Authenticity of Digital Evidence

1. Meaning of Authenticity of Digital Evidence

Authenticity of digital evidence means establishing that a digital record produced before a court is genuine, reliable, untampered with, and actually represents the data or event that the party claims it represents.

Digital evidence may include:

• WhatsApp messages and chats
• Emails
• SMS records
• CCTV footage
• Audio/video recordings
• Call-detail records (CDRs)
• GPS/location records
• Computer files
• Photographs and screenshots
• Social-media posts
• Digital signatures
• Server logs
• Metadata
• Cloud records
• Bank and transaction records

The central concern is that digital information can potentially be copied, edited, deleted, manipulated, or altered without obvious physical signs. The Supreme Court has therefore repeatedly emphasised source, authenticity, reliability and safeguards when electronic records are relied upon.

2. Authenticity vs Admissibility

These two concepts should not be confused.

Authenticity

The question is:

"Is this digital record genuine and has it remained substantially unaltered?"

For example, if a party produces a WhatsApp screenshot, the court may ask whether:

• the screenshot actually came from the alleged phone;
• the account belonged to the alleged person;
• the conversation is complete;
• messages were deleted or edited;
• the screenshot was manipulated;
• the date and time are reliable.

Admissibility

The question is:

"Has the evidence been produced in the legally prescribed manner?"

Thus, a digital record may appear genuine but still face an admissibility objection if the statutory requirements for producing secondary electronic evidence have not been satisfied.

The Supreme Court's decision in Anvar P.V. v. P.K. Basheer and its later clarification in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal are particularly important on this distinction.

3. Legal Framework in India

There is an important change in the law that should be kept in mind.

The Indian Evidence Act, 1872 governed most of the leading Supreme Court cases concerning electronic evidence. It has now been replaced by the Bharatiya Sakshya Adhiniyam, 2023 (BSA) for the new evidentiary regime.

Therefore, older judgments frequently refer to:

• Section 65A of the Indian Evidence Act
• Section 65B of the Indian Evidence Act

The corresponding modern statutory framework should be considered under the Bharatiya Sakshya Adhiniyam, 2023, particularly its provisions concerning electronic/digital records and certificates.

However, the principles developed in the Supreme Court's electronic-evidence cases remain extremely important for understanding authenticity, integrity, primary evidence, secondary evidence and proof of digital records.

4. Why Authenticity Is Important

Digital evidence is especially vulnerable to manipulation.

For example, suppose an employee is accused of sending an abusive WhatsApp message. The employer produces a screenshot.

The employee may argue:

• the screenshot was fabricated;
• the conversation was edited;
• the phone number was not actually operated by the employee;
• the screenshot does not show the complete conversation;
• the message was forwarded from another account;
• the date/time was manipulated;
• the image has been digitally altered.

Therefore, a court should not simply ask "Does this screenshot look real?"

It must consider the source, integrity, circumstances of creation, custody and method of production.

5. Major Factors Establishing Authenticity

A. Identification of the Source

The first question is:

Where did the digital evidence originate?

For example:

• Which mobile phone?
• Which computer?
• Which server?
• Which CCTV system?
• Which email account?
• Which social-media account?
• Which cloud storage?
• Which service provider?

The closer the evidence can be connected to its original source, the stronger the authenticity argument.

B. Identification of the Device

Where possible, the device from which the evidence originated should be identified.

For example:

Mobile phone → WhatsApp conversation → extraction → forensic image → court

rather than:

Screenshot → printout → court

The first method generally provides a much stronger evidentiary foundation.

C. Preservation of Original Evidence

The original digital record should be preserved as far as possible.

Investigators should avoid unnecessary alteration of the original device.

Forensic procedures may include:

1. Seizing the device.
2. Documenting its condition.
3. Creating a forensic image.
4. Calculating a hash value.
5. Working on the forensic copy rather than the original.
6. Maintaining documentation of every transfer.

6. Hash Values and Digital Integrity

A hash value is a mathematical representation of digital data.

For example:

Original file → SHA-256 → Hash A

If the file is subsequently modified:

Modified file → SHA-256 → Hash B

If Hash A and Hash B differ, that indicates that the underlying digital data has changed.

Hashing is therefore an important technical integrity mechanism.

However, a hash by itself does not necessarily prove:

• who created the file;
• who sent the message;
• whether the source itself was trustworthy;
• whether the device was properly attributed to a person.

Therefore, hash verification is an important part of authentication, but not the entire authentication process.

