How to Preserve Screenshots and Digital Evidence Before It Disappears

It is 11:47 at night. You open the same screenshot for the fifth time today — the one where your boss texted you something he should not have. Or the customer who paid you and now claims he didn't. Or the stranger on Instagram who has been threatening your daughter. You took the screenshot. Good. But now a friend has whispered something that has put a knot in your stomach: "Just a screenshot won't work in court, you know. They'll say it's fake." And the chat you screenshotted? It was deleted yesterday from his side. The CCTV at the building? It overwrites every fifteen days. So you sit there, phone in hand, wondering if the one piece of proof you have is already slipping through your fingers.

Take a breath. You are not too late, and you are not powerless. But the next forty-eight hours matter more than the next forty-eight days. This guide is for the person who has seen something on a screen, knows it is going to vanish, and wants to keep it in a way that a real Indian judge will actually look at.

Why Digital Evidence Vanishes So Fast

Paper documents sit in a drawer for decades. Digital evidence is the opposite — it is alive, and it is constantly being eaten by the systems that hold it. Most CCTV recorders overwrite themselves every 7 to 30 days. Bank and mall systems hold longer, sometimes 90 days. WhatsApp lets the other side delete a message for everyone within roughly 48 hours, and a "disappearing message" is gone within 24 hours, period. Instagram and X allow a user to delete a post or DM at any time. Even when your own phone is full and a backup happens, things shift, get compressed, get re-encoded.

The Supreme Court has noticed this fragility. In Anvar P.V. v. P.K. Basheer (AIR 2015 SC 180), the Court warned that electronic records are uniquely "susceptible to tampering, alteration, transposition, excision," and that without proper safeguards, "the whole trial based on proof of electronic records can lead to travesty of justice." That single line is why every system below exists. Courts are not anti-technology. They are simply allergic to evidence that could have been tweaked between the event and the trial.

So speed and cleanliness are everything. The clock starts the moment the thing happens — not the moment you decide to file a complaint.

What Even Counts as Digital Evidence?

Almost everything you can think of. Indian law uses the term "electronic record" very broadly. Floppies, CDs, DVDs, hard discs and satellite images can all be treated as documents, and so can tape recordings of conversations. As courts have repeatedly held, "documentary evidence includes electronic records," and the umbrella covers paper printouts of computer-stored data as well.

In practical 2026 language, that means:

• Screenshots of WhatsApp, Instagram, X, Telegram, Snapchat
• SMS and call logs
• Emails and email attachments
• Voice notes, video calls, Zoom/Meet recordings
• Payment app screens (PhonePe, GPay, Paytm, banking apps)
• CCTV footage and dashcam footage
• Photographs and videos with their original metadata
• Login records, location history, Drive/iCloud files
• Audio recordings stored on a phone or laptop

All of these are "documents" the moment a court is willing to look at them. The trick is in how you bring them to court.

Why a Plain Screenshot Is Not Enough

Here is the rule that catches most people by surprise. Section 65B of the Indian Evidence Act — the law that controls whether electronic evidence is admissible — says that any printout or copy of an electronic record is admissible in court only if it is accompanied by a special certificate. The certificate must do four things: identify the electronic record, describe how it was produced, give details of the device used, and be signed by a person in a responsible official position over that device.

"An electronic record by way of secondary evidence shall not be admitted in evidence unless the requirements under s 65B are satisfied… without such safeguards, the whole trial based on proof of electronic records can lead to travesty of justice."

That blockquote above is from the Supreme Court itself in Anvar P.V. v. P.K. Basheer. Translated to a courtroom in Saket: if you walk in with a printout of a WhatsApp screenshot and no Section 65B certificate, the other side's lawyer will object, and the judge will likely refuse to look at it.

The good news is that the certificate is short — usually less than a page — and your lawyer drafts it. Your job is the part before the certificate: keeping the original record clean, identifiable and preserved. The certificate is the bow on the box; if there is no clean box, the bow is useless.

