Online material found through OSINT is fragile. Posts get deleted, pages change and scam sites vanish, and a screenshot on its own is often not enough in an Indian court. To preserve OSINT as evidence, investigators and legal teams typically work on four layers: capture the content and its context promptly, document who captured it with what tool and when, protect the files with hash values and a custody record, and certify the record under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (BSA), with corroboration where possible. This guide explains each layer in practical terms.
Key Takeaways
- Online content is precarious, so capture comes before analysis
- A screenshot is a copy, and a copy of a copy is weaker still
- In a ruling reported by Verdictum in September 2026, the Madras High Court set aside a conviction where the proof of social media posts rested on photocopied screenshots without a certificate
- Section 63 BSA requires a certificate in a prescribed format, with a hash value, for electronic records produced in court
- Capture the page, its source, its URL, the time and the context, not only what is visible
- Keep an untouched original capture and work only on copies
- A short capture log makes the work repeatable and explainable
- Corroboration, such as a platform record or an independent capture, strengthens what a certificate proves
- Collect what is relevant to the case, and no more
Why OSINT evidence is fragile
The UN’s Berkeley Protocol on Digital Open Source Investigations (published by the Office of the United Nations High Commissioner for Human Rights with the University of California, Berkeley, 2020) is direct about this. It notes that platforms may remove content that breaks their rules, and that users may delete or edit their posts. Unless investigators capture the material or a timely preservation request is made, it “may be lost forever”. The Protocol also says digital material can be decontextualised, erased or corrupted, and that it needs to be actively preserved in both the short and long term.
Courts then ask a second question: can anyone show that what is produced is what was online? For that, the Protocol says, prosecutors and counsel typically have to establish authenticity and chain of custody, and preserving material in a way that documents both increases the chance it will be admitted.
What the law asks of electronic records
The BSA gives electronic records the same legal effect as other documents, but ties their proof to Section 63. Our guide to the Section 63 BSA certificate covers this in full. The parts that matter most for online material are:
| Provision | In brief | Why it matters for OSINT |
|---|---|---|
| Section 61 | An electronic record is not denied admissibility only because it is electronic | Online material can be admitted |
| Section 62 | The contents of electronic records are proved under Section 63 | The certificate route is the standard way to prove them |
| Section 63(4) | A certificate in the prescribed format accompanies the record each time it is submitted. Part A is by the person in charge of the device or activities, and Part B by an expert. Both state the hash value | Plan the hash and the signers before filing, not after |
| Section 63(3) | Where several computers or devices did the job, including networked, cloud-based or through an intermediary, they are treated as a single device for the section | Helps in describing how online content reached the capturing device |
| Section 57, Explanation 5 | An electronic record produced from proper custody is primary evidence unless it is disputed | Custody records matter when the record is challenged |
| Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) | Under the old law, the Supreme Court held the Section 65B certificate was a condition precedent for secondary electronic evidence | Still widely relied on in discussing certificates |
| Pune Bar Association v. Union of India (22 May 2026) | The Supreme Court upheld the hash and expert requirements and widened who can sign Part B, if the court is satisfied on unimpeachable material. It also noted that AI and deepfake technology add to the challenge of proving authenticity | Authenticity of online content is under closer scrutiny |
A recent illustration: screenshots without a certificate
In H. Raja v. State (Madras High Court, single judge, Justice V. Lakshminarayanan), reported by Verdictum on 2 September 2026, the Court treated social media posts as electronic records. It held that photocopies of screenshots of Facebook and Twitter posts, taken from news websites, cannot be treated as primary evidence. Relying on Arjun Panditrao, it held that a certificate is a mandatory precondition for admitting secondary digital evidence. The prosecution had not produced the original devices or a certificate, and the Court described the photocopied screenshot as a copy of a copy and said the chain of custody was broken unless the live URLs were produced. The conviction was set aside.
This was reported under the old Section 65B framework, and the report does not mention Section 63 of the BSA. Even so, the practical lesson carries over: a screenshot, by itself, is a weak foundation.
An open question worth raising with counsel
For a record that sits on a third party’s server, such as a social media platform, it is not always obvious who should sign Part A, since the investigator does not control that server. Many teams certify their own capture process, and for key items seek records from the platform through lawful process. How courts treat these arrangements is still developing, so this is a point to settle with legal advisers early.
