If you are the victim of a cyber crime, how you capture the evidence matters as much as what you capture. Indian law sets specific requirements for electronic records, and those requirements were renumbered recently.
The Law Changed: Section 65B Is Now Section 63
The Indian Evidence Act, 1872 was repealed and replaced by the Bharatiya Sakshya Adhiniyam, 2023, which came into force on 1 July 2024. Electronic records are now dealt with under Section 63 of the BSA, and the certificate everyone still calls a "65B certificate" is the certificate under Section 63(4), in the form set out in the Schedule to the Act.
The substance carried over, which is why older material — including an earlier version of this article — still cites Section 65B. If you are filing today, cite the current section, and take advice on your own matter: this article is background, not legal advice.
What the Provision Requires
1. A certificate: a certificate under Section 63(4), in the prescribed form, must accompany the electronic record
2. Integrity: the record must be shown not to have been altered
3. Chain of custody: who handled the record, and when, documented
4. Hash values: a cryptographic hash is the ordinary way of demonstrating that a copy matches what was captured
Common Mistakes That Sink Electronic Evidence
What Cyber Rakshak Does, and What It Does Not
The mobile app has not been released, so nothing in this section is something you can use today. What follows is how the vault behind it is built, not a description of a product you can install.
Items Cannot Be Deleted
Once an evidence item is written, the record refuses deletion, and the fields identifying the item and its file cannot be changed afterwards. It is not frozen in every respect — a verification flag and the notes attached to an item can still be updated — and we would rather say that than call it immutable and be wrong.
A Hash Is Recorded at Capture
A SHA-256 fingerprint is stored with each item.
⚠️ Be clear about what that proves. The fingerprint is computed on the device and stored as supplied; the server does not recompute it from the file. So it shows that the stored record has not changed since it was written — not that the file and its fingerprint were independently checked against each other.
Consent Is Checked Before Anything Is Captured
Evidence routes sit behind a consent check: capture and access are refused unless consent has been recorded for the account first. It is something you grant, and something you can withdraw again.
Metadata Travels With the Item
Capture time, location, device information and the account that captured it are stored alongside the item rather than left inside the file.
Some Actions Are Logged
Creating an item writes an entry against it, and so does exporting its file. Opening an item to look at it does not.
⚠️ "Chain of custody" is a conclusion a court draws, not a table we own. A log is evidence towards it, not a substitute for it.
A Report You Can Hand Over — Coming at Launch
A single document carrying an incident, the items filed under it and their metadata, for handing to the police or attaching to a complaint, is planned and is not built. Do not plan a filing around it.
What No App Can Do for You
No product can make your evidence admissible. A court decides admissibility, and the Section 63(4) certificate has to be signed by a person who can speak to the device and the process — an app cannot issue it about itself. Any vendor promising court-admissibility, this one included in an earlier version of this article, is describing something outside its control.
Capture early, change nothing, and get the certificate right. That is the part you can control.