Chapter-1
Nature of Digital Evidence
Digital evidence, also known as electronic evidence, is information stored or transmitted
in digital form that can be used in legal proceedings. It is intangible, easily modified and
requiring careful handling. Unlike physical evidence, it exists as binary data, can be easily
modified or lost by Artificial Intelligenc(AI). It usually includes metadata and demands technical
expertise for proper analysis. To be accepted in court, digital evidence must be authentic,
reliable, and handled with a clear chain of custody. It includes data from computers, mobile
phones, CCTV, emails, and social media, and is often vital in criminal and civil cases. The
nature of digital evidence is intangible, easily modified, copied, or deleted, and often requires
special tools and expertise to collect, preserve, and analyze. Its admissibility in court depends on
maintaining integrity, complying with privacy laws and its authenticity, reliability, and whether
proper procedures were followed during its handling to maintain its integrity.
1.1 Definition of digital evidence
Digital means using a system of receiving and sending information as a series of the
numbers one and zero (Binary Number), showing that an electronic signal is there or is not
there.1The term “digital” refers to data represented in binary code.2
Evidence is derived from the Latin word evidens or evidence, which means “to clearly; to
make clear to the sight; to discover clearly; to make plainly certain; to ascertain; to prove”. The
definition of “evidence” covers (a) the evidence of witnesses, 47 and (b) documentary evidence.
Evidence can be both oral and documentary and electronic records can be produced as evidence.
This means that evidence, even in criminal matters, can also be by way of electronic records.
This would include video-conferencing”. 3
1
A S Hornby, Oxford Advanced Learner’s Dictionary, Ninth edition, P-427.
2
According to Black's Law dictionary.
3
Ratanlal & Dhirajilal, The Law of evidence (PB)27th ed
Digital evidence is defined as any data stored or transmitted using a computer that
support or refute a theory of how an offense occurred or that address critical elements of the
offense such as intent or alibi.4
Digital evidence is information and data of value to an investigation that is stored on,
received, or transmitted by an electronic device. This evidence is acquired when data or
electronic devices are seized and secured for examination.5
The electronic evidence, as any information with values that is stored or transmitted
electronically, and it includes evidence such as computer data, digital audio, digital video, cell
phones and digital Fax machines.6
Digital evidence refers to any information or data of investigative value that is stored,
received, or transmitted electronically through digital devices such as computers, mobile phones,
digital audio or video files, and fax machines. Usually, evidence includes oral and documentary
but modern legal systems now recognize electronic records as valid evidence in crimes and
intellectual property and aarbitration cases. Digital evidence is important in supporting or
disproving theories of a crime and can help show how a crime happened or prove someone’s
innocence or guilt.
1.2 Types of Digital Evidence
Digital evidence is the information or data which is in the electronic forms. The
widespread use of technology in different aspects of life has led to an increase in the different
forms of digital evidence. Here are some of the types of digital evidence:
1. Communications through text messages, emails, instant messaging, and other electronic
messaging platforms can be used as digital evidence.
2. Social media posts, comments, messages, and other content from any other social media
platforms like Facebook, Twitter, Instagram, etc., can be used as valuable digital evidence.
3. Digital documents, spreadsheets, presentations, and other file types are also forms of digital
evidence. Metadata within these files may also provide important information.
4
Eoghan Casey, Digital Evidence and Computer Crime, Third Edition,2011, page
5
David W.Hagy, Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition, page
6
Section 79A of the Information Technology (Amendment) Act (2008)
4. Digital photos and videos can be powerful evidence. Metadata, such as timestamps, and Geo
location data, can be crucial in order to establish authenticity and context of media files.
5. Logs that record computer and internet activities, including browsing history, file access and
system logs, can be analyzed as digital evidence.
6. Mobile devices and some digital cameras record GPS and location data, and are also
considered as digital evidence.
7. Records of phone calls, including call logs, durations and time stamps, can be treated as
digital evidence.
8. Digital records of financial transactions are considered digital evidence. That includes bank
statements, online purchases and electronic fund transfers, which can be important in
financial investigations
9. Fingerprints, facial recognition data, and recording of unique voice characteristics may be
used as digital evidence.
10. Information related to network traffic, IP addresses, and connection logs can be important
for Cyber security and digital forensics.
11. Information that is related to software usage, application logs and system configurations can
be treated as digital evidence.
