Digital Forensics
Abstract
Modern criminal investigation increasingly begins with a single act: the seizure of a smartphone and its wholesale forensic imaging. A “forensic copy” or mirror image reproduces the entire contents of a device — not merely material relevant to the offence under investigation — capturing years of messages, photographs, financial records, health data, browsing history, and privileged communications alike. This indiscriminate capture sits uneasily with two settled principles of criminal procedure: proportionality in search and seizure, and the confidentiality attached to privileged communications.
This paper examines the Indian legal position governing full-device forensic imaging under the Bharatiya Nagarik Suraksha Sanhita, 2023 (“BNSS”), the Bharatiya Sakshya Adhiniyam, 2023 (“BSA”), the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”), read against Articles 20(3) and 21 of the Constitution. It surveys the emerging jurisprudence — from K.S. Puttaswamy to Virendra Khanna and the 2026 decision in Pune Bar Association — that has begun to grapple with the absence of a codified framework for data minimization, privilege protection, and post-investigation return or deletion of mirrored data, and concludes with recommendations drawn from comparative practice and the pending Foundation for Media Professionals litigation.
Legal Framework
Search and seizure powers
Section 94 BNSS (successor to Section 91 CrPC) is a summons-and-production provision: it allows a court or officer to require a person to produce a document, electronic communication, communication device, or other thing considered necessary for an investigation. It is not, by itself, a search provision, and the article uses it in that narrower sense here. Search of persons and premises — and the seizure that follows — is governed separately, including by the police search power under Section 185 BNSS.
Two further, distinct mechanisms apply once a search is underway. Section 105 BNSS requires audio-video recording of the process of search and seizure, a marked departure from the CrPC’s panchnama-only regime. Section 176(3) BNSS separately requires the attendance of a forensic expert at the scene of an offence punishable with imprisonment of seven years or more — but this obligation operates within a statutory notification framework tied to the State Government, and is not a self-executing, unconditional mandate that applies automatically in every serious offence. Production under Section 94, search under Section 185, recording under Section 105, and forensic expert attendance under Section 176(3) are accordingly four separate mechanisms and should not be compressed into a single proposition. In Rollymol v. State of Kerala, the Kerala High Court read this cluster of provisions as reflecting a deliberate legislative shift toward embedding forensic science across the stages of investigation.
Admissibility of digital evidence
Section 63 BSA, replacing Section 65B of the Indian Evidence Act, 1872 with effect from 1 July 2024, treats a “computer output” as a document admissible without production of the original device, provided a certificate under Section 63(4) is furnished in the form prescribed by the Schedule to the BSA. The Schedule is not a single undifferentiated signature block: Part A requires disclosure of the hash value of the electronic record, while Part B requires certification by an expert. The article should identify precisely which part is completed by whom, rather than asserting a blanket rule that the device custodian and an independent expert must jointly sign a single certificate.
This question reached the Supreme Court in Pune Bar Association v. Union of India (W.P.(Civil) No. 599/2026, decided 22 May 2026), where the constitutional validity of Section 63(4) and its Schedule was challenged as unduly onerous. The Court upheld the provision and, reading Sections 39(1) and 39(2) BSA harmoniously, declined to confine Part B certification to Examiners of Electronic Evidence notified under Section 79A of the IT Act — holding that any person with special skill and expertise in computer science and cyber forensics may sign Part B, while leaving the underlying question of law open rather than expressing a conclusive opinion. The Supreme Court had earlier held in Anvar P.V. v. P.K. Basheer, and reaffirmed in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, that a certificate of this kind is a mandatory precondition to admissibility.
Constitutional guarantees
Mirroring an entire phone engages the right to privacy recognized in K.S. Puttaswamy v. Union of India, and the privilege against self-incrimination under Article 20(3), examined alongside compelled disclosure of passwords in Selvi v. State of Karnataka. Article 20(3) jurisprudence requires several distinctions that are easy to elide: testimonial compulsion is treated differently from the production of physical or digital evidence already in existence; furnishing a password or passcode (drawn from the accused’s mental knowledge) sits differently from biometric authentication (a physical characteristic); and courts have not treated these categories as interchangeable. This distinction is central to how far Virendra Khanna and Selvi can be read together and is developed further below.
Under the Puttaswamy proportionality test, any intrusion on privacy must be lawful, necessary, and proportionate to a legitimate aim. Full-device imaging raises a serious proportionality question because the technique may capture substantially more information than is necessary for a given investigation. This is presented here as an argument this paper advances — one requiring fact-specific assessment in each case — rather than as a proposition already settled by Indian courts; no Indian judgment has yet held that full-device imaging inherently and invariably fails the proportionality standard.
