The forensic science behind screenshots, digital evidence and their use in India
You are lying in bed scrolling through your phone when a WhatsApp message lands — something threatening, or a payment confirmation that does not add up, or a comment on Instagram that crosses a line. Your thumb moves before you have even finished reading: volume-down, power button, done. Screenshot saved. It feels like you have just captured proof.
Most of us take screenshots as a reflex — a receipt, a joke, a chat we might need later. And yet almost nobody pauses to ask the harder question buried inside that reflex: is a screenshot actually evidence as India's forensic science and evidence law in India understand the term? Can it stand up in an investigation, or in court, or is it just a picture of a picture?
The honest answer is neither a comforting "yes" nor a dismissive "no." A screenshot can matter — sometimes decisively — but whether it does depends on things most phone users never think about: where it came from, whether it can be tied back to a real device and a real account, whether it has been altered, and whether it satisfies the specific requirements Indian law has built for electronic records. This article walks through the forensic science and the legal framework together, using the everyday screenshot as the entry point.
Can a Screenshot Really Be Used as Evidence?
Short answer: a screenshot can potentially form part of an evidentiary record, but its evidentiary value depends on authenticity, provenance, integrity, relevance, applicable legal requirements, and the surrounding evidence around it.
Under the Bharatiya Sakshya Adhiniyam, 2023 (BSA) — the law that replaced the Indian Evidence Act, 1872 with effect from 1 July 2024 — an electronic or digital record cannot be denied admissibility purely because it is electronic. [Source: Bharatiya Sakshya Adhiniyam, 2023, Section 61, India Code] But that recognition is explicitly made "subject to Section 63," the provision that actually governs how an electronic record, including something derived from a phone screen, gets admitted. [Source: Bharatiya Sakshya Adhiniyam, 2023, Section 61 and Section 63] A screenshot as a bare image file, by itself, is not automatically treated as equivalent to the message, chat, or post it depicts — a distinction this article returns to repeatedly.
What Exactly Is a Screenshot?
A screenshot is, at its simplest, an image file generated by the operating system that captures whatever pixels were being rendered on the screen at that instant. It is not a copy of the underlying data — the message text sitting in an app's database, the metadata tagged to a photo, or the routing headers of an email. It is a picture of a display, produced after the original content has already passed through an app's interface, been laid out, rendered, and shown to the eye.
That distinction sounds pedantic until you consider what gets lost along the way: sender and receiver identifiers stored by the app but not shown on screen, delivery and read timestamps in formats the interface simplifies for humans, message IDs, encryption metadata, and the wider conversation thread that never made it into the frame. A screenshot preserves appearance. It does not preserve the record.
Screenshot vs Original Digital Evidence
It helps to lay the two side by side. The comparison below is illustrative, not a formal legal test — but it captures why examiners and courts treat a raw screenshot with more caution than the record it came from.
| Aspect | Screenshot | Original Electronic Record |
|---|---|---|
| What it captures | Only the visible portion of the screen at one moment | The full underlying data as stored by the app or device |
| Metadata | Limited — often just the screenshot's own creation timestamp; app-level metadata usually stripped | Can include sender/receiver IDs, delivery status, message IDs, application logs |
| Context | Frequently cropped to one message or thread; surrounding conversation may be excluded | Preserves the full thread and sequence, if properly exported |
| Editability | Trivially edited using ordinary photo or screen-editing tools | Harder to alter without leaving traces in app or device logs |
| Authentication route | Requires independent corroboration and, where relied on as secondary evidence, compliance with Section 63 BSA | Can be authenticated through the device, application data, or a properly certified export |
| Forensic value | Useful as a lead or corroborating item; weaker in isolation | Stronger starting point for examination when preserved and hashed |
| Key limitation | Cannot, by itself, prove who typed the message or that nothing was altered before capture | May still require certification and corroboration to establish authorship |
Can a Screenshot Be Manipulated?