12. Data which is stored in cloud services such as Google Drive, Dropbox, or One drive, can be
used as evidence.
13. Metadata associated with digital files, such as creation data, modification history, and user
information is also considered digital evidence that is used for forensic purposes.
14. Cryptocurrencies, and blockchain transactions, can also serve as digital evidence. 7
It is noted that Digital evidence exists in many forms, including communications, social
media, digital documents, digital photos and videos, logs, ect. As technology advances, these
types provide critical information in civil and criminal cases. These types of digital evidence
demonstrate the extensive reach of digital forensics in judicial systems and the importance of
proper handling and analysis to ensure authenticity and admissibility in court.
7
Criminal Law- Practice and Procedure by Sri Mude Anil KumarNaik, ll Additional Civil Judge (Junior Division),
Proddatur, P- 4.
1.3 Legal Framework governing digital evidence
India
In India, the admissibility of digital evidence depends on the different laws, and courts
rulings. The Indian legal system has given legal recognition to digital evidence and such
recognition of digital evidence is covered under different laws. The legal framework for digital
evidence in India is primarily governed by the Indian Evidence Act, 1872, the Information
Technology Act, 2000, and the recent Bharatiya Sakshya Adhiniyam (BSA), 2023, which
replaced the Indian Evidence Act.
According to Section 65B of the Indian Evidence Act, has given legal recognition to
digital evidence 𝚊𝚗𝚍 specifically addresses the admissibility of the electronic records before the
court.8 As per the section, the electronic records include emails, or digital documents or other
documents acceptable as evidence in Court. This document can be used as evidence in court
without having to show the original digital file, subject to some conditions mentioned in the
section that needs to be followed. This section was introduced to allow easier use of electronic
information as evidence and to address the challenges posed by the growing use of electronic
records and digital communication in various legal matters. Section 65 B (4) of this Act,
electronic records can be presented in court as evidence, but they must be accompanied by a
certificate. In order to present a statement from the electronic record in court, a certificate can be
used. The certificate should be signed by a responsible official who can confirm how the
electronic record was produced, provide details about the devices involved, and address the
conditions.9
Under Section 4 of Information Technology Act (2000), electronic records (e.g., emails,
databases) are granted equivalence to paper documents. It states that wherever any law requires
information or any matter to be in writing or in printed form, an electronic record fulfilling the
same criteria will be considered valid and legally recognized.
According to Section 5 of this Act gives electronic signatures equal legal recognition as
handwritten signatures. It means that wherever a law requires a signature for authentication, an
8
Supreme Court on the admissibility of electronic evidence under section 65B of the Evidence Act
9
The Information Technology Act (2000)
electronic signature is considered valid and enforceable, provided it meets the prescribed
standards.10
According to Section 79A of the Act, which was amended in 2008 states that, it is
necessary for the central government to appoint an examiner of electronic evidence. That
person's role is to give their expert suggestions on electronic evidence in court or other
authorities.11
This new legislation modernizes evidence law for the digital age. It elevates electronic
and digital records to the status of primary evidence (previously secondary), simplifying their
admissibility without needing physical copies. It introduces updated definitions for electronic
records and digital signatures, mandates strict authentication and integrity requirements, and
allows some flexibility in certification where obtaining a certificate is not feasible. It also
recognizes advanced technologies like AI and blockchain in evidence handling.
Malaysia
According to Section 62 of the Evidence Act 1950 [Act 56] of Malaysia (Explanation 3)
“a document produced by a computer is primary evidence.” Sections 90A, 90B and 90C of the
Evidence Act 1950 [Act 56] provide the requirements for documents produced by a computer
(which includes electronic evidence obtained) to be admissible in a criminal trial. Paragraphs (1)-
(3) from section 90A of Act 56 state as follows:
(1) In any criminal or civil proceeding a document produced by a computer, or a statement
contained in such document, shall be admissible as evidence of any fact stated therein if the
document was produced by the computer in the course of its ordinary use, whether or not the
person tendering the same is the maker of such document or statement
(2) For the purposes of this section it may be proved that a document was produced by a
computer in the course of its ordinary use by tendering to the court a certificate signed by a
person who either before or after the production of the document by the computer is responsible
10
All about digital evidence written by apruthvi Ramkanta Hegde
11
The Indian Evidence Act (2000).
for the management of the operation of that computer, or for the conduct of the activities for
which that computer was used.