Privilege and data protection
Legal professional privilege is codified in Section 132 BSA (formerly Section 126, Indian Evidence Act, 1872), which protects specified advocate-client communications from disclosure without consent, subject to statutory exceptions. Full-device imaging routinely captures such communications without any segregation mechanism at the point of seizure. It does not, however, follow automatically from Section 132 that a forensic “filter team” is legally required; Section 132 is a rule about disclosure and admissibility, not a rule that itself mandates any particular seizure or examination protocol. Getting from privilege to a required filtering mechanism needs several further steps to be argued separately: privilege, seizure, examination, admissibility, disclosure to the opposing party, and use of material by investigators are conceptually distinct stages, and a safeguard at one stage does not automatically import a safeguard at another. This paper argues for an independent filter mechanism as a policy recommendation, not as a proposition already required by Section 132 itself.
Separately, the Government has described “data minimization” as one of the principles underlying the DPDP framework, but the DPDP Act, 2023 does not create a freestanding statutory data-minimization obligation under Section 4. Section 4 instead identifies the two lawful grounds on which personal data may be processed — the Data Principal’s consent, or a specified “legitimate use” — and defines “lawful purpose” negatively as any purpose not expressly forbidden by law; it does not, on its text, impose a minimization duty. Section 17(1)(c), read with Section 17(2), exempts processing that is “in the interest of prevention, detection, investigation or prosecution of any offence” from the notice, consent, and most of the Chapter II and Chapter III obligations that would otherwise bind a data fiduciary. This leaves the actor with the greatest practical access to personal data — the investigative arm of the State — largely outside the obligations Parliament has imposed on private fiduciaries, a policy vacuum precisely where minimization matters most.
The Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology on 13–14 November 2025, operationalizing the Act’s consent-notice, breach-notification, and Data Protection Board provisions on a phased timeline. The Rules do not narrow the Section 17 law-enforcement exemption or impose any minimization duty on investigative agencies handling a forensic image; an analysis of the DPDP framework that does not account for the Rules is, as of 2026, incomplete.
Role of the IT Act, 2000
Section 79A of the Information Technology Act, 2000 empowers the Central Government to notify “examiners of electronic evidence”, whose reports are treated as expert opinion, while Section 69 permits interception and decryption on defined grounds. Neither provision addresses the scope, retention, or purpose-limitation of a forensic mirror image once lawfully created — the statute regulates who may examine electronic evidence, not how much of a device that examination may touch.
Analysis
Virendra Khanna v. State of Karnataka (Karnataka HC, WP No. 11759/2020, decided 12 March 2021) remains the most detailed judicial guidance available in India, precisely because Parliament has not legislated on the point. Justice Suraj Govindaraj held that the Court could not, of its own motion, direct an accused to furnish passwords, passcodes or biometrics; the judgment instead contemplated an application by the investigating agency, followed by a judicial direction issued in the circumstances the judgment discusses, with refusal to comply permitting an adverse inference rather than automatic coercion. The chain the judgment establishes is therefore: investigative need → application to the court → judicial direction → consequences of non-compliance — not an unrestricted, self executing power to compel passwords. The judgment also prescribed a forensic protocol: a qualified examiner accompanying the search team, photographing the scene before the device is touched, preserving RAM data, isolating the device from wireless networks, and securing the SIM card and battery in separate Faraday enclosures. The Court acknowledged that access “for a specific reason” often enables access to all aspects of a person’s life, yet held that mere use of such data during investigation would not, without more, violate privacy — reasoning commentators have criticized as under-theorized on proportionality, and which this paper argues left the Article 20(3)/testimonial-versus-physical-evidence distinction underexplored.
The gap Virendra Khanna left open remains before the Supreme Court. In Foundation for Media Professionals v. Union of India (W.P.(Crl.) No. 395/2022), tagged with the connected Ram Ramaswamy petition and with Amazon Seller Services Private Ltd. v. Directorate of Enforcement, journalists and academics argue that the absence of any statutory requirement for a prior judicial warrant, purpose-limited imaging, or mandatory return and deletion of mirrored copies renders the current practice of cloning entire devices unconstitutional. At a hearing on 7 November 2023, a Bench of Justices S.K. Kaul and Sudhanshu Dhulia directed the Union to formulate guidelines and recorded that, pending finalization, the CBI’s (then-unpublished) manual would continue to be relied upon; the matter has since been listed periodically without a final set of guidelines being framed, and remained shown as pending as of its most recent listing update in January 2026. The petitions should be cited for what they have actually produced — a direction to the Union to consider guidelines and continuing judicial oversight — rather than as though the Supreme Court had already established a constitutional requirement of purpose-limited forensic imaging; that requirement remains the outcome the petitioners are seeking, not one the Court has yet granted.
