Blogs7 min read

Preservation and production of electronic evidence

LawWorld

18 Aug 2026

Understanding the Urgency of Electronic Evidence Preservation

Electronic evidence is fundamentally different from physical evidence. A document can sit in a file for years. A CCTV recording cannot. Most surveillance systems automatically overwrite footage within fifteen to thirty days. Call detail records held by telecom operators typically persist for only ninety to one hundred eighty days. WhatsApp messages vanish from cloud backups if not actively maintained. Bank transaction logs are archived after defined periods. The moment you realise you need this evidence, the clock is already running.

This is why preservation of electronic evidence is not a procedural nicety—it is a race against automatic deletion. In Indian criminal and civil litigation, the failure to preserve digital evidence in time has destroyed countless cases. Understanding the categories of electronic evidence, their natural retention periods, and the legal mechanisms available to secure them is essential for lawyers, investigators, and litigants.

Categories of Electronic Evidence and Their Retention Periods

CCTV Footage and Video Surveillance

CCTV systems operate on a loop. Once the hard drive or storage device reaches capacity, the oldest footage is overwritten. Depending on resolution, frame rate, and storage capacity, this cycle typically completes within fifteen to thirty days. Some systems may extend to sixty days if configured with larger storage, but this is not guaranteed. The moment a crime or incident occurs, you must assume the footage will be gone within weeks. Delay in securing it is delay in losing it permanently.

Call Detail Records and Tower Location Data

Telecom operators maintain call detail records (CDRs)—logs of incoming and outgoing calls, SMS, and data usage—for a statutory retention period typically ranging from ninety to one hundred eighty days. Tower location data, which pinpoints the geographic area where a phone connected to the network, follows similar retention schedules. These records are not stored indefinitely. After the retention period expires, operators routinely delete them to manage server capacity. If your investigation or litigation depends on establishing who called whom, or where a person was at a specific time, you must move quickly.

WhatsApp, Telegram, and Messaging Applications

Messages stored on a user's device may persist indefinitely, but cloud backups are another matter. WhatsApp backups stored on Google Drive or iCloud are typically retained only as long as the account remains active and synced. If a device is lost, factory reset, or the account is deleted, the backup data is often irrecoverable. Screenshots of messages are common, but a screenshot alone is not sufficient proof of the original message—it can be doctored, and it breaks the chain of custody. The original device, or a forensic image of it, is far more valuable.

Email and Web-Based Communications

Emails stored on servers may be retained by service providers for extended periods, but corporate email systems often have automated deletion policies. Emails older than a certain date are purged. Accessing historical email requires prompt action and often requires a formal request to the email service provider or the organization maintaining the server.

Bank Transaction Logs and Financial Records

Banks maintain transaction records for seven to ten years as per regulatory requirements, but accessing them requires formal legal process. A simple request to the bank may not yield results; a summons or court direction is often necessary. However, the longer you wait, the more likely the records are to be archived in offline storage, making retrieval slower and more cumbersome.

Device Images and Forensic Data

A device—mobile phone, laptop, hard drive—contains data that can be overwritten or corrupted if the device is used, charged, or exposed to physical damage. Creating a forensic image (a bit-by-bit copy of the device's storage) preserves the data in its original state and allows analysis without risking the original device. This must be done promptly and by a qualified forensic professional.

Legal Mechanisms for Preservation and Production

Application to the Investigating Officer

In criminal investigations, the first step is usually to inform the investigating officer (IO) of the electronic evidence that needs preservation. While the IO has a duty to preserve evidence, a written communication requesting specific preservation of CCTV footage, CDRs, or device data creates a paper trail and ensures the request is documented. This communication should specify exactly what evidence is needed, where it is located, and the urgency of retrieval.

Application to the Magistrate Under Section 93 CrPC

Section 93 of the Criminal Procedure Code empowers a Magistrate to issue a direction to any person to produce a document or thing. This is a formal legal tool. An application to the Magistrate requesting a direction to produce electronic evidence—such as CCTV footage from a shop, call records from a telecom operator, or transaction logs from a bank—carries the force of law. Non-compliance can result in contempt proceedings. This mechanism is particularly useful when the evidence holder is a third party who may not otherwise cooperate.

