Cybercrime Evidence Collection in India: How to Preserve Digital Proof

By Advocate Ganta Surya Kiran | 19 Law Chambers, Visakhapatnam | Cyber Crime

The biggest mistake cybercrime victims make after the crime itself is failing to preserve evidence correctly. Furthermore, digital evidence disappears faster than physical evidence fraudsters delete accounts, platforms automatically purge old messages, and IP logs are retained only for limited periods. Consequently, the hours immediately after discovering a cybercrime are the most critical for evidence preservation. Advocate Ganta Surya Kiran at 19 Law Chambers explains exactly what evidence to collect, how to preserve it correctly, and how Indian courts treat digital evidence.

Why Evidence Preservation is Critical in Cybercrime Cases

Digital evidence is fragile unlike physical evidence. Specifically: WhatsApp messages auto-delete in disappearing message mode, Instagram accounts and posts can be deleted instantly, IP address records are retained by ISPs for only 90 days in most cases, banking transaction records are accessible for 7 to 10 years but UPI transaction details may become harder to trace quickly, and fraudulent websites are frequently taken down within hours of complaints. Consequently, waiting even 24 hours to preserve evidence can result in permanent loss of critical proof.

Step-by-Step Evidence Collection Guide

• Screenshot Everything Immediately Take screenshots of: every threatening or harassing message including the sender’s profile name, profile picture, and phone number, every fake post or defamatory content with the URL visible in the browser bar, every fraudulent transaction confirmation or fake offer letter, the fraudster’s social media profile including their friends list if visible, and every email showing full email headers. Moreover, ensure every screenshot shows the date and time enable this in your phone’s status bar if not already showing. Furthermore, email screenshots to yourself immediately creating a dated timestamp record in your email server.
• Record Videos of the Evidence For online content that cannot be easily screenshotted record a screen video of the fraudulent platform, fake profile, or defamatory content. Furthermore, the video shows the content in its natural context including any interactive elements, linked accounts, or surrounding content that screenshots might miss. Moreover, video evidence is increasingly accepted as strong digital evidence by Indian courts. Consequently, record on a separate device if possible so the recording device’s timestamp is independent.
• Preserve All Transaction Records For financial fraud preserve: all bank statements showing the fraudulent debit transaction, UPI transaction IDs available in your UPI app’s transaction history, payment reference numbers from any payment gateway, screenshots of all payment requests received from the fraudster, and any digital receipts or order confirmations from the fraudulent platform. Furthermore, download and save these as PDF files — not just view them online. Read: UPI Fraud Complaint India.
•  Preserve All Communication Records Save all communications with the fraudster or harasser. Specifically: export your WhatsApp chat history through WhatsApp’s built-in Export Chat function — including media, email threads in PDF or .eml format, SMS message threads as screenshots or using a message backup app, and call logs showing all calls to and from the fraudster’s number. Moreover, do not block the fraudster’s number immediately first save all communication records. Consequently, blocking before saving may make certain evidence harder to access.
• Note Down All Identifiers Record every identifier visible about the fraudster. Specifically: phone numbers used even if changed, WhatsApp or Telegram usernames, email addresses, social media profile URLs and usernames, UPI IDs or payment handles, any website URLs, bank account numbers or UPI VPAs visible in payment requests, and any physical address information delivery addresses given, meet-up locations suggested. Furthermore, preserve any audio or video calls received from the fraudster many smartphones allow call recording through third-party apps.
• Prepare Section 65B Certificate Under the Indian Evidence Act electronic records are admissible in court only when accompanied by a certificate under Section 65B. Specifically, this certificate must be given by the person responsible for the computer or device on which the electronic record was stored. Moreover, the certificate must state: that the electronic record was produced from a computer in regular use, the computer was operating properly during the relevant period, and the information in the record was fed into the computer in the ordinary course of activities. Consequently, have your advocate assist in preparing a properly worded Section 65B certificate without which your digital evidence may be challenged as inadmissible.

What Evidence Can Police Obtain That You Cannot

Beyond what you preserve yourself police can obtain additional evidence through formal legal processes. Specifically: IP address records from Internet Service Providers — valid for only 90 days before logs are deleted, account registration details from social media platforms through court orders, bank account holder details from banks through letters rogatory, CCTV footage from locations where fraudsters operated, and call detail records (CDRs) from telecom companies. Consequently, filing your police complaint quickly — within days of the fraud — gives police the best chance of obtaining these time-sensitive records.

How Indian Courts Treat Digital Evidence

Indian courts accept digital evidence under the Indian Evidence Act as amended. Specifically:

Admissibility: Electronic records are admissible under Sections 65A and 65B of the Indian Evidence Act provided a proper Section 65B certificate accompanies the record. Furthermore, screenshots, emails, WhatsApp messages, and website captures are accepted as documentary evidence.

Reliability: Courts assess reliability based on: whether the device was under the witness’s control, whether the screenshot was taken contemporaneously, whether there is any evidence of tampering or manipulation, and whether the content is corroborated by other evidence.

Challenges: Defence advocates routinely challenge digital evidence by questioning: the authenticity of screenshots, chain of custody of digital devices, and the adequacy of the Section 65B certificate. Consequently, proper evidence preservation from the start significantly reduces successful challenges.

Frequently Asked Questions

Q: I deleted the fraudster’s messages in anger. Is my case lost?
Not necessarily. Furthermore, WhatsApp backs up messages automatically to Google Drive or iCloud check your backup. Moreover, police can obtain the chat records from WhatsApp through court orders platforms retain server-side records for specific periods. Additionally, the fraudster’s messages may be visible from the other end — if any friend or relative received the same messages. Consequently, engage an advocate immediately to explore all recovery options.

Q: Is a WhatsApp message screenshot valid as evidence in Indian courts?
Yes — with a Section 65B certificate. Furthermore, courts across India have accepted WhatsApp screenshots as valid digital evidence in numerous cases including cheque bounce, fraud, and criminal cases. Moreover, supplement screenshots with the exported chat history which provides complete unedited context. Read: Cyber Crime Laws India IT Act.

Q: How long do ISPs retain IP address records in India?
Currently 90 days for most ISPs under CERT-In guidelines — though this may change with new cybersecurity regulations. Consequently, file your police complaint within 90 days of the crime for the best chance of IP address tracing. Free legal aid: NALSA — nalsa.gov.in | Free Legal Aid in AP.

Also read: Online Fraud Complaint India | Cyber Stalking Harassment Complaint India | Best Cyber Crime Lawyers Vizag

📍 30-6-12, First Floor, Opp. Prema Samajam, Daba Gardens, Visakhapatnam — 530020 📞 +91 99495 92127 | 🌐 19lawchambers.com | 📺 @19LawChambers