Yes — and this is precisely why forensic and legal systems treat a bare screenshot with caution rather than blanket trust. At a high level, screenshots can be altered through cropping (removing context that changes meaning), text editing (replacing displayed words), image compositing (merging elements from different sources), reordering messages, or simply cutting out the parts of a conversation that do not support the story being told. None of this requires advanced skill; basic photo-editing tools are enough to produce something that looks convincing at a glance.
This article deliberately does not explain how to perform such edits or how to defeat detection — that would work against the very reason screenshots are scrutinised. What matters for a reader is the reverse: understanding that manipulation is easy enough that a screenshot's appearance of authenticity is not, by itself, proof of authenticity.
What Do Forensic Examiners Look For?
A digital forensic examiner does not simply look at a screenshot and pronounce it real or fake. Following recognised practice in the field — the Scientific Working Group on Digital Evidence (SWGDE) publishes detailed guidelines for forensic image analysis and image authentication — an examiner's approach typically draws on several categories of information together, not any single one in isolation. [Source: SWGDE, Guidelines for Forensic Image Analysis, 16-I-002; SWGDE, Best Practices for Image Authentication, 18-I-001]
Broadly, this includes the claimed source and original device; the file's own properties; whatever metadata survives; characteristics of the image itself, including compression patterns introduced by repeated saving, sharing, or app compression; visible inconsistencies in fonts, alignment, or pixel structure; the wider context in which the screenshot was produced; related digital artifacts on the device or in the app's own records; corroborating evidence from other sources; the integrity of the file as verified by hash values where available; and a documented chain of custody from collection to presentation. SWGDE's own guidance is explicit that authentication is strongest when a single image can be compared against a series of related images or video, precisely because a single still frame can conceal manipulation that a trained examiner may not detect. [Source: SWGDE, Best Practices for Image Authentication, 18-I-001]
Why Metadata Does NOT Automatically Prove a Screenshot Is Genuine
Metadata has an outsized reputation. In popular imagination, "checking the metadata" settles the question of whether a file is real. The reality is narrower. Metadata can be a useful data point — a creation timestamp, a device model, a file format signature — but screenshots typically carry far less metadata than the original photograph or message record would, and much of what remains is easily edited, stripped, or regenerated when a file is re-saved, compressed, or forwarded through a messaging app.
SWGDE's own integrity guidance frames metadata and hashing as tools for confirming that a file has not changed since it was acquired — not as a standalone guarantee that the content was genuine at the moment of capture. [Source: SWGDE, Best Practices for Maintaining the Integrity of Imagery, 17-I-001] In other words, metadata must always be read in context, alongside the other categories of examination described above, rather than treated as a single decisive test.
WhatsApp, Instagram and Social-Media Screenshots
The overwhelming majority of everyday screenshots that end up mattering in disputes come from a small set of sources: WhatsApp chats, Instagram DMs, Facebook posts, Telegram messages, emails, UPI or payment confirmations, and social-media profile pages. Each of these is generated by a platform that stores far more than what appears on screen — and none of that additional information travels with a plain screenshot.
Legal commentary on the current framework is direct about this: a bare, cropped screenshot is considered one of the weakest forms in which to present a chat, precisely because it carries little metadata, is easy to edit, and cannot be verified through a hash value the way a properly exported chat file can. [Source: iPleaders, "Electronic evidence under the BSA, 2023," July 2026] A screenshot of a WhatsApp conversation should not be assumed to be the complete or unquestionable record of that conversation — it is one representation of it, and the platform's own export and the device itself generally carry more evidentiary weight.
What Does Indian Law Say About Electronic Evidence?
