1. Introduction:

Cybercrime prosecutions often depend on evidence that exists only in electronic form: messages, emails, social media records, CCTV footage, device data, system logs, or information recovered from deleted files. Such evidence can be altered, damaged, or misunderstood if it is not properly collected and examined. The Prevention of Electronic Crimes Act, 2016 (PECA) provides procedures for handling electronic evidence, while the Qanun-e-Shahadat Order, 1984 (QSO) governs its relevance and proof in court.

2. Meaning of Digital and Forensic Evidence:

Digital evidence is information generated, stored, received or transmitted through an information system or electronic device. It may include a message, an email, a photograph, a video, a call record, a log or data stored on a computer or mobile phone.

Forensic evidence is information collected and analysed through a systematic technical examination. For example, a forensic examiner may examine a mobile phone, recover deleted files, analyse metadata, or compare a forensic copy of a device with the original.

3. Relevant Legal Provisions:

The principal provisions include:

• Section 36 PECA: dealing with seized data or an information system.
• Section 29(7) PECA: forensic-analysis capacity and reports produced by the investigation agency.
• Section 40 PECA: forensic laboratory and expert opinion.
• Articles 46-A, 59, 73, and 78-A QSO: relevance, expert opinion, primary evidence and proof of electronic documents.

These provisions work together: PECA addresses the collection and forensic examination of evidence, while the QSO sets out how electronic material may be proved in court.

4. Collection and Preservation of Electronic Evidence:

i. Recording what has been seized:

Section 36 PECA requires the authorized officer, when seizing or securing data or an information system, to prepare a list of what has been seized or made inaccessible, recording the date and time. A copy of that list must be given, in the prescribed manner, to the relevant person. This creates a record of what the investigation obtained and when it was obtained.

ii. Preserving the original material:

Electronic data may be changed by ordinary use or careless examination. A forensic copy allows investigators to examine the data while preserving the original device or source material as far as practicable. Section 36 also provides a process through which the owner or an authorized agent may request a forensic image, subject to the statutory safeguards.

iii. Maintaining the chain of custody:

The evidence should be documented from collection through storage, transfer and examination. This helps show who handled it, when it was handled and whether it remained secure. The applicable investigation rules provide procedures for digital-evidence acquisition and examination, including write protection, verification of the acquired copy and examination by trained personnel.

5. Forensic Examination and Expert Reports:

A forensic examination may identify the source, content, timing, or history of electronic material. It may also help determine whether data were deleted, altered, or transferred. Section 29(7) PECA provides that a forensic analysis report generated by the investigation agency is not inadmissible solely because it was generated by that agency. Section 40 provides for a forensic laboratory, independent of the investigation agency, to give expert opinion before the court or for the benefit of the investigation agency. These provisions facilitate the presentation of technical findings. They do not, by themselves, make every report conclusive or establish that its findings are correct.

6. Proving Electronic Evidence under the QSO

i. Relevance of electronic records

Article 46-A QSO makes statements in the form of electronic documents generated, received or recorded by an automated information system while it is in working order relevant facts. This provides a basis for the court to consider qualifying electronic records as evidence.

ii. Electronic material as primary evidence

Article 73 QSO addresses when an output or reproduction from an automated information system may be treated as primary evidence. Its application depends on the statutory requirements, including the system’s working condition at the relevant time.

iii. Proving authenticity

Article 78-A QSO addresses proof of an electronic document or signature when it is alleged to have been generated, wholly or partly, by a person through an information system and that allegation is denied. In such a case, the application of a security procedure to the signature or electronic document must be proved.

iv. Expert opinion on technical matters

Article 59 QSO makes expert opinion relevant on matters such as the authenticity and integrity of electronic documents and the functioning or operation of information systems. Expert evidence can help the court understand how the material was obtained and what the forensic examination establishes.

7. Court’s Assessment at Trial

The court considers whether the evidence is relevant and whether its authenticity and integrity have been adequately established. The prosecution must explain how the evidence was collected, preserved, and examined. Where necessary, the forensic examiner may explain the method and findings, and the defense may challenge them. Admissibility does not make evidence conclusive. The court must still assess its reliability and the weight it deserves in the case.

8. Conclusion

PECA and the QSO create a framework for presenting digital and forensic evidence in cybercrime trials. Proper seizure, preservation, forensic examination, authentication and expert explanation help establish whether the evidence may be admitted and relied upon. The court retains the responsibility to assess its genuineness, reliability and evidentiary weight.