(3) (a) It shall be sufficient, in a certificate given under subsection (2), for a matter to be stated to
the best of the knowledge and belief of the person stating it.
(b) A certificate given under subsection (2) shall be admissible in evidence as prima facie proof
of all matters stated in it without proof of signature of the person who gave the certificate.”12
Singapore
Singapore is an interesting jurisdiction to begin with since it previously had special
provisions for digital evidence similar to India and Malaysia, which were removed by the
Evidence (Amendment) Act, 2012. Section 35 of the Evidence Act, 1893 [‘Singapore Evidence
Act’] before amendment stated that computer output will be ‘admissible’ if it is expressly agreed
upon, produced ‘in an approved process’, or is shown by party tendering such output. The
Singapore Evidence Act also permitted an individual in a ‘responsible position’ to tender a
certificate that the computer was working in accordance with an ‘approved process’, after which
the Court would presume that the output was true unless proven otherwise.13
The pre-amendment Singapore Evidence Act treated electronic evidence as a separate
class of evidence. Though the provision may seem narrowly tailored to a computer (and thus
implicitly excluding other forms of digital evidence), a ‘computer’ was broadly defined to mean
‘electronic, magnetic, optical, electrochemical, or other data processing device…performing
logical, arithmetic or storage functions, and includes any data storage facility or communications
facility.’14 Therefore, any evidence that could reasonably be classified as digital evidence was
still covered by Singapore’s laws. Notably, this broad definition of computer is also seen in
15
jurisdictions such as Malaysia, which has laws similar to the erstwhile Sections 35 and 36 of
the Singaporean Evidence Act and has been held to include diverse forms of electronic evidence.
12
https://sherloc.unodc.org
13
Singapore Evidence Act 1893, s 35(3) (before the amendment).
14
Ibid s 3.
15
Malaysia Evidence Act 1950, s 3.
Despite the seemingly comprehensive nature of these provisions, they were nonetheless
criticised for lacking ‘technological neutrality.’ The Singapore Academy of Law’s Technology
Law Development Group (‘TLDG’) released a Consultation Paper (‘TLDG Consultation Paper’)
in 2003 that was critical of the special provisions relating to digital evidence. 16It argued that the
‘principle of equivalence’ as contained in the UNCITRAL Model Law on Electronic Commerce
was missing in Singapore law.17 The principle of equivalence states that electronic evidence
should not be rendered inadmissible solely because it is in a different form than other kinds of
evidence.18
A result of the TLDG Consultation Paper’s failure to expound on the consequences of
these differences is its failure to explain Section 116A of the Singapore Evidence Act. Section
116A was introduced by the Evidence (Amendment) Act, 2012 and it states that any computer
that ordinarily ‘produces’ or ‘communicates’ any ‘electronic record’ will presume that the record
was accurately produced.19 This provision is only applicable to electronic records, thereby
making it a special provision.
Outside of these changes, however, electronic evidence in Singapore is now subject to the
usual rules of admissibility that apply to other types of evidence. There is still a presumption that
any electronic evidence is accurate if it was produced or communicated in the ordinary course of
action, which is strikingly similar to provisions in jurisdictions like India which were not
considered technologically neutral by the TLDG itself.20
Myanmar
Only in 2015, the Myanmar Evidence Act (1872) was amended to introduce additional
regulations addressing electronic contracting and signatures. The newly introduced section 67A
stipulates that signing requirements (for evidence purposes) in respect of “electronic records” can
be satisfied with any method which ensures that the signing person can be identified and the
intention of such person to sign the document can be determined.
16
TLDG Consultation Paper (n 9).
17
Ibid 67-8.
18
Ibid 69.
19
Singapore Evidence Act, s 116A.
20
TLDG Consultation Paper (n 9) 64-68.
While the Myanmar Evidence Act (1872) itself does not contain a definition of
“electronic record” but only provides that a “document” also comprises the electronic record, the
Electronic Transactions Law (2014) defines electronic record as “generated, sent, received or
stored by means of electronic, magnetic, optical or any other similar technologies in an
information system or for transmission from one information system to another”. The
authenticity and integrity of electronic records is explicitly recognized under sections 3(c), 4(a)
Electronic Transactions Law (2014). Some written records are however excluded from the scope
of the law (wills, negotiable instruments, trusts, powers of attorney, documents relating to title,
instruments prescribed in any existing law to be registered and matters exempted by the Ministry
by issuing notification, with the approval of the Government).
