DIGITAL EVIDENCE & DOCUMENTATION

Preserve the Evidence. Document the Incident. Support the Investigation.

Digital evidence plays an important role in understanding and investigating cybercrime.

Messages, emails, screenshots, transaction records, social media profiles, website links and digital files may help establish what happened during a cyber incident.

Whether you are dealing with online financial fraud, account hacking, cyberstalking, blackmail, identity theft or unauthorised access, preserving relevant information can be important.

Indian Cyber Squad (ICS) provides educational guidance to help individuals, families and organisations understand digital evidence, document cyber incidents and prepare relevant information for official reporting.

PRESERVE DIGITAL EVIDENCE. DOCUMENT EVERY DETAIL. ACT RESPONSIBLY.

[EXPLORE DIGITAL EVIDENCE GUIDES]

[REPORT CYBERCRIME]

1. WHAT IS DIGITAL EVIDENCE?

Digital evidence refers to information stored, transmitted or created using electronic devices and digital systems that may be relevant to an incident or investigation.

It can help establish:

What happened during an incident.
When the incident occurred.
Which accounts, devices or platforms were involved.
How communication or transactions took place.
What information or systems may have been affected.

COMMON TYPES OF DIGITAL EVIDENCE

Screenshots: Images of messages, suspicious profiles, payment confirmations, threats and online activity.

Emails: Email messages, sender information, timestamps and relevant email headers.

Chat Records: WhatsApp conversations, SMS messages and other communication records.

Financial Records: Transaction IDs, UTR numbers, bank alerts and payment receipts.

Website Information: URLs, domain names, suspicious web pages and relevant online content.

Device Information: Relevant files, logs, application activity and system records.

Social Media Information: Usernames, profile links, posts, comments and account activity.

Not every digital record is automatically admissible or sufficient as legal evidence. Its relevance, authenticity, collection method and applicable legal requirements may matter.

2. HOW TO PRESERVE DIGITAL EVIDENCE

If you become a victim of cybercrime, preserving relevant information can help when reporting the incident.

STEP 1 – DO NOT DELETE RELEVANT INFORMATION: Avoid deleting messages, emails, transaction records, call logs or suspicious links that may be connected to the incident.

STEP 2 – TAKE SCREENSHOTS

Capture relevant information such as:

Threatening messages.
Fraudulent payment requests.
Suspicious social media profiles.
Unauthorised transactions.
Fake websites and advertisements.
Relevant error or security notifications.

Where possible, include the date, time, sender or account information.

STEP 3 – SAVE ORIGINAL RECORDS: Keep original emails, messages, transaction receipts and other available digital records.

Avoid editing, cropping or modifying the only copy of an important screenshot or file.

STEP 4 – RECORD IMPORTANT DETAILS

Write down:

Date and time of the incident.
Platform or application involved.
Mobile numbers and email addresses.
Usernames and profile URLs.
Transaction IDs and amounts, if applicable.
A brief description of what happened.

STEP 5 – KEEP A BACKUP: Store copies of relevant records securely. Use a trusted storage location with appropriate access protection.

STEP 6 – REPORT THE INCIDENT: Submit your complaint through the appropriate official reporting channel and provide relevant information when requested.

IMPORTANT: Do not delay urgent financial fraud reporting while collecting evidence. Call 1930 immediately if money has been lost through financial cyber fraud.

3. HOW TO PRESERVE SCREENSHOTS AND MESSAGES

Screenshots can help document online activity, but they should be captured carefully.

BEST PRACTICES

Capture the complete relevant conversation where possible.
Include the sender's name, username or phone number.
Retain visible dates and timestamps.
Capture the original profile or webpage URL.
Take additional screenshots if a conversation spans multiple screens.
Keep the original files without editing them.
Record when and how the screenshot was obtained.

WHAT TO AVOID

Editing screenshots to change their meaning.
Deleting the original conversation.
Forwarding sensitive material unnecessarily.
Publishing private conversations on social media.
Adding annotations to the only original copy.

Remember: A screenshot alone may not establish the authenticity or full context of an incident. Preserve original records wherever possible.

4. HOW TO PRESERVE WHATSAPP CONVERSATIONS

WhatsApp conversations may contain important information relating to fraud, threats, impersonation or harassment.

WHAT YOU SHOULD PRESERVE

Relevant chat messages.
Sender's phone number.
Date and time of messages.
Suspicious links.
Payment requests.
Relevant photographs or documents, where lawful and appropriate.
Relevant call information.

GENERAL PRESERVATION STEPS

Open the relevant WhatsApp conversation.
Identify the messages related to the incident.
Capture screenshots showing the relevant context.
Use WhatsApp's official chat export facility where appropriate.
Store the exported records securely.
Keep the original conversation on the device where possible.

If a conversation contains sensitive material involving a child, do not download, copy or forward illegal sexual content. Report it through the appropriate official channels.

OFFICIAL RESOURCE: https://faq.whatsapp.com/

5. HOW TO PRESERVE EMAIL EVIDENCE

Emails can contain important information about phishing, account compromise, financial fraud and impersonation.

INFORMATION TO KEEP

Original email.
Sender's email address.
Recipient information.
Date and time received.
Subject line.
Suspicious links or attachments.
Email headers, where available.

WHY EMAIL HEADERS MATTER

Email headers contain technical information about how an email was transmitted, including routing details and authentication information.

They may assist technical analysis, although they do not independently prove who personally sent an email.

IMPORTANT PRECAUTIONS

Do not click suspicious links.
Do not download unknown attachments.
Preserve the original email.
Avoid forwarding suspicious emails unnecessarily.
Use the email provider's official reporting options for phishing or abuse.