The scale of what indiscriminate imaging can expose was illustrated in the Pegasus spyware proceedings, where a court-appointed technical committee examined numerous seized and voluntarily submitted phones for signs of unlawful surveillance — underscoring how forensic access to a device inherently exposes its entire digital life, not merely the segment relevant to a single inquiry.
On the evidentiary side, State (NCT of Delhi) v. Navjot Sandhu (the Parliament attack case) initially permitted secondary electronic evidence without a Section 65B certificate; this was overruled in Anvar P.V. and reaffirmed with added rigour in Arjun Panditrao Khotkar (2020), which made the certificate mandatory wherever the original device is not itself produced — a rule the BSA now codifies through Section 63(4)’s hash-value-and-expert certification regime, as clarified in Pune Bar Association. Separately, in P. Gopalkrishnan @ Dileep v. State of Kerala & Anr., the Supreme Court balanced an accused’s fair-trial right to inspect a memory card central to a sexual assault investigation against the survivor’s privacy, permitting controlled inspection through an independent expert rather than unrestricted possession or copying of the material — an early judicial nod toward purpose-limited, supervised handling of sensitive digital material, not a general licence to copy such material freely.
Evaluation
Despite the BNSS’s procedural modernisation — audio-video recording under Section 105, forensic-expert involvement under Section 176(3) where notified, and the BSA’s hash-verified admissibility regime under Section 63(4) as upheld in Pune Bar Association — Indian law still lacks three safeguards central to this paper’s theme.
First, no statutory data-minimisation duty binds investigators once a phone is seized. Sections 94, 105 and 185 BNSS authorise, respectively, production, recording, and search/seizure of “any document or thing” relevant to an investigation, but in practice this is executed through full bit-by-bit imaging rather than targeted extraction, since forensic laboratories are not statutorily required to justify full imaging over selective extraction. The DPDP Act’s minimisation principle does not, as explained above, translate into a binding statutory obligation on the State’s investigative arm, because Section 17(1)(c) exempts investigation and prosecution from most of the obligations Parliament has otherwise imposed on data fiduciaries.
Second, privileged material receives no procedural firewall at the point of imaging. Section 132 BSA is a rule of admissibility and disclosure, not a rule of seizure; nothing in the BNSS requires an independent “filter team”, separate from the investigating officer, to segregate privileged content before the rest of the team reviews the image — a safeguard used in comparable jurisdictions and recommended here as a policy proposal rather than read into existing law.
Third, Indian law is silent on the return or deletion of forensic copies once an investigation concludes, a charge is dropped, or an accused is acquitted. Once a mirror image is created, it typically persists on forensic servers with no statutory retention ceiling, no notice to the device owner, and no judicial mechanism to compel deletion — a lacuna the Foundation for Media Professionals petition squarely raises, and one that would benefit from a systematic mapping of BNSS provisions, BSA provisions, police manuals, forensic-laboratory protocols, applicable state rules, and case-specific judicial directions, rather than being asserted without that underlying survey.
Comparative benchmarks
In England and Wales, the Police and Criminal Evidence Act 1984 and its Codes of Practice require material outside the scope of a warrant to be returned or deleted, with privileged material handled by an independent reviewer. The U.S. Supreme Court in Riley v. California (2014) held that a phone’s storage capacity makes it qualitatively different from a physical object for search-incident-to-arrest purposes, requiring a warrant absent exigency — a proportionality logic Indian courts have gestured toward in Puttaswamy but not yet operationalized specifically for forensic imaging.
A Suggested Forensic-Imaging Protocol
Translating the above analysis into practice, investigators and forensic laboratories could usefully be guided by a sequence such as the following. This is offered as a proposed checklist for consideration, not as a summary of existing binding law:
1. Identify the offence and the specific investigative purpose for which access to the device is sought.
2. Identify the categories of data reasonably required to serve that purpose.
3. Determine whether targeted extraction is technically capable of meeting the investigative need before resorting to full imaging.
4. Record, in writing, the reasons for full imaging where targeted extraction is not adopted.
5. Create a verified forensic copy in accordance with the Virendra Khanna protocol (scene photography, RAM preservation, network isolation, and Faraday enclosure handling of SIM and battery).
6. Segregate privileged or otherwise sensitive material through an independent reviewer before the investigating team accesses the image.
