Emerging Challenges In The Field Of Cyber Forensics And Digital Evidence
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
EMERGING
CHALLENGES
IN THE FIELD OF CYBER FORENSICS AND DIGITAL EVIDENCE Rachit Sharma, Assistant Professor, IILM University, Greater Noida Shreeji Saraf, IILM University, Greater Noida A. Introduction The field of crime, investigation and law has undergone significant transformations in the digital world which has given rise to cyber forensics and digital evidence. Another term for cyber forensics is digital forensics. Nowadays digital devices have become a part of our day to day life. Starting from emails to cloud storage, these all act as digital evidence. The role of digital evidence has significantly broadened across civil and criminal litigations. It has become important to ensure their admissibility and integrity is maintained. There is a combination of legal frameworks which govern the same. Although there have been various advancements it has given rise to several challenges even. B.
Definition and scope I. What is cyber forensics?
Digital forensics is also considered as cyber forensics. It can be understood as the practice of the application of various techniques like scientific and investigative for withdrawing information, analyzing the data and gathering data. This is even used in the collection, preservation, and identification of evidence. This evidence is then presented in the court of law. Cyber forensics was formally introduced in the 1980’s. With the advancement in the field of computers, an increase was noticed in criminal activities in the digital world. It became difficult to handle these types of cases with traditional forensics techniques. To handle these types of cases cyber forensics was introduced. 1 There are several phases involved in the procedure of cyber forensics. The investigation procedure of cyber forensics involves key stages like identification, preservation, analysis,
1 SLUNK, https://www.splunk.com/en_us/blog/learn/cyber-forensics.html, (last visited April 23, 2025)
documentation and presentation. Forensic investigators are bound to follow these principles to ensure that there is completeness, and integrity, of the forensic evidence. The field of cyber forensics can be further classified or divided into the following domains:2 • Digital crime investigation • Collection and preservation of evidence • Analysis of malware • Research and development • Forensic data recovery • Network forensics II. What is digital evidence?
Digital evidence can be referred to as any information or data that is considered of value to an investigation. This type of evidence is usually stored in an electronic device. 3 The evidence primarily consists of digital video, computer data, mobile phones, etc. Digital evidence is that evidence which is stored electronically and presented in a court of law. This type of evidence is not stored in traditional paper documents. There are various forms or sources of digital evidence. Some of these are stated below:4 • Emails • Social media like posts and personal messages. • Audio and video recordings
2 SCOPE
OF CYBER FORENSIC, LINKEDIN, https://www.linkedin.com/pulse/scope-cyber-forensics-savivelaayutham-7rcgc/, (last visited April 23, 2025) IACP CYBER CENTER, https://www.iacpcybercenter.org/officers/cyber-crime-investigations/digitalevidence/#:~:text=Digital%20evidence%20is%20any%20information,common%20types%20of%20digital%20e vidence, (last visited on April 23, 2025) 4 BLOG IPLEADERS, https://blog.ipleaders.in/all-about-digital-evidence/#What_is_digital_evidence, (last visited on April 23, 2025)
Surveillance system which includes CCTV footage • Cloud storage which consists of documents and backups
III. Scope of digital evidence There has been continued growth in the digital world because of which digital evidence is expanding. Digital evidence is seen to play an important role in both the domain of civil and criminal litigation. In criminal investigation, digital evidence has its relevance in the field of cybercrimes, terrorism, organized crime, etc. For example, the court had placed its relevance on the chat logs of WhatsApp and GPS data location as an admissible form of evidence in the case of State v. Balu5. In civil litigation, digital evidence has its relevance in the cases of defamation and breach of contract. 6 IV. Importance in the legal proceedings Cyber forensics and digital evidence have appeared to be important tools that play a significant role in the field of crime and legal proceedings.
