Chain of custody for digital evidence is the written record of who held a device or file, when, where, and why, and what was done to it, from the moment of seizure until it is produced in court. The Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), calls this the “sequence of custody” and builds it into the law in three places: audio-video recording of search and seizure (Section 105), reporting the seizure to the Magistrate (Section 106), and the police report itself, which must state the sequence of custody for electronic devices (Section 193). The Bharatiya Sakshya Adhiniyam, 2023 (BSA) then tests the result through the Section 63 certificate and its hash value.
Key Takeaways
- The BNSS uses the term “sequence of custody” and requires it in the police report for electronic devices
- Section 105 requires search and seizure to be recorded on audio-video, preferably by mobile phone, and sent to a Magistrate without delay
- Section 106 requires the seizure to be reported to the Magistrate
- Section 176(3) adds a forensic expert visit and videography for offences punishable with seven years or more, from a date each State notifies
- A hash value taken at extraction ties the chain to the BSA Section 63 certificate
- The Supreme Court’s 2025 directions on a Chain of Custody Register concern DNA evidence, but the discipline applies just as well to devices
- A one-page register, filled at every handover, closes most of the gaps
What “chain of custody” means
Think of a seized phone as a witness that cannot speak. Its evidence is only as good as your ability to show that nobody changed it between the crime scene and the courtroom. The chain of custody is the paper trail that shows this.
The Supreme Court described the idea in Prakash Nishad v. State of Maharashtra (2023), referring to guidelines of the Ministry of Home Affairs. The core of it: from the time an item is taken until its role in the case ends, every person who handled it is recorded so that its integrity is not in doubt. The guidelines were about biological samples, but the logic carries over to devices and files, which are even easier to alter without leaving a visible mark.
Digital evidence adds risks that physical evidence does not have:
- Data can be wiped remotely if the device stays connected to a network
- Files can change simply by switching a device on
- A copy can look identical to the original but differ in ways only a hash value will reveal
- Cloud and platform data is held by a third party, so custody starts with someone else
What the BNSS requires
The BNSS does not have one section titled “chain of custody.” It spreads the duty across the steps of an investigation. The table below uses the gazetted text.
| Provision | What it says | What it means for digital evidence |
|---|---|---|
| Section 94(1) | A Court, or an officer in charge of a police station, can require production of a document, electronic communication including communication devices likely to contain digital evidence, or other thing, by written order in physical or electronic form | Keep the order with the case file. It is the first document in the chain when a device or record is held by someone else |
| Section 103(4) to (6) | Before a search under that Chapter, two or more independent and respectable inhabitants are called as witnesses. A list of things seized is signed by them, and a copy goes to the occupant | The seizure list is the first entry in your register |
| Section 105 | The search or taking possession of property, including preparing the seizure list and its signing by witnesses, is to be recorded through audio-video electronic means, preferably mobile phone, and forwarded without delay to the District Magistrate, Sub-divisional Magistrate or Judicial Magistrate of the first class | The recording is itself an electronic record. Hash it and certify it under Section 63 BSA |
| Section 106 | A police officer may seize property alleged or suspected to be stolen, or found in circumstances that create suspicion of an offence. The seizure is to be reported forthwith to the Magistrate. Where property cannot conveniently be transported, custody may be given on a bond to produce it | Report every device seizure. Note that the section says “property” and does not name digital devices |
| Section 176(3) | For offences punishable with seven years or more, the officer in charge must cause a forensic expert to visit the scene and cause videography of the collection, from a date notified by the State Government within five years. Where a State lacks the forensic facility, it is to notify the use of another State’s facility | Confirm your State’s notification. Where it applies, expert collection is part of the chain |
| Section 185 | A search by a police officer is to be recorded through audio-video electronic means, preferably by mobile phone. The Press Information Bureau describes copies going to the Magistrate within 48 hours | Same discipline as Section 105 for searches under this section |
| Section 193(3) | The police report must state, among other things, “the sequence of custody in case of electronic device.” | The custody record must be complete enough to be summarised in the charge-sheet |
A note on Section 106: Some commentary describes it as expressly covering digital assets and electronic devices. The gazetted text uses the word “property” and does not single out devices. Section 94 is the provision that names communication devices. If your team is drafting seizure memos, ask your legal advisers how your State prosecution treats this.
Why the chain matters in court
Custody records support the evidence at three points.
The Section 63 certificate
Under the BSA, a computer output is proved through a certificate in two parts, and both parts carry the hash value. If the hash in the certificate does not match the file produced, the chain has a problem. Our guide to the Section 63 BSA certificate covers the format, and the Supreme Court’s May 2026 order in Pune Bar Association v. Union of India explains who can sign Part B.
The “proper custody” rule
Section 57, Explanation 5 of the BSA says an electronic or digital record produced from proper custody is primary evidence unless it is disputed. The record of custody is how you show it was proper.
