Cyber Crime Evidence: Screenshots, Chats, Emails and Logs

You finally decide to go to the police. Someone has been blackmailing you on Instagram for two weeks. You have the chats. You have screenshots of the threats. You walk into the cyber cell with a folder of printed pages, hopeful. The officer flips through it, looks up and says, "Madam, all this is fine, but we will need a 65B certificate." You smile and nod, because you do not want to look stupid. On the way home, you wonder what on earth a 65B certificate is, why your printed screenshots are not enough, and whether the harasser will get away because of a piece of paper you have never heard of.

This is the small but decisive crack into which most cyber-crime cases fall. The story is real, the evidence exists, but the way it has been preserved is not the way Indian courts can accept it. This article explains, in clear language, how to capture and preserve digital evidence so that when the moment comes, your screenshots, chats, emails and server logs do exactly what you need them to do — convince a judge.

What This Article Will Answer

• Why is a screenshot, by itself, often not accepted as evidence?
• What is the Section 65B certificate, and who can sign it?
• How do I capture WhatsApp chats, Instagram threats, emails and call logs the right way?
• What does "chain of custody" mean for ordinary people?
• When should I bring in a notary, and when is that overkill?
• What are the most common mistakes that destroy a cyber-crime case?

Why Electronic Evidence Is Treated Differently

An old-fashioned piece of paper has the writer's signature, the original ink, sometimes a stamp. A judge can hold it, smell it, ask a handwriting expert about it. A digital file has none of that. It is a string of zeros and ones that can be copied a thousand times, edited invisibly, and stored on a server in another country. The law had to find a way to trust it.

India's Evidence Act has, for over two decades, recognised that printouts and copies of electronic records can be treated as documents for the purpose of evidence. Our source commentary on documentary evidence puts it like this: documentary evidence includes electronic records — floppies, CDs, DVDs, hard discs, satellite images and tape recordings of conversations have all been treated as documents (R M Malkani v Maharashtra AIR 1973 SC 157; R K Anand v Registrar, Delhi High Court (2009) 8 SCC 106).

The catch is in the manner of proof. Section 65B of the Evidence Act creates a special pathway. Once you walk that pathway, the court will accept your electronic record as a document without the original device having to be dragged into court. If you skip the pathway, even genuine evidence may be set aside as inadmissible. The Supreme Court drove this home in Anvar P V v P K Basheer AIR 2015 SC 180, holding that the special law on electronic records under Section 65B prevails over the general law on secondary evidence.

What Is the Section 65B Certificate, in Plain Words?

A Section 65B certificate is a short signed declaration that travels with your electronic record into court. Its job is to tell the judge four things, all of which our source commentary identifies as the statutory requirements:

1. The electronic record was produced by a computer (or phone, server, camera) that was used regularly during the relevant period to handle that kind of information.
2. That kind of information was regularly fed into the computer in the ordinary course of activities.
3. The computer was operating properly during the relevant period — and where any malfunction occurred, it did not affect the accuracy of the record.
4. The information in the record reproduces, or is derived from, what was fed into the computer.

The certificate is signed by a person occupying a responsible position in relation to the operation of the device or the management of the relevant activities. The Madras High Court in K Ramajayam v The Inspector of Police, T-4 Maduravoyal, 2016 Cr LJ 1542, helpfully clarified that the certificate is not a guarantee of the truth of the contents — it speaks only to the working condition of the machine that produced the record.

For ordinary individuals, this means you can sign a 65B certificate for your own phone, your own laptop, your own email account. For records held on a third-party platform — say WhatsApp servers, Gmail, Instagram, your bank's CCTV — the certificate has to come from a responsible officer of that platform, usually obtained through a police request under Section 91 CrPC / Section 94 BNSS.

The Supreme Court has also acknowledged the unique reliability of certain machine records. In Tomaso Bruno v Uttar Pradesh (2015) 7 SCC 17, the Court observed that CCTV footage, properly produced under Section 65B, can be superior to human testimony because it does not suffer the frailties of human memory.

Screenshots — The Right Way

Most cyber complaints begin and end with screenshots. Yet most screenshots are taken in a way that hurts the case.

The right way is mechanical and boring on purpose. Take full-window captures, not cropped images. The frame must contain the URL bar, the date and time on the device, the contact name or account handle, and the message itself. If the device clock is wrong, fix it before capturing. Use the operating system's native screenshot tool — Print Screen on Windows, Cmd+Shift+3 on Mac, Power+Volume on Android, Side+Volume on iPhone — so the file name carries an automatic timestamp.