Both of these technologies have significantly contributed to both civil and criminal cases by preserving electronic data. Cyber forensics have aided in preserving digital data and making sure its admissibility and integrity is maintained so that it can be presented in a court of law. Digital data can be very easily altered. Indian courts have accepted digital evidence as per the Indian Evidence Act, of 1872. The specific sections that deal with the admissibility of electronic records are Sections 65A & 65B. An increasing dependence seems to have been placed in the cyber forensic reports in the cases of data breach, cyber stalking, etc. These reports assist the judiciary in reaching the correct decision. The Supreme Court further in the case of Arjun Panditrao Khotkar v.
Kailash Kushanrao Gorantryal7 put forward that there are certain conditions that need to be adhered to in the case relating to the scope and application of digital evidence. The conditions outlined by the court were that proper authentication and certification are required in this regard.
5 2022
6 BLOG IPLEADERS, https://blog.ipleaders.in/all-about-digital-evidence/#What_is_digital_evidence, (last visited on April 23, 2025)
7 7 SCC 1 (2020)
C. Legal framework related to Cyber Forensics and Digital Evidence I. Laws governing Digital Evidence With several advancements in the digital world, there has been a change in which manner evidence is stored, and presented in the courts. Digital evidence now plays a significant role in both the civil and criminal proceedings. Digital evidence in India is governed by the combination of various laws and precedents. Ø Indian Evidence Act, 1872 The first and foremost act that seems to hold huge importance in the field of digital evidence is the Indian Evidence Act, 1872. Earlier this act didn’t contain any provision that was directly related to the digital evidence. After an amendment was made to act in the year 2000, Section 65B dealt with digital evidence. This section gave legal recognition to the digital evidence.
Section 65B lays out that emails or digital documents that are a part of the electronic record are now acceptable and admissible in a court of law. Section 65A deals with the list of requirements that must be adhered to for the admissibility of the electronic evidence. This section further goes on to clarify that if any information or data is stored or is part of the electronic record like files saved on the computer, it can be presented in the court without showing the original device. In this case, the conditions must be complied with. 8 However, the Indian Evidence Act has been replaced by the Bharatiya Sakshya Adhiniyam,
2023. The act was seen to bring several changes in the provisions regarding digital evidence
but many still remain the same. Section 2(e) of the act mentioned that evidence is categorized into two forms like oral evidence and documentary evidence. The act even stated that now digital evidence shall be considered as primary evidence. The act seemed to have increased the evidentiary value of the digital evidence. 9 8 LAWS OF INDIA, https://lawsofindia. com/2023/09/02/electronic-evidence-in-the-indian-evidence-actnavigating-the-digital-frontier/, (last visited on April 24, 2025) 9 BLOG IPLEADERS, https://blog. ipleaders. in/all-about-digitalevidence/#Admissibility_of_digital_evidence_in_Indian_Law, (last visited on April 24, 2025) Ø Information Technology Act, 2000 This act was mainly enacted to give legal recognition to digital signatures and electronic records. Sections 4 and 5 of the act dealt with the above provisions.
Digital evidence consists of digital signatures and electronic records even. Section 4 clarifies that “if the law requires any information to be in writing, the same shall be accepted in the electronic form as long as it can be accessed in the future”. Section 5 has given legal recognition to electronic signatures. It states that “if a law requires a signature, the same shall be accepted in the form of electronic signature. The Information Technology Act was amended in the year 2008, which brought some changes under Section 79A. This section clarifies that an appointment of an examiner of electronic evidence is deemed compulsory for the central government. The person who shall be appointed will provide expert opinions and suggestions on electronic evidence in court. 10 II. Important Legal Precedents concerning Digital Evidence
The Supreme Court in the case Anvar P. V. v. P. K. Basheer11 redefined the admissibility criteria with regard to the electronic evidence under the Indian Evidence Act, 1872. The court further laid down that if any electronic evidence or record needs to be treated as secondary evidence it is a mandatory requirement of a certificate under section 65B (4). If there is an absence of a certificate then the electronic evidence remains inadmissible. The judgement further went on to highlight the importance of adhering to procedural laws to ensure that electronic records are reliable and their integrity is maintained. • It was in the case of Shafhi Mohammad v. State of Himachal Pradesh12 that the Supreme Court had laid down some flexibility for the requirement of a certificate under Section 65B (4) in certain cases.