The reliability of the case as a whole
In Kattavellai @ Devakar v. State of Tamil Nadu (2025 INSC 845, decided 15 July 2025), the Supreme Court acquitted an accused who had been sentenced to death. Among other lapses, it found that the chain of custody of the DNA samples could not be established. It then issued nationwide directions: samples to be documented and packaged, delivered to the forensic laboratory within 48 hours (or the reason for delay recorded in the case diary), not to be opened or resealed without the trial court’s authorisation, and a Chain of Custody Register to be maintained from collection until conviction or acquittal and appended to the trial court record. These directions are about DNA. Nothing in them is a rule for phones. But they show what the Court expects to see when an item of scientific evidence is questioned, and the same habit protects digital evidence.
Courts have also held that a defect in an investigation is not by itself a ground for acquittal, as the Supreme Court did in C. Muniappan v. State of Tamil Nadu ((2010) 9 SCC 567). The practical question is always what a gap does to the reliability of the evidence that remains. A clean register keeps that question from being asked.
The chain, link by link
The steps below follow a device from seizure to court. Each is tagged as Law (a statutory duty), SOP (a published government procedure) or Good practice (widely recommended, not mandated).
Before the seizure
- Confirm your authority: warrant, written order under Section 94, consent, or the power under Section 106. (Law)
- Line up independent witnesses for the search and the seizure list. (Law)
- Bring the right kit: labels, seals, paper or cardboard packaging, Faraday bags, camera or phone for recording, and a blank register. (Good practice)
At the scene
- Start the audio-video recording before touching any device, and keep it running through the seizure list and witness signatures. (Law, Section 105)
- Record the state of each device: on or off, screen contents, connected cables and networks, visible damage. Photograph it as found. (Good practice)
- If a device is off, do not turn it on. If it is on, it’s recommended to place it in flight mode, and if it is locked with an unknown code, isolating it in a Faraday bag. Any network connection, even a few seconds, can allow remote deletion. (Good practice)
- Note the IMEI, SIM and memory card details, and identify and seize the charger and cables. (Good practice)
- Do not browse or search a seized device yourself unless you are trained and authorised to do so. Bring in a forensic examiner. (Good practice)
Label and seal
- Attach an exhibit label to every item. The exhibit name, device description, make, model and serial number, place, date and time of seizure, name of the person seizing, name of the witness, case number, and space for every later handler. (Good practice)
- Package devices separately from other items. (Good practice)
- Follow the seal discipline in the BPR&D SOP: the person who applies the seal and the person who opens it should both know its characteristics, recorded with signatures in the chain of custody form. (SOP)
Report and forward
- Report the seizure to the Magistrate. (Law, Section 106)
- Forward the recording to the Magistrate without delay. (Law, Section 105)
- Where a State has notified under Section 176(3), make sure the forensic expert and the videography of collection are on file. (Law)
Transport and storage
- Log every handover in the register: who gave, who received, date and time, reason, and condition of the seal. (SOP: the BPR&D SOP asks for a clear written record of the sequence of custody for each package until it reaches the Magistrate or the forensic laboratory.)
- Keep devices away from magnetic sources, moisture and heavy vibration. Log the storage location. (Good practice)
- Watch the battery.
Forensic imaging
- Before opening, photograph the bag, the label and the seal, and check they are intact. (Good practice)
- Use a write blocker for storage media. Mobile devices generally cannot be accessed through a write blocker, so record the reason whenever one is not used. (Good practice)
- Make a bit-for-bit image, calculate the hash of the source and of the image, and check that they match. Work on the image, not the original. (Good practice)
- Record the tools, versions, date, time and operator. Also record the device’s own clock against the real time. (Good practice)
Analysis
- Re-check the hash before starting analysis. (Good practice)
- Write the report so a third party can repeat the steps and reach the same results. (Good practice)
- Reseal the original with a new seal number, and log the reseal in the register. (Good practice)
Certification
- Part A is prepared by the person in charge of the device or record, and Part B by an expert, both stating the hash value and algorithm. (Law, Section 63(4) BSA)
- Make sure the hash in the certificate is copied from the tool’s report and matches the file being produced. (Good practice)
The police report
- Summarise the sequence of custody for each electronic device in the report under Section 193(3). The register makes this a copy exercise instead of a memory exercise. (Law)
In court
- Produce the record with the certificate each time it is submitted. (Law, Section 63(4) BSA)
- Keep the sealed original under custody until the court orders otherwise. (Good practice)
What a chain of custody register should hold
The BNSS does not prescribe one format. Some States may issue their own. The fields below combine what the Supreme Court listed for DNA evidence with the exhibit label fields from the Council of Europe SOP, adapted for digital items.
