Why Preserving Digital Evidence Matters

In any cyber‑crime investigation, the quality of the digital evidence can decide whether the police can register a First Information Report (FIR) and whether the case proceeds to court. Courts in India follow strict rules about the authenticity and chain of custody of electronic records. If you lose a screenshot, delete a chat, or fail to back up a hard‑drive image, the prosecution may argue that the evidence is tampered with or unreliable.

Key point: Acting quickly and following a documented process helps maintain the evidential value of emails, messages, social‑media posts, and other electronic artefacts.

Step‑by‑Step Guide to Preserve Digital Evidence

1. Stop All Activity on the Device

As soon as you realise that you are a victim of cyber‑crime, power off the device or disconnect it from the internet. Continuing to use the phone, computer, or tablet can overwrite crucial data. If turning off the device is not possible, switch it to Airplane mode and avoid opening any apps.

2. Take Time‑Stamped Screenshots

Capture the offending content exactly as it appears on the screen. Use the built‑in screenshot function (Power+Volume Down on most phones, Print Screen on Windows, Command+Shift+4 on macOS). After taking each screenshot, add a visible time‑stamp by opening the image in a simple editor and typing the date and time, or use a tool that automatically embeds the timestamp. Save the files in a dedicated folder named “Cyber‑Crime Evidence – [Your Name] – [Date]”.

3. Export Chats and Emails

For messaging apps (WhatsApp, Telegram, Signal) use the native “Export Chat” feature. Choose the option that includes media files. Save the exported .txt or .pdf files in the same evidence folder. For emails, use the “Print” → “Save as PDF” option to create a non‑editable copy that retains headers, timestamps, and IP information.

4. Preserve Social‑Media Posts

Social‑media platforms often allow you to download your data. Request a copy of your data from Facebook, Instagram, or Twitter via the platform’s settings. Additionally, use the “Save Page As” function in your browser to store a .html file of the offending post, which captures the exact layout and metadata.

5. Create a Forensic Image of Storage Media

If the crime involves files stored on a hard‑drive, USB stick, or SD card, create a bit‑by‑bit forensic image. Free tools like “FTK Imager” or “dd” (Linux) can generate a read‑only copy (e.g., .E01 or .dd file). Store the image on an external hard‑drive and label it clearly. Do not edit the original media after imaging.

6. Record Network Information

Note the IP address, MAC address, and any router logs that show the time of the incident. On Windows, run ipconfig /all; on macOS, use ifconfig. If you have access to router admin panels, download the log files for the relevant date and time.

7. Keep a Detailed Log

Write a chronological log describing each action you took: when you discovered the incident, what device you used, when you took screenshots, and any communications with the platform or service provider. This log becomes part of the chain of custody and shows that you did not tamper with the evidence.

8. Store Evidence Securely

Place the evidence folder on an encrypted USB drive or a password‑protected cloud storage (e.g., Google Drive with two‑factor authentication). Make at least two copies: one for personal records and one to hand over to the police. Avoid uploading the original files to public forums or social media.

9. Submit the Evidence to Police

When filing the FIR, present the original device (or the forensic image) along with the organized evidence folder. Provide the log you prepared and any receipts for internet service or platform communications. Ask the officer to note the receipt of the evidence in the FIR register.

Documents and Costs You May Need

  • Identity proof: Aadhar card, PAN card, or passport to verify your identity while filing the FIR.
  • Device details: Make, model, IMEI (for mobiles), and serial number of the device.
  • Proof of ownership: Purchase receipt or service bill for the device, if available.
  • Cost of forensic imaging: If you hire a professional, charges can range from INR 2,000 to 5,000 per device, but many tools are free for personal use.
  • Legal fees: Not required for evidence preservation, but you may incur a nominal fee for notarising the evidence log (around INR 100‑200).

Common Mistakes to Avoid

Deleting the content before saving: Once deleted, recovery becomes difficult and may be considered evidence tampering.

Using cloud backups that sync automatically: Cloud services may overwrite older versions of files; turn off sync before creating backups.

Relying on screenshots alone: Screenshots do not capture hidden metadata; combine them with exported logs and forensic images.

Sharing the evidence publicly: Posting screenshots on social media can weaken your case and expose personal data.

What Happens After You Submit the Evidence?

The police will register the FIR and may forward the digital evidence to a cyber‑cell or a certified forensic laboratory. The lab will verify the integrity of the data and produce a forensic report, which becomes part of the investigative file. If the investigation proceeds, the evidence you preserved will be presented in court, and the documented chain of custody will help establish its authenticity.

Remember, the faster you act and the more systematic you are, the stronger your case will be against the cyber‑criminal.

This article provides general information and does not constitute legal advice.

Photo by Philipp Katzenberger on Unsplash