Forensic technology in India: how digital evidence is preserved, reviewed and used
Forensic technology covers the tools and methods used to find, preserve and analyse electronic information in an investigation or dispute. It supports forensic audits, internal investigations, litigation and regulatory responses. In India, the rules on electronic evidence changed when the Bharatiya Sakshya Adhiniyam replaced the Indian Evidence Act from July 1, 2024.
What forensic technology covers
| Service | What it involves |
|---|---|
| Evidence preservation | Securing data before it is deleted or changed, including legal hold notices |
| Forensic imaging | Bit-for-bit copies of laptops, servers and drives, verified with hash values |
| Mobile data | Extracting messages, call logs and files from company phones, within legal limits |
| Email and cloud collection | Collecting mailboxes and files from email and cloud platforms |
| E-discovery and review | Processing, searching and reviewing large volumes of documents |
| Data analytics | Analysing ERP, payment and access data for patterns and anomalies |
| Reporting and testimony support | Documenting methods and findings so they can be relied on |
Common data sources in Indian companies
| Source | Examples | Notes |
|---|---|---|
| Accounting and ERP | Tally, SAP, Oracle, Microsoft Dynamics, cloud accounting tools | Audit trail and user logs matter as much as transactions |
| Email and collaboration | Microsoft 365, Google Workspace | Retention settings decide what can be recovered |
| Messaging | WhatsApp and other chat apps, often on personal phones | Usually the hardest source to collect |
| Devices | Laptops, desktops, USB drives | Imaged with write-blocking |
| Physical security | CCTV, access cards, biometric attendance | Often overwritten quickly, so preserve early |
| Banking | Bank statements, payment portals | Obtained from the company or through legal process |
Electronic evidence under Indian law
The Bharatiya Sakshya Adhiniyam, 2023 (BSA) replaced the Indian Evidence Act, 1872 from July 1, 2024. Electronic records are admissible as evidence, and section 63 sets out the conditions, including a certificate in the prescribed format confirming how the record was produced. The certificate is signed by the person in charge of the device or system and by an expert.
- Collect evidence in a way that preserves its integrity, using write-blocking and hash values
- Record a chain of custody from collection to presentation
- Document the tools and methods used
- Prepare section 63 certificates where records may be used in proceedings
- Keep original media secure and work only on verified copies
Privacy and employee data
Investigations often involve personal data of employees and others. India's Digital Personal Data Protection Act, 2023 is being brought into effect in phases through its rules, and investigations should be planned with counsel so that the collection and use of personal data rests on the right legal basis. Company policies on IT use, devices and monitoring matter too:
- Company-owned devices and accounts are easier to collect from than personal devices
- Personal phones used for work usually need the employee's cooperation or a legal order
- Collection should be proportionate to the allegations and documented
- Data shared outside India, for example with US counsel, should follow the applicable rules and your policies
How a forensic technology engagement runs
- Scoping with counsel: identify custodians, data sources, date ranges and legal constraints
- Preservation: issue legal hold notices and suspend deletion policies
- Collection: image devices and collect email, cloud and ERP data, with chain of custody
- Processing: index data, remove duplicates and recover deleted items where possible
- Review: keyword searches, filters and technology-assisted review to find relevant documents quickly
- Analysis and reporting: timelines, communication maps and documented findings
Data analytics in investigations
- Vendors sharing bank accounts, phone numbers or addresses with employees
- Payments just below approval limits, or split invoices
- Changes to vendor bank details followed by large payments
- Journal entries posted at unusual times or by unusual users
- Access to systems after an employee has left
- Communication patterns between employees and suppliers around key dates
The same analytics, run regularly, support internal audit and concurrent audit as early warning tools.
Cross-border matters with the US
Being ready before an incident
- IT and device policies that allow collection from company systems
- Retention settings that keep email and chat long enough
- Central logging for key systems
- A list of data sources and system owners
- A response plan naming who calls counsel, who preserves data and who communicates
- Audit trail settings in the accounting software, which the statutory auditor also reports on
Mistakes that weaken digital evidence
- IT staff browsing a suspect's laptop before it is imaged
- Forwarding emails instead of collecting them with metadata
- Letting deletion policies run after a matter is known
- Taking screenshots of chats instead of collecting the data
- No record of who handled devices and when
- Collecting far more personal data than the matter needs
A short call with us and your counsel at the start avoids most of these.