Summons to Third Parties

Banks, telecom operators, email service providers, and other custodians of electronic evidence often require a formal summons before releasing data. A summons issued by the court, or by the investigating officer under Section 91 CrPC, compels production. The summons must be precise: it must specify the exact data required, the date range, and any other relevant parameters. Vague summons often result in incomplete or irrelevant data.

Application in a Pending Suit

In civil litigation, electronic evidence can be sought through discovery, interrogatories, or applications under the Indian Evidence Act and the Civil Procedure Code. An application to the court can direct the opposing party or a third party to produce electronic evidence relevant to the case.

Certification of Electronic Records

Under Section 65A and 65B of the Indian Evidence Act, electronic records are admissible only if accompanied by a certificate. This certificate is critical—its absence can render otherwise valuable electronic evidence inadmissible.

What the Certificate Must State

The certificate must state: (1) the person certifying is the person in charge of the computer or electronic device; (2) the device was used regularly to store or process information; (3) the information was supplied regularly to the device in the ordinary course of business; (4) the device was functioning properly at all material times; and (5) the electronic record is an accurate representation of the information held in the device.

Who May Sign the Certificate

The certificate must be signed by the person in charge of the computer or electronic device at the time the electronic record was created or stored. For bank records, this is typically a bank official. For telecom records, a telecom operator representative. For CCTV footage, the person in charge of the surveillance system. The signatory must have personal knowledge of the facts stated in the certificate.

Consequence of Absence

Without the certificate, the electronic record is inadmissible unless the court permits oral evidence from the person in charge. This is a significant procedural hurdle. Obtaining the certificate at the time of production is far easier than attempting to obtain it later, often after the relevant person has left their position.

Chain of Custody and Admissibility

Hash Values and Integrity Verification

A hash value is a unique digital fingerprint of a file. If the file is altered even slightly, the hash changes. Documenting the hash value of electronic evidence at the time of preservation proves that the evidence has not been altered. Courts increasingly recognize hash values as evidence of integrity.

Chain of Custody Documentation

Who handled the evidence, when, and for what purpose? This must be documented at every step. From the moment CCTV footage is downloaded to the moment it is produced in court, every person who accessed it should be recorded. Any gap in the chain weakens the evidence.

Original Device Versus Copy

A forensic image or certified copy of a device is generally acceptable, but the original device is preferable. Screenshots and informal copies are weak evidence and often inadmissible without corroboration.

Model Preservation Application

To the Investigating Officer / Magistrate:

I request urgent preservation of the following electronic evidence: [Specify CCTV footage from [location], covering [date/time range]; Call detail records for [phone number] for [date range]; WhatsApp messages between [parties] for [date range]]. This evidence is material to the investigation/case and is at risk of automatic deletion. Please issue directions to [relevant custodian] to preserve and produce this evidence within [specified timeframe].

Conclusion

Electronic evidence is perishable. The legal system provides tools to preserve it—applications to the Magistrate, summons to third parties, and formal certification requirements—but these tools are effective only if used promptly. Understanding retention periods, knowing which mechanism to use, and ensuring proper chain of custody and certification are the difference between evidence that wins cases and evidence that disappears forever. Act fast, document thoroughly, and preserve before it is too late.

12% read

Keep reading — it’s free.

Create a free LawWorld account to finish this piece and unlock the full library of practice guides written for advocates in India.

Finish every guide, free
Save articles to read later
New practice insights weekly

Free forever. No card required.

Preservation and production of electronic evidence

Understanding the Urgency of Electronic Evidence Preservation

Categories of Electronic Evidence and Their Retention Periods

When a court can be asked to reconsider its own order

Guarantors and their liability

Drafting a written statement that protects your client

Anticipatory bail and how to prepare for the hearing