Save originals to a separate folder. Do not edit them. Do not paste them into Word or PowerPoint as the only copy. If you need to crop or annotate for clarity, do that on a duplicate, and clearly label it "annotated copy." Hash the original folder if you are technical enough — a SHA-256 hash takes thirty seconds and pre-empts every defence challenge about manipulation.

For long chat threads, scroll capture tools (built into modern phones, or apps like LongShot) can stitch together a continuous image. Combine these with the platform's own export feature wherever it exists.

Saving WhatsApp Chats Without Losing Evidentiary Value

WhatsApp is the single most common venue for cyber harassment, fraud and threats in India. Treat the chat with discipline.

• Do not delete or "clear chat" the offending conversation. Even after you have screenshotted it. The original chat in your installed app is your strongest copy.
• Export the chat with media — open the chat, tap the contact name, scroll to "Export chat", choose "Include media". You will get a .zip file containing a .txt transcript and all images, videos and voice notes.
• Note the contact details — phone number, display name, time zone showing on your device, and the date when you saved the chat.
• Back up to two locations — the original device, plus an external drive or sealed cloud folder. Keep them untouched.
• Prepare a 65B certificate — name yourself as the person responsible for your phone, identify the export file, describe the device, declare that the phone was working normally during the relevant period.

If a counter-party claims the chat is doctored, the police can seek WhatsApp's records under a written order to produce documents (Section 91 CrPC / Section 94 BNSS). Subscriber records and certain technical metadata are usually obtainable; the message contents themselves are end-to-end encrypted and typically not stored on WhatsApp servers.

Emails, Full Headers and Server Logs

Email is, on paper, easier to authenticate than WhatsApp because it carries its own audit trail in the headers. Most users never look at headers. Defence lawyers do.

For evidence purposes, save the email with full headers showing the entire delivery chain — the originating server, every hop, the message ID, the SPF and DKIM results, the sender and reply-to addresses (which are sometimes different in phishing emails). On Gmail, "Show original" gives you this. On Outlook, "View Source" or "Internet headers."

Save both as PDF (for the printed file) and as the original .eml file (for any forensic analysis later). Print on paper for filing alongside the 65B certificate. Where the email contains an attachment that is itself critical evidence — say a forged invoice or a malware file — preserve the attachment separately, hash it, and refer to the hash in your certificate.

For server-side logs — say, login records of a mailbox, or admin logs of an account compromise — those will have to come from the service provider through a police request. The corresponding 65B certificate will be issued by the provider's authorised officer. Plan for time: Indian and foreign providers can take weeks to months to respond.

Chain of Custody — From Phone to Courtroom

"Chain of custody" sounds like a phrase from a Hollywood crime show. In Indian practice, it is unglamorous paperwork. The point is to be able to tell the judge, at any moment, who had the evidence, when, and what they did with it. If there is a gap, the defence walks through it.

Practical chain of custody for individual victims looks like this. Day 1 — incident occurs, screenshots and exports taken on your phone, files copied to a clean folder, hashes generated. Day 2 — folder copied to an external drive, kept in your locker; another copy emailed to yourself or a trusted lawyer for time-stamping. Day 3 — printed copies prepared for the cyber complaint, with a covering note listing every file, its hash, and a draft 65B certificate. Each handover, even if only between you and your lawyer, is logged in a single page log.

If the matter escalates to a forensic examination of the device itself, a sealed handover under panchnama becomes important. Until then, your discipline at home is what holds the evidence together. If the police are reluctant to register your FIR, your clean evidence package is also your strongest argument when you escalate to the senior officer or the magistrate.

Notarisation as an Extra Layer

Notarisation is not statutorily required for electronic records. The 65B certificate alone is the legal mechanism. But where stakes are high — defamation, blackmail, sextortion, large frauds — a notary's affidavit on the same day as capture creates a third-party time-stamp that is very hard to challenge later. The notary does not vouch for the truth of the chats; the notary records that on this date, this person produced these documents and these files. That alone closes off a host of "fabricated later" defences.

Some practitioners also use online time-stamping services or hash-anchoring on public ledgers. These add belt-and-braces protection but are still niche in Indian courts. If your matter is contentious and your evidence is digital-heavy, ask your lawyer whether they want a notary brought in alongside the 65B route.

The Do and Don't List

What Should I Actually Do Now?