7. Chain of Custody

Another important element is the chain of custody.

It means maintaining a record showing:

Who collected the evidence → who possessed it → who examined it → what examination was performed → where it was stored → who produced it before the court.

For example:

Police officer → forensic laboratory → investigating officer → prosecution → court

If the chain of custody is seriously defective, the opposing party may argue that the evidence could have been altered after collection.

8. Metadata

Metadata is information associated with a digital file.

For example, a photograph may contain:

• date and time;
• device information;
• GPS coordinates;
• file format;
• modification information.

An email may contain:

• sender;
• recipient;
• message ID;
• timestamps;
• server information;
• routing information.

Metadata can assist in establishing authenticity.

However, metadata should not automatically be treated as conclusive because metadata itself may sometimes be altered or stripped.

9. Digital Signatures

A digital signature can provide strong evidence concerning:

• identity of the signer;
• integrity of the signed document;
• whether the document has been altered after signing.

Digital signatures operate through cryptographic technology and therefore provide stronger authentication than an ordinary electronic image of a signature.

10. Screenshots and Authenticity

Screenshots are frequently produced in litigation.

Examples:

• WhatsApp screenshot
• Instagram screenshot
• Facebook screenshot
• Email screenshot
• Website screenshot

A screenshot is not automatically unreliable, but its evidentiary value depends upon how its authenticity is established.

A court may consider:

• the original device;
• the account;
• the phone number/email ID;
• surrounding messages;
• metadata;
• service-provider records;
• forensic examination;
• witness testimony;
• statutory certificate requirements where applicable.

A screenshot should therefore not be treated as automatically equivalent to the original digital record.

11. CCTV Footage

CCTV is an important category of digital evidence.

Authenticity may involve establishing:

1. Identity of the CCTV camera.
2. Location of the camera.
3. Ownership/control of the CCTV system.
4. Date and time settings.
5. Whether the recording system was functioning properly.
6. Whether footage was continuously recorded.
7. Whether footage was copied or edited.
8. Whether the original storage medium is available.
9. How the footage was extracted.
10. Whether the copy corresponds to the original.

The Supreme Court has specifically dealt with CCTV and electronic evidence in several cases, although some earlier observations on Section 65B were subsequently reconsidered.

12. Audio Recordings

For an audio recording, authenticity may require consideration of:

• identity of the speaker;
• accuracy of the recording;
• continuity of the conversation;
• absence of manipulation;
• method of recording;
• preservation of the original;
• circumstances in which the recording was made.

The Supreme Court has recognised that recorded conversations can be admissible, subject to appropriate safeguards concerning authenticity and reliability.

13. Six Important Case Laws

1. Ram Singh v. Col. Ram Singh

1985 Supp SCC 611

This is one of the foundational Indian cases concerning tape-recorded evidence.

The Supreme Court accepted that technological developments should not automatically exclude evidence merely because it is recorded electronically.

However, the Court emphasised safeguards concerning accuracy and authenticity.

Important considerations included:

• identification of the voice;
• accuracy of the recording;
• absence of tampering;
• preservation of the recording;
• reliability of the circumstances surrounding the recording.

The principle is important because it established that electronic recordings can be evidence, but authenticity must be demonstrated.

Principle

Electronic evidence is not inadmissible merely because it is technologically generated; its authenticity and reliability must be established.

2. State (NCT of Delhi) v. Navjot Sandhu

(2005) 11 SCC 600

This case, commonly known as the Parliament Attack case, involved extensive electronic evidence, including telephone-related records.

The Supreme Court considered electronic records and their evidentiary use.

The case is historically important because it represented an earlier approach to proving electronic records.

However, its interpretation concerning the manner of proving secondary electronic evidence was subsequently displaced by Anvar P.V.

Importance

The case demonstrates the evolution of Indian law:

Navjot Sandhu → Anvar P.V. → Arjun Panditrao

Thus, it should be cited with the qualification that portions concerning proof of secondary electronic records no longer represent the prevailing position.

3. Anvar P.V. v. P.K. Basheer

(2014) 10 SCC 473

This is one of the most important cases on electronic evidence.

The Supreme Court held that electronic records are subject to the special statutory framework concerning electronic evidence.

The Court emphasised that electronic records are susceptible to:

• tampering;
• alteration;
• transposition;
• excision;
• manipulation.

Therefore, statutory safeguards were necessary.

The Court held that where secondary electronic evidence was being produced, the requirements of Section 65B of the then Evidence Act had to be satisfied.