The court specified that if the person didn’t have possession of the device that produced the electronic record, they were not required to produce the certificate. The primary object was to lessen the difficulties and to make sure that evidence is not denied just because of procedural difficulties. 13
10 BLOG IPLEADERS, https://blog.ipleaders.in/all-about-digital
evidence/#Admissibility_of_digital_evidence_in_Indian_Law, (last visited on April 24, 2025)
11 (2014) 10 SCC 473
12 2018 5 SCC 311
13CENTURY LAW FIRM BLOG, https://www. centurylawfirm. in/blog/the-complete-guide-to-electronicrecords-evidence-in-indian-law/, (last visited on April 25, 2025) III. Laws governing Cyber Forensics In India cyber forensics is governed by a combination of statutes. These statutes collectively deal with the admissibility of digital evidence, and how is it collected and protected. The main laws that deal with it are listed below: Ø Information Technology Act, 2000 Information Technology Act is considered one of the foundational and key acts for cybercrimes and digital evidence. Section 4 provides legal recognition of electronic records. This act has even provided legal status to digital signatures. By granting such a recognition it aids in the verification of electronic documents. This act contains several provisions related to cybercrimes like hacking, unauthorized access and more.
This is mostly covered under Section
67 of the act. Further Section 79A authorizes the government to designate forensic labs. These
forensic labs will serve as the official examiners to officially certify digital evidence. 14 Ø Indian Evidence Act 1872 This act was amended by the Information Technology Act which seems to have provided the rules on how digital evidence shall be used in a court of law. Section 3(2) of the act has broadened the scope of documents. It started including electronic records to help make digital evidence, acceptable and admissible in a court of law. Sections 65A and 65B similarly specify the rules and conditions on how electronic records shall be submitted. 15 Ø Digital Personal Data Protection Act, 2023 (DPDP Act) The data privacy rules set by the DPDP Act are in direct connection with the cyber forensic practice. This directly impacts cyber forensics, especially in the case of handling and examination of personal digital data.
While conducting any investigations forensic experts are now required to align their practices with that of the privacy rules. For example, in the case of collection of evidence laws regarding data protection should be kept in mind. When any authority or enforcement agency is collecting or accessing the personal data of any individual, 14INDIA CODE, https://www. indiacode. nic. in/bitstream/123456789/13116/1/it_act_2000_updated. pdf, (last visited on April 25, 2025) 15MCRHRD, https://www. mcrhrdi. gov. in/FC2020/week11/IT%20Act%202000%20- %20Digital%20evidence. pdf, (last visited on April 25, 2025) the same should be done with the consent of that individual. Consent must be asked for before accessing the personal data. For which reason the data is being collected, it should be used for that specific reason only.
Forensic investigators or experts are to take all the required steps for the protection of the data. Ø Bharatiya Nagarik Suraksha Sanhita, 2023 This act has replaced the Criminal Procedure Code. This act now introduces an updated version of how criminal investigations must be carried out. Forensic experts are now required to visit the crimes for the collection of evidence for crimes whose punishment are more than 7 years or seven years. The evidence collected must be recorded electronically. Trials and inquires of the criminal investigation could take place in online mode. The electronic devices that contain the evidence related to of the investigation can be produced in a court of law. If there is an electronic recording of the evidence collected, this would maintain a chain of custody. IV. Important Legal Precedents concerning Cyber Forensics
The case of the State of Tamil Nadu V. Suhas Katti16 was the first and foremost case that was registered under the Information Technology Act for posting obscene material online. The accused in this case was found guilty and convicted under section 67 for the offense of sending obscene messages electronically. This case was seen as an example in the field of digital evidence. This case clearly presented if there is proper collection and verification of digital evidence, this can aid in the conviction of any accused in a court of law. This case even showcased what is the role of cyber forensics in criminal investigation. this case further provided that emails and digital records shall be considered valid and admissible as a strong form of evidence in the court. • In the case of Arjun Panditrao Khotkar v.