How Do I Save Things So a Court Will Trust Them?

Think of yourself as a curator preserving something precious. You are not editing, cropping, beautifying or "fixing" anything. Three principles drive everything below.

Principle one — never modify the original. Do not edit the screenshot, do not crop it to "look better", do not blur out parts even if those parts are private. The court will inspect the unmodified version. If you must redact for sharing on social media, do that on a copy and label the copy clearly.

Principle two — multiple copies on multiple devices. Save the original to the phone's gallery, then email it to yourself, then upload to Google Drive or iCloud, then transfer a copy to a pen drive that you store in a cupboard. Five copies in five places means deletion of one is no disaster.

Principle three — keep a clean trail. Note in a small notebook (yes, paper) the date and time you saved each piece of evidence, which device, where you stored it. This becomes your chain of custody. Later, when an investigating officer asks "When did you take this screenshot?", you have a clear answer.

Chats, Emails, CCTV — Specific Steps for Each

WhatsApp and other chat platforms

Open the chat. Tap the three dots, then "More", then "Export Chat". Choose "Include Media". The phone will create a text file plus all photos and videos shared in that chat. Email that bundle to yourself immediately so a timestamped server copy exists. Then take a screen recording of the chat — not just static screenshots — showing yourself opening the chat from the chat list and scrolling through it. Live recordings are far harder to fake than still images.

Also note the phone number, the contact name, the timestamps, and your own phone model and number. Do not delete the contact. Do not block them yet — once blocked, some platforms hide the chat. Save first, react later.

Emails

Email is one of the friendlier formats because the original lives on a server. From your account, download the suspect email as an EML or PDF — most email clients let you do this in two clicks. Forward the email (without editing) to a second email address you control. Take a screenshot of the email open in your inbox. Note the full email headers (in Gmail: "Show original"). Headers contain server-level metadata that proves the email was actually sent from where it claims.

CCTV footage

Time is your enemy. Most home and shop systems overwrite within 7 to 30 days. Within 48 hours of the incident, do this: visit the location with a written request asking the owner or society to preserve footage from a specific date and time range. Hand the request, get a stamp or signature on a copy. Ask for a copy on a pen drive — most modern DVRs export easily. If the owner refuses, your lawyer can send a preservation notice. If they still refuse, the police can seize the recorder under the BNSS. Always ask the operator who exported the footage to issue a Section 65B certificate at the same time — get it in writing while the device is still in front of you.

Social media posts and comments

Take screenshots first, then save the URL of the post (the long web address). Use the platform's "Save" or "Bookmark" feature if available. If the post is on a public profile, also note the username, the profile URL, the follower count visible at that moment, and any verification badges. Many platforms also offer a "Download Your Information" feature — use it. The bigger the digital paper trail, the harder it becomes for the other side to claim "that never happened."

Hash Values, Metadata and Why They Are Your Friends

A hash value is the closest thing digital files have to a fingerprint. It is a string of letters and numbers — typically called an MD5, SHA-1 or SHA-256 hash — that any computer can calculate from a given file. Change one pixel and the entire hash changes. So if you save a video today and note the hash on a piece of paper, you can prove two years later in court that the file is exactly the same. No tampering. No re-encoding. Identical to what was originally captured.

You do not need to be a computer engineer to use this. Free tools exist. For really serious cases — leaked videos, blackmail material, fraud evidence — pay a small fee to a private cyber forensic expert to image your device. The expert will hand you a "forensic copy" with a hash value, a written report, and a Section 65B certificate. That bundle is gold in court.

Metadata is the second friend. Every photo, video and document carries hidden information: when it was made, on what device, sometimes even where (GPS). Original files keep this metadata. Cropped, edited or screenshotted-from-screen versions often lose it. Always save the original alongside any copy. If you also have a problem of cyber crime that needs an FIR, the forensic copy plus metadata makes the investigating officer's life much easier.

What Should I Actually Do Now?