Principle

The case established the importance of the Section 65B certificate for secondary electronic evidence under the old Evidence Act framework.

Relevance to authenticity

The certificate mechanism was intended to provide assurance concerning:

• source;
• manner of production;
• functioning of the computer/system;
• reliability of the electronic output.

4. Shafhi Mohammad v. State of Himachal Pradesh

(2018) 2 SCC 801

This case took a more flexible approach to the Section 65B certificate requirement.

The Court held, in substance, that where a party did not possess the device from which the electronic record originated, insisting upon a certificate could create practical difficulties.

However, this approach was subsequently overruled by the Supreme Court in Arjun Panditrao Khotkar.

Therefore, Shafhi Mohammad is important mainly for understanding the development of the law.

Present position

The relaxation given by Shafhi Mohammad cannot be treated as the prevailing rule after Arjun Panditrao.

5. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal

(2020) 7 SCC 1

This is arguably the most important modern Supreme Court decision on the subject.

A three-judge Bench reaffirmed Anvar P.V.

The Court held that the certificate requirement under Section 65B(4) was a condition precedent for admission of secondary electronic evidence under the then Evidence Act. Oral evidence could not simply substitute for the required certificate.

The Court also clarified an important distinction.

Original device available

If the original electronic record/device itself is produced, the certificate requirement does not operate in the same way as it does for secondary electronic evidence.

The judgment specifically discussed situations involving:

• laptops;
• computers;
• tablets;
• mobile phones.

If the original device containing the information is produced and properly proved, the certificate may not be necessary merely because the evidence is electronic.

Network/system situation

Where the relevant electronic information is stored within a computer system or network that cannot practically be produced before the court, the statutory certificate mechanism becomes important.

Overruling

The Court expressly treated:

• Tomaso Bruno
• Shafhi Mohammad

as not laying down the correct law to the extent inconsistent with the clarified position.

6. Vikram Singh v. State of Punjab

(2017) 8 SCC 518

This case involved a recorded conversation.

The Supreme Court followed the principle that where the primary electronic evidence itself is produced, the certificate requirement applicable to secondary evidence does not necessarily arise.

The case is important for understanding the distinction between:

Primary evidence

The original electronic recording/device itself.

Secondary evidence

A copy, printout, extracted output or other reproduction of the original electronic record.

The Supreme Court later relied upon Vikram Singh while explaining this distinction in Arjun Panditrao.

7. Sonu @ Amar v. State of Haryana

(2017) 8 SCC 570

This case is useful for understanding the procedural dimension of objections concerning electronic evidence.

The Supreme Court considered objections relating to the manner in which electronic evidence was produced and the stage at which such objections were raised.

The broader lesson is that parties should raise evidentiary objections properly and at the appropriate stage rather than waiting until a later stage of litigation.

The case has subsequently been discussed in later Supreme Court decisions dealing with electronic evidence and Section 65B.

8. Tomaso Bruno v. State of U.P.

(2015) 7 SCC 178

This case involved CCTV evidence.

The Supreme Court stressed the importance of scientific and electronic evidence in modern criminal investigation.

However, the legal position stated in Tomaso Bruno concerning the statutory treatment of electronic evidence was later held to be per incuriam by the three-judge Bench in Arjun Panditrao.

Therefore:

Tomaso Bruno is historically important, but its inconsistent Section 65B proposition should not be treated as the current rule.

14. Comparison of Important Cases

15. How Courts Can Test Authenticity

A useful authenticity checklist is:

1. Source

Where did the evidence originate?

2. Ownership/control

Who owned or controlled the device/account/system?

3. Identification

Can the device, account, phone number or computer be connected to the relevant person?

4. Integrity

Has the evidence remained unchanged?

5. Hash

Can the forensic hash demonstrate that the examined copy corresponds to the preserved data?

6. Metadata

Does metadata support the claimed date, time, device and circumstances?

7. Chain of custody

Who handled the evidence from collection to production?

8. Forensic examination

Was the device or record examined using accepted forensic methods?

9. Original/secondary status

Is the court seeing the original electronic record or a copy/output?

10. Statutory compliance

Have the applicable statutory requirements for electronic evidence been satisfied?

16. Example: WhatsApp Evidence

Suppose an employer alleges:

"Employee A sent a threatening WhatsApp message."

The employer produces a screenshot.

Weak method

Screenshot → Printout → Court

The employee can challenge:

• authenticity;
• source;
• completeness;
• identity;
• alteration;
• deletion of surrounding messages.