Kailash Kushanrao Gorantyal17 the Supreme Court put out that certificate is of extreme importance when electronic evidence is submitted or admitted as evidence in the court. Under Section 165 of the Indian Evidence Act, the court has the authority to call the person who refuses to submit the certificate. All the conditions mentioned under Section 65B (4) must be complied with.
16 CC No. 4680 of 2004
17 (2020) 7 SCR 180
D. Challenges arising in the field of Cyber Forensics and Digital Evidence?
In today’s legal field analysis of cyber forensic and digital evidence is seen as great importance and is crucial. Although there are several challenges that arises with it. These challenges can be categorized into 2 categories technical and legal. I. Technical challenges
Cloud storage- Cloud computing has completely transformed the way data is stored and accessed but it has introduced several challenges for digital forensics. Data in this is stored at many servers which are located in different places. This makes it difficult for the investigators to access the data as they would require the permission of the cloud service providers. Cloud data is considered to be volatile. By this one can understand that data is created and deleted quickly. So, this data needs to be captured at the right time, before it is lost. 18 • Encryption- Encryption has helped in the protection of data but it becomes difficult to access it without the decrypted keys. Many service providers employ end-to-end encryption.
In certain scenarios when it is important to access data for lawful and legal purposes because of this end-to-end encryption the service providers are not even able to access the data. This serves as a big challenge. 19 • Remote access and dispersed data- There has been a rise in remote work which has led to data being stored in a scattered manner. This has created various challenges. It has become difficult to keep track of who has altered or changed the data last in the remote work. It is extremely important to keep track of it as it is mainly for court use. In addition to this, it becomes difficult for the investigators to access the data that is stored in the personal device. This access is not possible without direct access.
II. Legal challenges
Admissibility of digital evidence- Above we have noted that Sections 65A & 65B of the Indian Evidence Act deal with the provision of digital evidence that can be presented
18 MDPI, https://www.mdpi.com/2073-431X/13/8/213, (last visited on April 26, 2025)
19 MDPI, https://www.mdpi.com/2922422, (last visited on April 26, 2025)
in the court. It was established in the case that a certificate is needed while submitting the electronic record. However, in many cases obtaining this certificate can be challenging. For example, if the data is retrieved from third party apps or companies. 20 • Complication in the legal framework- Many investigations are cross borders and every country has different laws and legal frameworks. This poses a challenge in evidence collection. There exists a huge gap between technological advancement and law. This creates a hurdle in investigations as there are unclear laws and legal frameworks. 21 • Data privacy laws- These laws present a challenge when data is required to be accessed for some investigation purpose. The general data protection regulation has clearly indicated that consent is required of the user before accessing the data. This creates a hurdle. E.
Conclusion The administration of justice has strengthened with the introduction and implementation of fields like cyber forensics and digital evidence. Indian courts have started relying on digital evidence but there are serval laws that help ensure its preservation and admissibility. The challenges that are being faced, it has become extremely important to provide a solution for the same. If there is a gap between technological advancement and law, it becomes essential to bridge this gap to ensure that the delivery of justice is not hampered. A combination of new forensic techniques, and updated legal frameworks can play an essential role in combating the challenges and hurdles that arise. 20 LAWYERS SARC, https://lawyersarc. in/digital-evidence-admissibility-and-challenges/, (last visited on April 26, 2025) 21IJCNIS ORG, https://ijcnis. org/index.
php/ijcnis/article/view/7142, (last visited on April 26, 2025)