Common Mistakes That Destroy a Good Case

Most cases do not collapse because the law was against the victim. They collapse because the victim — frightened, exhausted, advised by relatives — did the wrong thing in the first 72 hours. Watch for these.

Sending the screenshot to ten friends on WhatsApp. Each forward strips metadata, re-compresses the image, and creates copies whose authenticity is harder to defend. Save first, share later — and only with your lawyer.

Factory-resetting the phone. People do this in panic, thinking it will "remove evidence" of their own embarrassment. It removes everything, including the timestamps and the data your own case depends on.

Photographing one phone screen with another phone. The second phone's photo has no metadata about the first phone's content. The court can call this two-step distance "manufactured." Take a direct screenshot from the device that holds the content.

Cropping or beautifying the screenshot. Even removing your own phone number can look like tampering. Save the unmodified original. Redact only on a clearly labelled copy if you must share publicly.

Ignoring CCTV because "the police will get it." Police take days or weeks. The DVR overwrites in days. Parallel preservation by you, in writing, is what saves the footage.

Waiting until you "have everything" before reporting. Don't. Go to the cyber cell with what you have today. Police can write to platforms for preservation only after the FIR is registered. Speed matters more than completeness.

A Quiet Promise From a Lawyer Who Has Seen This Before

The most painful conversations happen when a person walks in with a story that is clearly true — a fraud, a stalker, a blackmailer, a leak — and a phone full of evidence that was, somewhere along the way, mishandled. Saved poorly. Cropped. Forwarded. Edited. The case is still arguable, but each handling mistake quietly lowers the ceiling. So if there is one thing this article does for you tonight, let it be this: stop touching the evidence, write down what you have, and pick up the phone in the morning. At Pinaka Legal in Delhi, our team handles these situations every week — quietly, practically, without panic — and we have seen what early discipline does to a case versus what late discipline leaves behind. The law is on the side of the careful; do not lose by being uncareful.

You do not need to know what a hash value is or why Anvar P.V. matters. You need to keep things still and reach the right hands. The rest is craft.

Frequently Asked Questions

Are screenshots admissible as evidence in Indian courts?

Yes, but only if you follow the rules. A screenshot is a printout of an electronic record. Under Section 65B of the Indian Evidence Act, electronic records are admissible if accompanied by a certificate identifying the device, describing how the record was produced, and signed by a person in a responsible position. The Supreme Court in Anvar P.V. v. P.K. Basheer made this certificate mandatory. Without it, your screenshot is inadmissible. So, take the screenshot — but also save the original, note the device, and keep it untouched until your lawyer prepares the certificate.

What is a Section 65B certificate and why is it so important?

It is a written declaration that accompanies any electronic evidence — screenshot, video, email, CCTV clip — when produced in court. It identifies the device that created or stored the record, describes how the record was made, and confirms the device was working properly. The certificate must be signed by a person occupying a responsible official position over that device. The Supreme Court has repeatedly held that without this certificate, electronic evidence cannot be admitted as secondary evidence. It is the difference between a Whatsapp screenshot the judge actually reads and one she throws out.

How do I save WhatsApp chats so they hold up in court?

First, do not delete the chat or the contact. Open the chat, tap the menu, and use the Export Chat feature with media. WhatsApp creates a text file plus the attached photos and videos. Email this export to yourself so a timestamped copy lives on a server. Then take screen recordings showing the chat opening from the chat list to the messages — this proves the screenshots came from a real conversation, not a fake. Note the phone model and your number. Your lawyer will draft the Section 65B certificate when filing.

Can the other side claim my screenshot is morphed or fake?

They can try. Electronic records are easy to tamper with, which is why courts demand the Section 65B certificate and why preservation hygiene matters. The Supreme Court has noted that electronic records are susceptible to alteration and excision, and the certificate is the safeguard. To defeat a tampering allegation, keep the original device unmodified, keep the file with its original metadata, calculate a hash value where possible, and avoid editing or cropping. The cleaner your chain, the harder it is to attack.

