Preserve; do not alter
Once a person is aware that a device or account may be relevant to an investigation, deleting chats, resetting a phone or manipulating records can create serious evidentiary issues. Preserve potentially relevant material and obtain case-specific advice before taking steps that may change the data.
Imaging and hash values
Delhi Police's published IFSO material describes cyber-forensic capabilities including extraction of deleted data, imaging and hash-value calculation, forensic servers and tools for mobile devices. A hash can assist in demonstrating whether a forensic image/file remains unchanged, but its significance depends on how the evidence was acquired and documented.
Context matters
A screenshot alone may omit the account identity, URL, timestamp, surrounding conversation or metadata. Depending on the dispute, investigators or courts may need original device/platform records, server records or properly proved electronic evidence.
Keep procedural records
Where a device or digital storage item is taken during an investigation, preserve copies of the notice, seizure memo or other documentation actually supplied. Record the device description and identifiers shown in the documentation and keep subsequent correspondence concerning examination or return.
Primary sources
- Delhi Police RTI Manual – IFSO / Cyber Crime mandate and 1930 helpline
- National Cyber Crime Reporting Portal (NCRP)
Frequently asked questions
What is a hash value in digital forensics?
A hash is a computed value used to help identify data and test whether the data represented by that hash has changed. Its evidentiary significance depends on acquisition and documentation.
Is a screenshot always enough to prove a chat?
Not necessarily. Authenticity, completeness, account identity, metadata and the applicable rules for proving electronic records can become relevant.
Should I factory-reset a phone before an investigation?
Do not destroy or alter potentially relevant evidence. Obtain case-specific legal advice before taking any step that changes data on a relevant device.