Stronger method

Original phone → forensic extraction → preservation → hash → forensic report → applicable certificate → court

Additional evidence may include:

• phone number;
• account information;
• complete conversation;
• device ownership;
• witness testimony;
• metadata;
• service-provider information where legally obtainable.

The court then evaluates the evidence as a whole.

17. Example: CCTV Evidence

Suppose a company claims that an employee entered a restricted area at 10:30 PM.

The CCTV footage should ideally be accompanied by evidence establishing:

• identity of camera;
• location of camera;
• functioning of CCTV system;
• relevant date/time;
• original storage system;
• method of copying footage;
• integrity of copied footage;
• chain of custody;
• applicable statutory requirements.

A simple edited video clip on a pen drive is substantially more vulnerable to an authenticity challenge than properly preserved original footage with forensic documentation.

18. Digital Evidence and Tampering

Authenticity becomes particularly important where allegations involve:

Editing

Removing portions of an audio/video recording.

Splicing

Combining different portions of recordings.

Deepfakes

Creating artificially generated audio/video representations.

Screenshot manipulation

Changing names, dates, messages or images.

Metadata manipulation

Changing or removing metadata.

Account impersonation

Creating a fake social-media account.

Selective extraction

Producing only favourable messages while withholding the surrounding conversation.

These circumstances can significantly affect the evidentiary weight given to a digital record.

19. Role of Expert Evidence

Expert evidence can assist where authenticity is technically disputed.

A forensic expert may examine:

• mobile phones;
• computers;
• hard drives;
• CCTV systems;
• audio recordings;
• video files;
• metadata;
• deleted files;
• database records;
• system logs.

The expert may determine whether:

• a file was modified;
• two files are identical;
• a recording contains discontinuities;
• deleted data can be recovered;
• metadata is consistent with the alleged circumstances.

However, expert opinion is generally assistance to the court, not an automatic substitute for statutory requirements concerning admissibility.

20. Burden of Establishing Authenticity

The party relying upon digital evidence ordinarily needs to establish the necessary foundation for its admission and reliability.

The opposing party can challenge:

• authenticity;
• source;
• authorship;
• integrity;
• chain of custody;
• completeness;
• statutory compliance.

The court then decides whether the evidence should be admitted and what evidentiary weight should be assigned to it.

21. Authenticity in Employment and HR Disputes

This concept is particularly relevant to employment law.

Examples include:

• employee WhatsApp chats;
• emails concerning termination;
• attendance-system records;
• biometric records;
• CCTV footage;
• HR database entries;
• payroll records;
• electronic approvals;
• workplace audio recordings;
• Teams/Zoom communications;
• digital performance records.

For example, if an employer alleges that an employee approved a transaction electronically, the employer should be able to establish:

employee identity + account/device + timestamp + system record + integrity + method of extraction.

Likewise, if an employee alleges that an HR record was subsequently altered, the employer may need to demonstrate the relevant audit trail and system integrity.

22. Key Principle from the Case Law

The Supreme Court's jurisprudence can broadly be understood through three propositions:

First

Electronic evidence is legally capable of being evidence.

It cannot be rejected merely because it is digital.

Second

Authenticity and reliability matter.

The court must be satisfied that the electronic record is what it is claimed to be and has not been improperly manipulated.

Third

The method of proof matters.

Under the former Evidence Act framework, Anvar and Arjun Panditrao established important rules concerning secondary electronic evidence and the certificate requirement.

23. Conclusion

Authenticity of digital evidence is the process of demonstrating that electronic information is genuine, originates from the claimed source, has not been improperly altered, and can reliably be connected with the facts it is offered to prove.

The strongest authentication normally combines:

Original source + identifiable device/account + preservation + forensic integrity + hash verification + chain of custody + metadata + appropriate certificate/statutory compliance + corroboration.

The most important Indian authorities are Ram Singh, Navjot Sandhu, Anvar P.V., Vikram Singh, Sonu @ Amar, Shafhi Mohammad, Tomaso Bruno and, above all, Arjun Panditrao Khotkar.

For present-day legal analysis, particular care is necessary because the Bharatiya Sakshya Adhiniyam, 2023 has replaced the Indian Evidence Act, while many leading authorities were decided under the earlier statutory framework. The older Supreme Court cases remain essential for understanding the principles of authentication and electronic evidence, but the applicable statutory provision must be checked according to the date and nature of the proceeding.