Indian Kanoon - Search engine for Indian Law

During an Income Tax search operation, technical forensics personnel is responsible for assisting the Income Tax Department in imaging and cloning digital devices found at the premises, which may contain crucial data related to the concerned party.

The procedure of seizure of electronic devices as well as imaging and cloning of digital devices is carried on in accordance with the Search and seizure manual (last updated in 2025) and Digital Evidence Investigation Manual 2014.

The forensics expert employs specialized tools while creating backups or images of the digital evidence to maintain its integrity, ensuring that no data from the original device is altered or tampered with during the cloning process. This ensures that the original evidence remains untouched throughout the acquisition process. Once the imaging/cloning is complete, the software used generates results that may vary depending on the tool; however, two consistent and critical outputs are provided by all: the forensic image of the original evidence and the hash value--a unique digital fingerprint representing all the information stored on the original device. Hash values are generated using cryptographic algorithms through a process known as hashing. Hashing is a one-way function that transforms any amount of data into a fixed-length string of characters, known as the digest. This digest is non-reversible--meaning it cannot be decrypted or traced back to the original content--and is therefore used as a digital fingerprint for the data. Even a minor change in the original dataset would result in a completely different hash value, which makes it an effective mechanism for data integrity verification.

Hash value can be generated of any data set and it's a data unique value. Which mean, if two data sets having exactly the same data will be having the same Hash value. This function of hashing is used for ta integrity check in case of tampering of data after a hash value is produced. Majorly two types of hashing algorithm are used i.e., MD5 and SHAI.

MD5 (Message Digest Algorithm 5): Produces a 128-bit hash value. It is efficient and widely supported across forensic platforms, and primarily used as a checksum to detect unintentional data corruption. SHA-1 (Secure Hash Algorithm 1): Produces a 160-bit hash value, typically rendered as a 40-character hexadecimal string. It provides a higher level of uniqueness and is often used for evidence validation in legal settings.

iii. A reliable and validated duplication process was used.

iv. All media were secure and safe.

Based on above, the chain of custody of the seized electronic evidence was never compromised in the process described above and followed in the case of the assessee. The cloned data is stored in 2 devices, 'a Working Copy' and 'a Master copy'. And the master copy is sealed permanently and is never desealed. The hash value (i.e.--a unique digital fingerprint representing all theinformation stored ontheoriginal device) is generated which remains the same throughout the search proceedings and later on during the assessment proceedings. The unique hash value remains same for a particular electronic evidence/data set. Moreover, since the Master copy remains sealed, the question of compromise of the chain of custody does not arise. Further, the entire seized material is handed over by the Investigation Wing to the Assessing Officer in Central Circle through a handing over note (A copy of the same in case of the assessee is attached herewith). The handing ITAs No.3094; 3143 to 3148 & 3422 to 3426/Del/2023 over note is the document which evidences that the entire seized material including the electronic devices and evidences is handed over to the assessing officer in the central circle. Even during this stage, the Master copy of the electronic evidence is not opened and remains sealed. Therefore, the chain of custody as well as the hash value remains intact and uncompromised.

26. However, when we examine the Panchnama, the copy of which was file at hearing, there is absolutely no whisper of the hash value of these digital devices and evidences in the Panchnama. There is no mention of IMEI numbers of the devices shown seized in the Panchnama.

27. The Revenue has then relied mobile device collection form of two phones and they make it apparent that the mobile collection forms are dated 23.03.2021 while signatures of the Mr. Vimal Jain, authorized officer, Forensic examiner and two witnesses are dated 24.03.2021. Time column in the form is left blank. Mobile device collection form does mention MD5 hash value and SHA1 hash value of the ITAs No.3094; 3143 to 3148 & 3422 to 3426/Del/2023 two devices, which were impounded at the time of seizure of these devices and hash value of one external drive used to copy the content of all the digital devices seized.