| Field | What to record |
|---|---|
| Case details | FIR number and date, sections, police station, name of investigating officer |
| Exhibit reference | Unique exhibit number, sub-exhibit numbers for storage media removed from a device |
| Description | Type, make, model, serial number, IMEI or other identifier, visible damage |
| State when seized | On or off, locked or unlocked, connected or isolated, photo reference |
| Seizure | Place, date, time (IST), name of the person seizing, names of independent witnesses |
| Authority | Warrant, order under Section 94, consent, or Section 106 reference |
| Packaging | Bag type (paper, Faraday), seal number, seal photo |
| Each handover | From, to, date, time, purpose, condition of seal, signature of both |
| Storage | Location, access controls, dates in and out |
| Imaging | Tool and version, operator, start and end time, source hash, image hash, algorithm |
| Certificates | Part A signer and date, Part B signer and date, hash report reference |
| Court | Date produced, Magistrate or court, any order on opening, resealing or disposal |
The role of technology: eSakshya
The National Informatics Centre’s eSakshya app is built for the recording side of this. According to NIC, police can record the scene, including search and seizure, from a mobile phone. Each recording can run up to four minutes, and multiple recordings can be uploaded for each FIR to a cloud platform, along with a selfie for authenticity. If connectivity is poor, recordings can be made on personal devices and uploaded later.
Common gaps and how to close them
These are process gaps, and most can be closed with a template and a checklist.
| Gap | Why it causes trouble | Fix |
|---|---|---|
| Device switched on or searched by hand before imaging | Data on the device changes | Isolate the device and call the forensic examiner |
| No recording of the seizure | Section 105 expects one, and the seizure list loses support | Start recording before touching anything |
| Seizure not reported to the Magistrate | Section 106 expects a report | Add it to the day-of-seizure checklist |
| Label and register entries missing for a handover | The gap has to be explained later | Make the register a one-page form that travels with the item |
| Original opened for analysis without a check | Seal integrity cannot be shown | Photograph bag, label and seal before opening |
| Hash taken from a converted or re-saved copy | It will not match the file produced | Hash the exact file, and log the tool |
| Hash in Part A differs from Part B | It suggests two different files | Copy from the tool’s report, once |
| Sequence of custody left out of the police report | Section 193(3) expects it | Prepare the summary from the register |
| Clock on the device never compared with real time | Timestamps become disputable | Record both at the time of examination |
Where analysis tools fit
Custody does not end when an image is made. Once evidence data goes into an analysis platform, the same questions apply: which copy is being worked on, who has accessed it, and can anyone show the data was not changed. When you evaluate any platform, ask whether it verifies hash values on import, works from a copy of the source image, keeps a user-level access log, and can export that log.
Argus, Innefu’s forensic analytics toolkit, works on data extracted by commercial forensic tools. It brings output from multiple devices into one repository, correlates common contacts, locations, applications and groups across suspects’ phones, and prepares plain-language reports for court use. It sits downstream of extraction and does not replace the register, the seals or the Section 63 certificate. Those stay with the people who seized, imaged and examined the device.
Frequently Asked Questions
1. What is chain of custody for digital evidence?
It is the written record of every person who held a device or file, when and why, and what was done to it, from seizure to court. The BNSS calls it the “sequence of custody”.
2. Is chain of custody mandatory under the BNSS?
The BNSS does not use the phrase as a stand-alone duty. It requires audio-video recording of search and seizure (Section 105), reporting the seizure to the Magistrate (Section 106), and a statement of the sequence of custody for electronic devices in the police report (Section 193(3)).
3. What does “sequence of custody” in Section 193 mean?
Commentary by a former Kerala High Court judge, published by LiveLaw, reads it as the chain of custody. It is a required item in the police report for cases involving electronic devices.
4. Do I need a Chain of Custody Register for digital evidence?
The Supreme Court’s 2025 direction in Kattavellai requires a register for DNA samples. For digital evidence no equivalent direction was found in the sources reviewed, but keeping a register is the simplest way to meet the Section 193(3) requirement and to support the Section 63 certificate.
5. Should a seized phone be switched off?
Not if it is on. The Council of Europe SOP says that if a phone is on, keep it on and put it in flight mode, and isolate a locked phone in a Faraday bag. If it is off, do not turn it on.
6. Which hash algorithm should be used?
The Schedule to the BSA lists SHA1, SHA256, MD5 or another legally acceptable standard. SHA-256 is the safer choice.
7. What happens if there is a gap in the chain?
It depends on the case. In Kattavellai, a broken chain of custody for DNA was among the reasons the Supreme Court found the evidence unreliable. Courts also weigh the remaining evidence, so a gap does not automatically end a case, but it is easier to avoid than to explain.
8. Does Section 176(3) apply in every State?
The duty runs from a date notified by each State Government within five years of 1 July 2024. Goa, for example, notified in February 2025. Check your State gazette.
This article is for general information and is not legal advice. Laws, State notifications and court decisions change. Confirm the current position with qualified counsel before relying on it in a specific matter.
