording to the District Magistrate, Sub-divisional Magistrate or Judicial Magistrate. Both provisions assume the record still exists somewhere.

Speed also protects your narrative. A complaint that attaches a hashed copy of a conversation, a bank dispute reference and a dated capture of the offending post is far harder to brush aside than a bare statement of grievance. Investigating officers assess a complaint partly on how much of the record is already in front of them, so the earlier you hand over organised material, the earlier the investigation can actually move.

A step-by-step preservation procedure

The following sequence is what a careful complainant, business or investigating officer should follow. It works because each step creates material that the next one can rely on.

1. Stop the destruction. Do not delete the account, uninstall the application, reset the phone or "clean up" storage. Keep the device powered and reachable. If a malware infection is suspected, disconnect it from the network rather than wiping it.
2. Capture the primary record. Take the screenshot or export from within the original application, not from a forwarded copy. Include the sender's number or handle, timestamps and any attachment. Where the platform allows an official data export, use it, because it preserves more context than a screen capture.
3. Preserve metadata. Save the files to a location that keeps the creation date and device detail. Where possible, keep the original device or SIM card so that the record can be verified in its native environment.
4. Hash the material. Generate a cryptographic hash such as SHA-256 for every file. A hash converts the file into a unique string of characters; if the file changes by even one character later, the hash changes, which proves tampering. Record the hashes in a signed memorandum.
5. Create working copies. Keep the uploaded copies for daily use and store the primary set on write-protected media in a safe place. Two independent copies in two locations prevent an accidental loss.
6. Report immediately. File the complaint at cybercrime.gov.in if the offence is within its scope, or dial the national helpline 1930 where money has moved, and request an acknowledgement number. For an offence that requires police action, an FIR under section 173 of the BNSS fixes the date on which the first information reached the officer.
7. Get a section 94 order for third-party records. If the record sits with a platform, bank, telecom operator or intermediary, ask the investigating officer to issue a written order or request the Magistrate to summon it. An intermediary's safe-harbour protection under section 79 of the IT Act depends on it acting on lawful orders, so a proper order is also the fastest route to removal of the offending content.
8. Have the seizure recorded. Where police seize a device under section 105 of the BNSS, insist that the audio-video recording and the list of seized items be prepared and forwarded to the Magistrate. This recording is your evidence that the device was taken over in the condition you described.
9. Prepare the section 63(4) certificate early. Once the record is stable, have the person in charge of the device or the management of the relevant activities fill Part A, and an expert fill Part B, in the Schedule form. Do this before the first hearing, not on the day the record is tendered.

What to preserve, and how

• Chat and email threads: full thread with headers, not cropped images. Email headers reveal the sending server and the originating address.
• Financial records: complete statement for the disputed period, transaction reference numbers, and the bank's acknowledgement of the dispute.
• Call records: call detail records requested through the operator, together with any recording and its source device.
• CCTV and video: the original file, not a phone recording of a screen; note the camera identifier and the system clock.
• Web page and social media content: a dated capture that records the URL, timestamp and the device used, plus a request to the platform to preserve the content.
• Device state: the handset, SIM, memory card and any login session data, kept unaltered.

Evidence type and the matching preservation method

What decides whether the court accepts it

Three questions decide admissibility in practice. First, is the material the primary record or a copy of a copy? A screenshot of a forwarded screenshot invites a challenge that the original may have said something different. Second, is the chain of custody unbroken? Every hand that touched the device, every transfer between officers, and every time the material was copied should be documented. Third, does the certificate comply with section 63(4)? A capable expert opinion will not cure a missing certificate, because the statute makes the certificate, not the assurance, the gatekeeper.

Corroboration is the quiet test. A single screenshot may show that a message existed, but it rarely proves who sent it or that the transaction which followed was linked to it. Where the electronic record is read beside a bank statement, a call detail record or an expert's examination of the device, each piece shores up the others and the court has less room to doubt any one of them. Gaps between records are read as omissions, so completeness matters as much as content.

Courts also weigh authenticity against the possibility of manipulation. Metadata, hashes, and the absence of unexplained gaps in a conversation all help. So does consistency between the electronic record and independent material such as a bank statement or call detail record. Where the law is unsettled on how much corroboration an electronic record needs, counsel should not promise a particular outcome; the safer course is to over-preserve and let the court evaluate.

Common mistakes that ruin electronic evidence

• Editing, cropping or annotating a screenshot before saving the original.
• Deleting the account "to be safe" and thereby destroying the primary record.
• Keeping only a pen-drive copy without hashes or a preservation memorandum.
• Waiting for a court order before downloading a record that the platform will delete.
• Filing one section 63(4) certificate at the start and assuming it lasts for the case.
• Formatting a device before the investigating officer has examined it.
• Assuming an intermediary will preserve content on a mere phone call rather than a written order.

When to involve a lawyer

Preserving evidence is not, by itself, a complicated task, but the sequence of report, section 94 order, section 105 seizure, certificate and production is where most cases quietly fail. A person who is about to file a complaint, or who has received a section 94 notice, benefits from advice before the first record is tendered. You can read more about the litigation options on the resources and updates section. If the matter is already before a Magistrate, the certificate and the production of the record should be handled together. To plan a step-by-step approach, speak with a cyber crime lawyer in Kolkata and confirm what your matter needs.

A short summary is worth repeating: preserve the primary record, hash it, store copies safely, report promptly so that section 94 and section 105 of the BNSS can operate, and have the section 63(4) certificate ready before the first hearing. Evidence that is collected with this discipline usually survives scrutiny; evidence gathered loosely rarely does.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• BSA Section 57 Primary Electronic Evidence: Calcutta HC
• Section 63 BSA certificate: how to get it and who signs
• BSA Electronic Oral Evidence Recording: City Sessions Court
• Business email compromise: evidence to preserve in 48 hours
• Work from home scam evidence to preserve in first 48 hours
• UPI Fraud Evidence: What to Preserve in 48 Hours

Cyber crime lawyer in your city · Bank account freeze help · Contact