1. Do not delete anything. The original chat, post or email on the source device is your master copy.
2. Capture full-window screenshots with URL/contact and timestamp visible.
3. Use the platform's export — WhatsApp "Export chat with media", Gmail "Show original", Instagram data download.
4. Save originals to a clean folder named by date. Generate SHA-256 hashes for the folder.
5. Draft a Section 65B certificate the same day, identifying the device, your responsibility for it, and the proper working state during the relevant period.
6. If the matter is high-stakes, see a notary and have an affidavit recorded the same week.
7. Take a clean printed copy plus the digital files on a labelled USB when you go to the police, your lawyer or the cyber cell.

Evidence That Actually Wins Cases

Cyber-crime victims often imagine that the technology will speak for itself, that "everyone can see what happened." Courts cannot. They can only see what is properly placed before them. The good news is that the standard is not high-tech wizardry — it is discipline. A handful of clean screenshots, a complete chat export, a printed email with full headers, a one-page 65B certificate and a chain-of-custody log will out-perform a folder of three hundred messy images every single time.

If you are preparing to file a cyber complaint or you have just received a notice in a cyber matter and need help putting your electronic evidence in order, our office at Pinaka Legal regularly walks complainants and accused through this exact process — from capture to certificate to courtroom. Whether you engage us or not, give your evidence the seriousness it deserves the very first day. The case you save is your own.

Frequently Asked Questions

Are screenshots accepted as evidence in Indian courts?

Yes, but only when they are produced as electronic records under Section 65B of the Evidence Act and are accompanied by a Section 65B certificate. A bare screenshot pasted into a complaint, without the certificate, is treated as inadmissible secondary electronic evidence by trial courts following Anvar P V v P K Basheer.

What exactly is a Section 65B certificate?

It is a written statement, signed by a person responsible for the device, that explains how the electronic record was produced. It identifies the device, confirms it was working properly during the relevant period, confirms the device was used regularly to handle that kind of information, and that the printout or file accurately reproduces what was on the device.

Can I prepare the Section 65B certificate myself for my own phone?

Yes, if you are the person operating and managing the device. The certificate must be signed by a person occupying a responsible position in relation to the operation of the device or the management of the relevant activities. For your personal phone or laptop, that is you.

Is a WhatsApp chat alone enough or do I need the phone too?

The chat export is the working evidence. The phone is your back-up. Best practice is to export the WhatsApp chat with media as a .txt or .zip file, hash the file, attach a Section 65B certificate, and preserve the phone untouched until trial. If the other side disputes authenticity, the phone may be summoned for forensic checks.

How do I produce email as evidence?

Take the full email — not just the body, but the entire message including all headers, the From, Reply-To, Received chain, message ID and date. Save as PDF or .eml. Print on paper for filing, attach a Section 65B certificate, and keep the original mailbox accessible. Server logs and IP addresses in the headers can independently corroborate the source.

What is chain of custody and why does it matter?

Chain of custody is a written record of who handled the evidence, when and how, from the moment it was collected to the moment it reaches court. Without it, the defence can argue the file was edited or planted in between. For digital evidence, this includes hashes, log of devices used to view the file, and a transfer register if the device changed hands.

Should I get a notary to certify my screenshots?

It is not legally compulsory but is highly recommended for sensitive cases. Notarisation does not replace a Section 65B certificate, but it adds a contemporaneous time-stamp and a third-party witness, which makes later challenges to authenticity much harder. Use both layers when the evidence is critical.

Can deleted WhatsApp messages still be used as evidence?

It depends. If you exported or backed up the chat before deletion, the export can be tendered with a 65B certificate. Once deleted from both devices and the cloud backup, recovery requires forensic extraction by a competent expert and the report has to be tendered through that expert in court.

How do I prove someone sent me a fake or threatening message?

Preserve the message in its original form (do not delete the chat), screenshot the full window with timestamp and contact details, export the chat with media, note the phone number or username, and ask your service provider for relevant logs through the police. The police can issue a written order under Section 91 CrPC / Section 94 BNSS to the platform to produce subscriber and log data.

What is the single biggest mistake victims make with digital evidence?

Editing or cropping screenshots. The moment a screenshot is cropped or pasted into a Word file, the metadata is gone and the defence will argue it was fabricated. Keep originals untouched on the source device, export full-window captures, hash the files, and only then prepare any cleaned-up copies for filing.

For more articles on Indian law, visit the Pinaka Legal Blog.