What is a hash value and do I really need one?

A hash value is a string of letters and numbers, like a digital fingerprint, that any computer can calculate from a file. If even one pixel of the file changes, the hash changes completely. So if you save a video today and note its hash, you can prove in court two years later that the file is exactly the same. You don't strictly need a hash — but if you have a serious case (CCTV, leaked video, important email), a hash makes the evidence near-bulletproof. Free tools exist; ask a lawyer or a cyber forensics expert.

How long does CCTV footage usually last before it is overwritten?

It depends on the system. Most domestic and shop CCTVs overwrite themselves every 7 to 30 days. Mall and bank systems may keep 30 to 90 days. So if something happens, you have a narrow window. Visit the location within 48 hours, write a request to the owner asking them to preserve the footage of a specific date and time range, and ask for a copy on a pen drive. If they refuse, get your lawyer to send a preservation notice or have the police seize the footage with a Section 65B certificate from the operator. For deeper guidance on getting an FIR registered when police hesitate, that step is critical for CCTV cases.

What if the trolling account or post is deleted before I can save it?

It's still recoverable in many cases — but only if you act fast. Platforms like Instagram, X and Facebook keep deleted content on their servers for some time. The police, with a notice to the platform, can request preservation and disclosure. So even if the public post is gone, your FIR can ask the investigating officer to formally write to the platform. Save whatever you have — even partial screenshots, the URL, the username, the timestamps — and rush to the cyber cell. Speed matters more than perfection.

Should I take screenshots on my phone or use a separate camera?

Take screenshots on the phone where the content originally appeared — the metadata is cleaner. Plus, take a second device and record a short video showing your phone screen scrolling through the content, with the date visible. This double layer is harder to attack as fake. Avoid photographing one phone screen with another phone unless you have no choice. Cropped or filtered screenshots create suspicion. Save originals untouched in a separate folder, and never edit them — even to hide your own number.

Can the police investigate even if I don't have a Section 65B certificate yet?

Yes. The certificate is needed at the trial stage to make the evidence admissible — not at the FIR stage. Go to the police or cyber cell with whatever you have: screenshots, URLs, usernames, the device. If your offence is cognizable (most cyber harm is), they must register an FIR. The investigating officer will collect the device, run forensic analysis, and arrange the certificate at the time of the chargesheet. Your job is to preserve, not certify. Don't delay reporting because you think your evidence is incomplete.

Can I send the original phone for police seizure or do I keep it?

It depends on the case. For serious matters — sextortion, blackmail, identity theft, hacking — police may seize the device for forensic imaging. The forensic lab makes a bit-for-bit copy of your phone and works on the copy, returning the original later. For smaller cases, a screenshot or chat export with a Section 65B certificate is often enough. Discuss with your lawyer before handing over the device. Keep a backup of important data first. Never factory-reset before seizure — that destroys the evidence you want to use.

What if I am the accused and the police seize my phone?

You have rights. The seizure must be recorded. You can ask for a copy of the seizure memo. You can request a hash value of the device be calculated in your presence so the data cannot be silently altered later. You can ask that the forensic examination happen in the presence of an independent witness. If the police try to add or modify content, the hash will not match. A lawyer experienced in cyber matters should be involved from day one — these procedural protections are real and they work.

Is data on my Google or Apple account also evidence I can use?

Yes. Emails, location history, Drive files, photos with timestamps, login records — all are electronic records and all are usable in court with a Section 65B certificate. Download your data using the official takeout tools, save it to a separate drive, and note the date you downloaded it. For matters where the platform itself must testify, the police can write to Google or Apple seeking preservation and disclosure. Your job is to identify what exists, save your own copies, and not delete anything from the cloud account itself.

For more articles on Indian law, visit the Pinaka Legal Blog. Written by the Pinaka Legal Editorial Team. For queries, call +91 8595704798 or email info@pinakalegal.com.