What to capture
A screenshot shows what the screen looked like. A good capture also records what a court may later ask about.
| Item | Why it matters |
|---|---|
| Full-page capture, not only the visible part | Shows what was on the page and what was not |
| Page source or an archive of the page (for example a web archive file) | Preserves content that a screenshot cannot show, such as links and hidden text |
| Full URL, including parameters | Lets anyone find the same page |
| Date and time in IST, and the source of the clock | Establishes when the capture was made |
| Account identifiers, such as the profile URL and the account ID, not only the display name | Display names change and can be copied |
| Visible context: replies, comments, reactions, timestamps | Prevents a post being presented without its surrounding conversation |
| Media files in their original format | Images and videos carry more information than their on-screen preview |
| Screen recording for dynamic content | Captures scrolling, video, stories and live elements |
| How the page was reached | Shows the path and avoids claims of a doctored link |
| Tool name and version, device, browser, network | Allows the process to be repeated |
| Hash value of each saved file | Ties the saved file to the certificate |
The Berkeley Protocol also asks that the steps from identification to reporting be documented consistently and clearly, including the tools used, and says automated processes must be explainable in court. It favours itemised, manual collection over bulk automated collection, while accepting that bulk collection may sometimes be appropriate, and it stresses that security measures should be in place before online work begins.
A practical workflow
These are commonly followed practices. Departmental procedures and legal advice come first.
1. Decide what to preserve
Prioritise what is relevant to the case and at risk of disappearing. The Berkeley Protocol pairs preservation with data minimisation: collect what is relevant, and avoid over-collection without under-collecting.
2. Prepare the capture environment
Use a dedicated, secured and logged device or environment, set up before work begins. Keep it separate from personal accounts and from the systems where case files are stored.
3. Capture promptly and in more than one way
Combine a full-page screenshot, a saved copy of the page or its source, downloaded media, and a screen recording where the content moves. If something is likely to be removed soon, capture first and analyse later.
4. Hash and store the originals
Calculate a hash value of each file straight after capture. The Schedule to the BSA lists SHA1, SHA256, MD5 or another legally acceptable standard, and SHA-256 is the safer choice, since MD5 and SHA-1 have known collision weaknesses. The Council of Europe’s electronic evidence SOP says MD5 and SHA-1 should never be used exclusively. Store the original captures read-only and do the analysis on copies.
5. Keep a capture log
Record the case reference, what was captured, the URL, date and time, the person who captured it, the tool, the hash and where the file is stored. A one-page log completed at the time of capture is far better than a reconstruction later. A template is below.
6. Verify and corroborate
Re-check the live page where possible and note any change. Capture again at a later time to show persistence. Look for independent confirmation, such as the same post on another platform, a cached copy, a witness or the platform’s own records obtained through lawful process.
7. Certify
Prepare the Section 63 certificate. Part A describes the source and handling, and Part B is signed by an expert. Both carry the hash and the algorithm, and the hash in the certificate should be copied from the tool’s report so that it matches the file produced. See the Section 63 BSA certificate guide for the fields and the Pune Bar Association position on who can sign Part B.
8. Maintain custody and hand over
Record each transfer of the files, who held them, when and why. Where the evidence forms part of a police report involving electronic devices, Section 193(3) of the Bharatiya Nagarik Suraksha Sanhita, 2023 calls for a statement of the sequence of custody. Our guide to chain of custody for digital evidence under BNSS covers the register in detail.
9. Be ready to explain
The person who captured the material may be asked how, with what and when. A clear log and a repeatable method make that straightforward.
A simple OSINT capture log
| Field | Example entry |
|---|---|
| Case reference | FIR or internal case number |
| Item number | OSINT-001 |
| What was captured | Public post by account X, with replies |
| Full URL | As copied from the browser |
| Account identifiers | Profile URL and account ID |
| Date and time of capture (IST) | DD/MM/YYYY, 24-hour time |
| Clock source | Network time or official time reference |
| Captured by | Name and role |
| Device, browser, network | Description |
| Tool and version | Name and version |
| Files created | Screenshot, page source, media, screen recording |
| Hash value and algorithm, per file | Copied from the tool’s report |
| Storage location | Path or exhibit reference |
| Re-check | Date, time and what was seen |
| Notes | Anything unusual, such as page changes or errors |
Special types of online content
| Content type | Preservation points |
|---|---|
| Public social media posts | Capture the post with replies, account ID and timestamps. Save media in original format |
| Edited or deleted posts | Capture before the change where possible, and note the edit history if shown. A timely preservation request through lawful channels is another route the Berkeley Protocol points to |
| Videos, stories and live streams | Screen record, and also save the original media where the platform allows it |
| Websites and scam pages | Capture quickly, as they often disappear. |
| Images | Keep the original file. Platforms often strip metadata, so treat reverse image search results as leads and not proof |
| Public channels and groups | Capture only publicly accessible content, within lawful limits. |
| Third-party web archives | They can help show how a page looked earlier, but how courts treat them can vary, and I did not verify Indian authority. Use them as corroboration and always make your own capture |
What screenshots can and cannot do
Screenshots are useful as a quick record and as a visual exhibit. Their weaknesses are well known.