7. Restrict investigator access to categories of data relevant to the specific offence under investigation.
8. Maintain access logs recording who examined the image, when, and for what purpose.
9. Define retention and deletion conditions in advance, including a default deletion point tied to the conclusion of proceedings, discharge, or acquittal.
10. Record judicial directions where applicable, particularly where access is compelled under the Virendra Khanna framework.
Conclusion
India’s new criminal-procedure and evidence codes have modernised the mechanics of digital evidence collection — audio-video recording, forensic-expert involvement where notified, and hash-verified certification as upheld in Pune Bar Association — but they have not answered the harder question this paper set out to examine: how much of a person’s digital life a criminal investigation is entitled to copy, retain, and later either return or delete. Virendra Khanna filled a legislative silence with a carefully bounded judicial protocol, but its privacy analysis, as critics note, engaged only lightly with proportionality. The Supreme Court’s continuing consideration of the Foundation for Media Professionals and Ram Ramaswamy petitions offers the most realistic near-term avenue for a binding framework covering purpose-limited imaging, independent segregation of privileged material, and mandatory return or deletion after investigation. Until then, the gap between what forensic technology permits and what proportionate criminal procedure requires remains an open and urgent question in Indian law.
Frequently Asked Questions
Q1. Does an investigating officer need a warrant before mirroring a phone?
Not invariably. A device may be produced on summons under Section 94 BNSS or seized during an authorized search, such as under Section 185 BNSS; a court direction becomes necessary chiefly where the accused refuses to cooperate and compelled access is sought, per Virendra Khanna, and even then only on an application by the investigating agency rather than a court acting on its own motion.
Q2. Can privileged lawyer-client communications found on an imaged phone be used as evidence?
No, Section 132 BSA bars disclosure of advocate-client communications without consent, subject to statutory exceptions — but this protection depends on the material being identified and flagged as privileged, since there is no automatic filtering mechanism built into the point of seizure itself.
Q3. Must a forensic copy be deleted after trial or acquittal?
There is presently no statutory deadline. Deletion is left to departmental practice, a gap under challenge in the pending Foundation for Media Professionals and Ram Ramaswamy petitions before the Supreme Court.
Q4. Does a Section 63 BSA certificate address privacy concerns about full-device imaging?
No. The certificate — comprising the Part A hash-value disclosure and the Part B expert certification, upheld in Pune Bar Association v. Union of India (2026) — speaks only to the authenticity and integrity of the record for admissibility purposes; it says nothing about the necessity or proportionality of imaging the entire device in the first place.
Q5. Can police copy an entire smartphone during an investigation?
There is no general statutory rule authorising unrestricted copying of every item on a smartphone in every investigation. The legality and scope of access depend on the applicable search, seizure, production and investigative powers, the facts of the case, and constitutional safeguards including privacy and proportionality.
References & Citations
Statutes
Bharatiya Nagarik Suraksha Sanhita, 2023, ss. 94, 105, 176(3), 185
Bharatiya Sakshya Adhiniyam, 2023, ss. 39, 63, 132, and the Schedule
Indian Evidence Act, 1872 (repealed w.e.f. 1 July 2024), ss. 65B, 126
Information Technology Act, 2000, ss. 69, 79A
Digital Personal Data Protection Act, 2023, ss. 4, 17
Digital Personal Data Protection Rules, 2025 (notified 13–14 November 2025)
Constitution of India, arts. 20(3), 21
Police and Criminal Evidence Act 1984 (UK) and accompanying Codes of Practice
Cases
K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1
Selvi v. State of Karnataka, (2010) 7 SCC 263
Virendra Khanna v. State of Karnataka, WP No. 11759/2020, Karnataka HC (12 March 2021)
Foundation for Media Professionals v. Union of India, W.P.(Crl.) No. 395/2022 (SC, pending)
Ram Ramaswamy v. Union of India (SC, pending, tagged with the above)
Amazon Seller Services Private Ltd. v. Directorate of Enforcement (SC, tagged with the above)
Anvar P.V. v. P.K. Basheer, (2014) 10 SCC 473
Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1
State (NCT of Delhi) v. Navjot Sandhu, (2005) 11 SCC 600
Rollymol v. State of Kerala, Kerala HC (BNSS technology observations)
P. Gopalkrishnan @ Dileep v. State of Kerala & Anr., Supreme Court of India (2019)
Riley v. California, 573 U.S. 373 (2014) [U.S. Supreme Court]
Pune Bar Association v. Union of India, W.P.(Civil) No. 599/2026, Supreme Court of India (22 May 2026)
Maneka Gandhi v. Union of India, 1978 AIR 597, 1978 SCR (2) 621
