The Screenshot, the Cupboard and the Missing Hash
A cyber police station in Haryana registers a case in which a retired teacher lost ₹2.40 lakh in a 'digital arrest' scam. The money was split across three mule accounts. A suspect is picked up with a Windows laptop and an Android phone.
At the police station a constable powers on the laptop, opens WhatsApp Web, screenshots a chat mentioning '15,000 USDT', and emails the screenshot to his personal address so it can be printed. The laptop is then shut down and placed in a cupboard. No seizure memo is prepared for the laptop or for the phone charger; the phone has been left switched on and charging since seizure, and notifications are arriving.
The phone is unlocked during interrogation using a PIN the suspect gave orally, and the gallery and messaging apps are browsed. The investigating officer proposes to file the printed screenshots with an admissibility certificate that he will sign himself. The bank statement for one mule account was obtained by an email reply from a branch manager, with no written requisition on file.
1. Identify the handling errors and state how each device should have been seized and preserved in the first hour.
Read the worked answer
Errors: (i) powering on the laptop and opening an application altered the very data under investigation and updated file timestamps; (ii) emailing evidence to a personal address removed it from any controlled chain and created an unaccounted copy; (iii) no seizure memo for the laptop or charger - the items cannot later be proved to be the items seized; (iv) the phone left on and connected, so messages could be deleted remotely and app data changed by notifications; (v) browsing the gallery and apps during interrogation is an unrecorded search of a private device; (vi) no hash value, so integrity cannot be demonstrated.
Correct first hour: photograph the devices in place, prepare a seizure memo describing make, model, IMEI or serial number and condition, with witnesses; put the phone in airplane mode or a signal-blocking bag without unlocking or exploring it; keep the laptop powered off; label and seal each item, with the charger listed separately; record every handover by name, time and purpose; and compute a cryptographic hash (SHA-256) of the acquired image at the first opportunity, so any later mismatch is detectable.
2. What is needed to make the WhatsApp screenshot admissible, and what is its evidentiary weakness? How would you cure the weakness?
Read the worked answer
Admissibility. Electronic records are admissible only with the statutory certificate accompanying them when they are produced in court - s.65B of the Indian Evidence Act, carried into the Bharatiya Sakshya Adhiniyam, 2023 as s.63. The certificate must identify the record, describe the device and the manner of production, and deal with the condition of the device. A certificate signed by the investigating officer who did not produce the record is exactly the defect the provision exists to prevent; it should come from the person in control of the device or the process, with the IO's covering note.
The weakness is authenticity, not form. A screenshot of a chat shows only what a screen displayed. It does not show the account holder, that the messages were unaltered, or that the chat is complete - and here the constable's email to himself makes the copy vulnerable to a tampering suggestion.
Cure: acquire a forensic image of the device with a hash, extract the chat through a tool that reports the underlying database records, and corroborate with subscriber and IP log data requisitioned from the service provider under legal process. The screenshot then becomes an illustration of verified data, not the proof itself.
3. List the fields your chain-of-custody record must carry, and explain how a hash value is used to prove that the evidence was not altered.
Read the worked answer
Fields: case number and exhibit number; a description sufficient to identify the item (make, model, IMEI or serial number, storage capacity, visible damage); date and time of seizure with the place and the officer's name; the name and signature of each person who handled it and the purpose of each transfer; the seal number and a note each time a seal is broken and re-affixed; the storage location between handlings; the hash value at acquisition and at each subsequent verification; and the names of witnesses at seizure and at opening.
How the hash works: a cryptographic hash function such as SHA-256 converts the entire acquired image into a fixed-length value. Change one bit anywhere in the image and the value changes completely. The record therefore carries the hash at acquisition, and every later examiner recomputes it and states whether it matches.
Consequence: a matching hash proves the image examined is bit-for-bit the image acquired; a mismatch proves alteration or a handling error and must be explained. Because the hash was never computed at seizure in this case, no such proof is possible - which is why the missing hash, not the missing cupboard key, is the defect that will be argued in court.