6. HOW TO DOCUMENT FINANCIAL CYBER FRAUD

Financial cyber fraud cases may involve multiple transactions, payment applications, bank accounts and communication channels.

Organising transaction information can help when reporting the incident.

INFORMATION TO RECORD

Date and time of each transaction.
Amount transferred or deducted.
Transaction ID or UTR number.
Payment method used.
Bank or payment application involved.
Relevant beneficiary details, if available.
Bank SMS notifications.
Fraudster's phone number or communication details.
Bank complaint reference number.
Cybercrime complaint acknowledgement number.

MAINTAIN A TRANSACTION RECORD

Prepare a simple chronological record of transactions.

Date and time Amount Transaction ID Payment method like upi/ card/ bank

Do not publish account numbers, card details, OTPs, PINs or other confidential financial information.

URGENT: If you have lost money through financial cyber fraud, call 1930 immediately and contact your bank.

7. HOW TO PRESERVE SUSPICIOUS URLS AND WEBSITE INFORMATION

Suspicious websites and links may be involved in phishing, fake investment schemes, fraudulent payment requests and identity theft.

WHAT TO RECORD

Complete website URL.
Date and time you accessed it.
Screenshot of the relevant page.
Name or branding used by the website.
Related messages or emails containing the link.
Any payment request associated with the website.

IMPORTANT SAFETY PRECAUTIONS

Do not revisit a suspicious website unnecessarily.
Do not enter passwords or banking information.
Do not download unknown files.
Do not interact with suspicious payment forms.
Do not upload private or confidential information to public URL-analysis services.

A suspicious link can be documented without opening it again.

8. HOW TO MAINTAIN A CYBER INCIDENT RECORD

A chronological incident record can help you organise information before contacting your bank, police or other authorities.

CYBER INCIDENT DOCUMENTATION TEMPLATE

1. Incident Information

Type of incident:
Date and time discovered:
Platform or application involved:
Brief description:

2. Account or Contact Information

Relevant username:
Phone number:
Email address:
Website or profile URL:

3. Financial Information (If Applicable)

Amount involved:
Transaction date:
Transaction ID:
Bank or payment service:

4. Evidence Collected

Screenshots:
Emails:
Chat records:
Transaction receipts:
URLs:
Other relevant files:

5. Reporting Information

Bank complaint reference:
Cybercrime acknowledgement number:
Police station or authority contacted:
Date of reporting:
Follow-up details:

Keep this information secure and share it only with authorised persons or appropriate authorities.

9. DIGITAL EVIDENCE: IMPORTANT LEGAL AND SAFETY CONSIDERATIONS

Digital evidence may be relevant to legal proceedings and official investigations.

However, collecting and preserving digital information must be done responsibly.

FOLLOW THESE PRINCIPLES

Preserve original digital records wherever possible.
Do not alter or fabricate evidence.
Do not access another person's device or account without authorisation.
Do not attempt to hack a suspected person's account.
Do not publicly disclose sensitive personal information.
Maintain a record of how and when evidence was collected.
Share relevant material through appropriate official channels.

ELECTRONIC RECORDS AND INDIAN LAW

Electronic and digital records are recognised under Indian law.

The Bharatiya Sakshya Adhiniyam, 2023 contains provisions relating to electronic and digital records, including requirements concerning their admissibility and proof.

For formal investigations or court proceedings, consult a qualified legal professional or the investigating authority regarding applicable evidence requirements and certification.

10. OFFICIAL CYBERCRIME REPORTING RESOURCES

National Cyber Crime Reporting Portal
https://cybercrime.gov.in/

National Cyber Financial Fraud Helpline
1930

Emergency Response Support System
112

For serious incidents, contact the appropriate police authorities or cybercrime police station.

FREQUENTLY ASKED QUESTIONS

Q1. What is digital evidence in cybercrime?

Digital evidence is electronic information that may be relevant to understanding or investigating a cyber incident, such as emails, screenshots, messages, transaction records and digital files.

Q2. Are screenshots enough to prove cybercrime?

Screenshots may be useful, but additional original records, account information, technical details and other evidence may be required. The relevance and authenticity of the evidence matter.

Q3. Should I delete messages after taking screenshots?

No. Keep the original messages wherever possible. Screenshots should supplement original records, not replace them.

Q4. Can WhatsApp chats be used as evidence?

Electronic chat records may be relevant, depending on the circumstances and applicable legal requirements. Preserve original records and seek appropriate legal guidance when necessary.

Q5. Should I open a suspicious link to collect evidence?

No. You can record the link from the message or email without opening it. Avoid exposing your device or personal information to additional risk.

Q6. What should I do if my phone is hacked?

Use a trusted device to secure important accounts, preserve relevant information where safe, contact affected service providers and report the incident through appropriate channels.

Q7. Can I investigate a suspected cybercriminal myself?

Do not attempt unauthorised access, hacking, surveillance or retaliation. Preserve relevant information and report it to the appropriate authorities.

PRESERVE INFORMATION. SUPPORT CYBER SAFETY.

Digital evidence can be important when responding to cybercrime. Understanding how to document incidents responsibly can help individuals and organisations take informed action.

Indian Cyber Squad encourages everyone to preserve relevant information, protect personal data and report cyber incidents through appropriate official channels.

DOCUMENT RESPONSIBLY. REPORT PROMPTLY. STAY CYBER SAFE.

[EXPLORE CYBER SUPPORT]

[REPORT CYBERCRIME]

[EXPLORE MORE CYBER SAFETY GUIDES]