The Electronic Transactions Law (2014) further provides that “matters that are prescribed
to be reduced in writing or to be signed under any existing law may be made by electronic
record, electronic data message or electronic signature”, with electronic signature being defined
as “any symbol or mark arranged personally” by the signatory “or on his behalf by electronic
technology or any similar technologies to verify the authenticity of the source of the electronic
record and the absence of amendment or substitution”. According to this definition, the
electronic signature is thus a method of verifying the authenticity of the identity of the signatory
and affirmation that the signed document contains what it was intended to contain by the
signatory.21
Therefore, it can be concluded that the laws for digital evidence differ across India,
Singapore, Malaysia, and Myanmar. India allows digital evidence under the Information
Technology Act, 2000, and the Indian Evidence Act, 1872 (amended in 2000), which admit
electronic records but courts sometimes question its reliability. Singapore has strong and clear
rules under its Evidence Act, making it easy to use digital proof in court. Malaysia also accepts
digital evidence under Evidence Act 1950 (amended in 1997) and the Digital Signature Act
1997, though enforcement can be inconsistent, but enforcement can be weak. In Myanmar, the
Evidence Act (1872) was amended in 2015 to include some provisions for electronic evidence,
but the legal framework remains weak compared to other countries. Unlike Singapore or even
India, Myanmar lacks detailed rules on data integrity, encryption, or digital forensics, making
investigations difficult. The 2015 update was a small step forward, but the system still needs
21
www.luther-lawfirm.com
stronger laws and better enforcement to deal with modern digital crimes effectively. For now,
Myanmar’s approach to digital evidence remains underdeveloped. Hence, Singapore is the most
advanced, while Myanmar needs major updates to its laws.
1.4 Evidentiary Value of the Digital Evidence
The value of evidence comes from the legal world where evidence has a ‘probative
value’, meaning the weight or persuasive value assigned to the evidence. The probative value of
the evidence is weighed by the stakeholders (judge, jury, etc.) to help make a decision.
Probative value is the probability of evidence to reach its proof purpose of a relevant fact
in issue. It is one of the main elements of admitting evidence, as the admitted evidence must be
relevant, tending to make the fact in issue more likely or less likely to happen, no matter how
slight its probability is. However, there are exceptions to admitting relevant evidence. If the
probative value of evidence is substantially outweighed by the dangers of “unfair prejudice,
confusing the issues, misleading the jury, undue delay, wasting time, or needlessly presenting
cumulative evidence” then this evidence might be excluded.
The Indian Parliament on August 11, 2023, introduced the Bharatiya Sakshya Adhiniyam
that replaced the Indian Evidence Act, 1872. The Act has validated the evidentiary value of the
digital evidence. Some of the major changes with regard to electronic records are as follows:
The Act has expanded the evidentiary value of electronic or digital evidence, by
considering digital evidence as primary evidence. As per the Section 57 of the Act primary
evidence refers to actual documents presented for the Court’s examination. Section 65B of the
Indian Evidence Act 1872, digital Evidence was considered secondary evidence. Section 63 of
the Indian Evidence Act stated the meaning of the Secondary evidence.
However, the Act has provided more importance to digital evidence in the legal
proceedings by considering the digital evidence as primary evidence. Section 57 of the Act
prescribes the provisions for digital evidence as primary Evidence. The Section in its explanation
part 4 says that, when an electronic or digital record is created or stored, and this storage happens
at the same time or one after another in multiple files, each of these files is considered Primary
evidence.
Explanation 5 states that if an electronic or digital record is produced from proper
custody and is not disputed, it is also considered as Primary evidence. Explanation 6 states that
video is simultaneously stored in Electronic form and transmitted, broadcast or transferred
elsewhere, each of These stored recordings is considered primary evidence. Explanation 7
Further extends the concept to situations where an electronic or digital Record is stored in
various locations within a computer resource, including Temporary files. In such cases, each
automated storage space is considered Primary evidence.22
Therefore, electronic evidence must be original evidence to ensure accuracy in a criminal
case and to decide the case. Similarly, electronic records can be modified, so when presenting
evidence, the authenticity of the evidence will be more accurate only if the original evidence is
presented. When electronic records are to be presented as secondary evidence, the party
presenting the evidence can only be admitted as evidence if it clearly states that it is relevant to
the issues that can be presented as secondary evidence. Therefore, only when electronic records
are presented as original evidence in cases, the courts can decide the case with certainty, given
the high value of the digital evidence.