- They are easy to edit, and an opposing party may suggest this
- They show only what was on screen, not the source or hidden data
- They do not carry a hash or a custody trail unless you add one
- A printout of a screenshot is a further step removed from the original
A sensible approach is “screenshot plus”: the screenshot together with the saved page or source, the media files, the URL, the log, the hash values and the certificate.
Challenges to expect
| Challenge | How teams commonly respond |
|---|---|
| “This was edited” or “this is a deepfake” | Original files, hash values, independent copies and corroboration from platform records or other sources |
| “No one can say who captured it” | A named capturer, a log and a repeatable method |
| “The page has changed since” | Capture time stated clearly, later re-captures, and archives where available |
| “The account is not the accused’s” | Attribution is a separate question. OSINT shows what was posted, and other records such as subscriber and platform data connect it to a person |
| “The collection was unlawful” | Collect only from lawful, public sources, and document the basis |
| “Context was removed” | Capture replies, surrounding posts and the account’s wider activity where relevant |
Common mistakes
| Mistake | Fix |
|---|---|
| Relying on a screenshot alone | Combine it with the page source, media, log and hash |
| Capturing only what is visible | Capture the full page and its context |
| Working on the original capture | Keep the original read-only and analyse a copy |
| No time source recorded | Record the clock reference with every capture |
| Hash calculated after editing or converting | Hash the exact file produced, straight after capture |
| Hash in Part A differs from Part B | Copy it once from the tool’s report |
| Capturing everything | Collect what is relevant to the case |
| Using a personal account or device | Use an authorised, secured, logged setup |
| Leaving certification to the last minute | Plan the signers and the hash at the time of capture |
| Treating a web archive as the only copy | Make your own capture as well |
For banks, fintechs and enterprises
Organisations also preserve online material for brand impersonation, fraud, defamation and intellectual property matters, and may later hand it to an agency or produce it in court. A written procedure for capture, hashing, storage and certification, agreed with the legal team, and a decision in advance on who signs Part A, saves time when a case arises.
Where tools help
Tools can help with collection, structured logging and consistent exports, but they do not make material admissible on their own. When evaluating any platform for evidence work, ask whether it keeps the original capture alongside any translation or summary, records when and by whom each capture was made, produces and verifies hash values, keeps an access log, and exports a record that a certificate signer can rely on.
Frequently Asked Questions
1. Can a screenshot be used as evidence in an Indian court?
A screenshot can be produced as an electronic record, but it needs to be proved. Under the BSA, that means the Section 63 certificate. In a ruling reported in September 2026, the Madras High Court set aside a conviction where photocopies of screenshots of social media posts were relied on without a certificate. A screenshot is best supported by the saved page, the URL, a log, hash values and a certificate.
2. Is a Section 63 BSA certificate needed for OSINT material?
Electronic records produced in court are proved through the Section 63 certificate, which has two parts and carries the hash value. Our Section 63 guide explains the format. Prepare it as the default for any record you intend to rely on.
3. How should a social media post be preserved?
Capture the full page with replies, account identifiers and timestamps, save the page source or an archive, download original media, record the URL, date and time, calculate hash values, log everything, and keep the original files untouched.
4. What if the post is deleted before capture?
Preserve whatever exists, such as cached copies or other people’s captures, and consider a preservation request to the platform through lawful channels. The Berkeley Protocol notes that content can be lost forever unless it is captured or a timely preservation request is made. Corroboration then matters more.
5. Who should capture OSINT evidence?
A trained person using an authorised, secured and logged setup, who is able to explain the method later. Departmental procedures decide the details.
6. Who signs Part A for content on a third party’s platform?
This is not straightforward, because the platform’s server is not in the investigator’s control. Many teams certify their own capture process and seek platform records for key items through lawful process. Legal advice is recommended on how to approach this in a particular case.
7. Is the Wayback Machine or another web archive accepted by Indian courts?
I could not verify Indian authority on this. Archives can help show how a page looked earlier, but they are best used as corroboration, alongside your own captures.
8. How do we deal with deepfakes and edited content?
Keep original files, record hash values, look for independent copies and corroboration, and document how the material was obtained. The Supreme Court in the Pune Bar Association order noted that AI and deepfake technology add to the challenge of proving authenticity.
Disclaimer: This article is for general information and is not legal advice. Laws and court decisions change. Confirm the current position with qualified counsel before relying on it in a specific matter.