1.4 Artificial Intelligence (AI)
Advantages (AI)
One of the most significant concerns regarding AI in digital forensics is the rise of
deepfakes. These synthetic media, which can convincingly alter audio and visual content, may
call into question the authenticity of digital evidence. While the technical manipulation of media
is a challenge, the perception problem it creates among jurors and the public is even more
concerning. Ensuring the authenticity of digital evidence is paramount, and AI tools must be
developed to detect and mitigate the impact of deepfakes and synthetic media effectively.
(2) Data Replication and Authentication: The replicability of AI findings and the proper
authentication of AI-generated evidence pose potential challenges. For AI tools to be widely
accepted in forensic investigations, they must produce consistent and verifiable results. This
22
Criminal Practice and procedureSri Mude Anil Kumar Naik,II Additional Civil Judge(Junior Division),
Proddatur,P-
necessitates rigorous validation processes and standardized protocols to ensure that evidence
where AI comes into play still meets judicial standards.
(3) Ethical and Privacy Considerations: The use of AI in digital forensics also raises
ethical and privacy concerns. The collection and analysis of vast amounts of personal data must
be conducted in a manner that safeguards individual privacy rights. Additionally, the potential
for AI to be used in ways that could infringe upon civil liberties must be carefully monitored and
regulated.23
Artificial Intelligence (AI) in the legal field, especially with regard to electronic evidence,
is a revolutionary advancement that is changing the way attorneys collect, evaluate, and verify
digital data.24 This can be very helpful when evaluating case outcomes. Data or information
saved in a digital format that can be used in court is referred to as electronic evidence, or digital
evidence.25
Emails, social media posts, multimedia files, metadata, and online transactions are
examples of this type of evidence, and they can all have a big influence on the results of a case.
Additionally, by using algorithms that identify changes and create chains of custody, AI can help
confirm the legitimacy of electronic evidence.
However, the integration of AI into the management of electronic evidence raises
significant challenges and ethical considerations. The "black box" nature of many AI algorithms
can lead to questions about the reliability of the evidence generated, as the decision-making
processes may lack transparency. Furthermore, algorithmic bias can result in discriminatory
outcomes, potentially undermining fairness and justice in legal contexts. Privacy concerns also
arise, as the handling of electronic evidence often involves sensitive personal data, necessitating
stringent data protection measures.26
There are particular difficulties with regard to the admissibility of electronic evidence in
court when artificial intelligence (AI) is used in its gathering and analysis. Even while AI has
23
Major Cities Chiefs Association, Digital Evidence Working Group, Digital Evidence Enhancing public safety
using digital investigative technologies, October 2024,
24
R. L. Williamson & J. D. Thompson, Artificial Intelligence in the Legal Profession: Opportunities and Risks, 25 J.
Legal Tech. & Innovation, 93-115 (2023).
25
AI in Legal Evidence: Ethical Implications and Legal Adaptations, 28 Harv. L. Rev. Tech. & Law 41, 58-72
(2024)
26
R. Brown & J. Smith, Electronic Evidence: Legal and Procedural Challenges (New York: Academic Press,2020),
demonstrated its ability to swiftly and effectively handle vast amounts of digital data, the use of
AI-processed evidence presents serious legal issues, namely with regard to its dependability,
transparency, and adherence to accepted standards of proof.27
In the end, incorporating AI into the legal system has the potential to greatly improve the
effectiveness and equity of court proceedings. To ensure that the core values of justice,
accountability, and transparency are maintained, this must be done carefully. To guarantee that
AI enhances the legal environment while preserving individual liberties and rights, responsible
legal frameworks must be established and public trust must be prioritized. If handled responsibly
and with foresight, artificial intelligence (AI) in legal proceedings has the potential to
revolutionize evidence management in a world that is becoming more digital.
27
E. R. Smith & J. P. Harris, AI in the Courtroom: Navigating Admissibility and Evidence Integrity, 37 J. Digital
Law & Ethics, 108-127 (2023)