Since 1 July 2024, electronic evidence in India is governed by the Bharatiya Sakshya Adhiniyam, 2023, which replaced the Indian Evidence Act, 1872 (and, within it, the well-known Section 65B). [Source: Bharatiya Sakshya Adhiniyam, 2023, effective 1 July 2024] Three sections work together:
- Section 61 is a recognition clause: an electronic or digital record cannot be denied admissibility merely for being electronic, and — subject to Section 63 — it has the same legal effect as any other document. [Source: Bharatiya Sakshya Adhiniyam, 2023, Section 61]
- Section 62 is a short routing provision: the contents of an electronic record are to be proved in accordance with Section 63. [Source: Bharatiya Sakshya Adhiniyam, 2023, Section 62]
- Section 63 does the substantive work. It provides that information contained in an electronic record — printed, stored, or copied on optical or magnetic media, semiconductor memory, or produced by "a computer or any communication device" — is deemed a document and can be admitted without producing the original, provided specified conditions are satisfied and a certificate accompanies the record. [Source: Bharatiya Sakshya Adhiniyam, 2023, Section 63(1)]
That certificate, required under Section 63(4), must identify the record, describe how it was produced, give details of the device involved, and — under the current framework — be signed both by the person in charge of the device or activity and by an expert, along with the record's hash value. [Source: Bharatiya Sakshya Adhiniyam, 2023, Section 63(4); ksandk.com, "Section 63 Bharatiya Sakshya Adhiniyam, 2023"] This is a meaningful expansion on the old single-signatory certificate under Section 65B of the 1872 Act.
None of this means "every screenshot needs a certificate" in a simplistic sense. Certification under Section 63 applies to electronic records being led as secondary evidence — copies, printouts, or exports, which is how a screenshot would ordinarily be treated. Where the original device itself is produced and its owner testifies to it directly, the record can instead be treated as primary evidence, and the Section 63 certificate route does not govern in the same way. [Source: Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1, Supreme Court of India] In practice, producing the original device to a court is rare, which is why the certificate route is the one most screenshots and chat exports must pass through.
Admissibility of any specific piece of electronic evidence depends on the facts of the case and the applicable law and procedure at the time it is presented. This article is educational and does not constitute legal advice. For a specific matter, consult a qualified advocate.
A Case Worth Knowing: Arjun Panditrao Khotkar (2020)
Although this case did not concern a screenshot specifically, its treatment of electronic evidence is directly relevant to understanding the broader evidentiary framework screenshots now sit inside. In Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1, a three-judge bench of the Supreme Court held that a certificate under the (then) Section 65B of the Evidence Act, 1872 is a mandatory pre-requisite for admitting an electronic record as secondary evidence, and clarified that where a party cannot obtain that certificate from a person or entity in control of the source device, they may apply to the court, which has the power to direct its production. [Source: Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1, Supreme Court of India, 14 July 2020] That reasoning — mandatory certification for secondary evidence, with a judicial remedy if a party cannot obtain the certificate independently — is the foundation Section 63 of the BSA now carries forward.
Is a Screenshot the Same as the Original Message?
No. A screenshot is a downstream product — several steps removed from the record it depicts. Each step in that chain is a point where information can be lost, and, in principle, a point where something could go wrong or be altered.
Can a Screenshot Alone Prove Who Sent a Message?
Not by itself, and this is one of the more consequential misconceptions people carry. A screenshot can show what was displayed — the text, a display name, a profile picture. What it cannot do on its own is establish who actually typed and sent that message. Legal commentary on WhatsApp evidence makes this point plainly: a chat, even properly exported, proves what was said, not who said it — a delivery or "read" indicator shows that a message reached a particular device, not the identity of the human operating it. [Source: iPleaders, "Electronic evidence under the BSA, 2023," July 2026] Establishing authorship typically requires additional evidence — telecom subscriber records linking a number to a person, device-level forensic examination, or other corroborating material — considered together with the screenshot rather than in place of it.
What Makes Digital Evidence More Reliable?
- Preserve the original message, chat, or file wherever possible — do not rely on a screenshot alone if the original is still accessible
- Preserve context — keep the surrounding conversation, not just the isolated portion
- Record how, when, and by whom the material was obtained
- Avoid unnecessary alteration, cropping, or re-saving that could strip useful information
- Preserve the source device where appropriate, rather than only a copy
- Maintain a documented chain of custody from collection onward
- Use proper forensic acquisition and certification (Section 63 BSA) when the record is intended for legal proceedings
- Seek professional or legal advice where the material may become important evidence
Screenshot Evidence: Myth vs Fact
What Should You Do If a Screenshot May Become Important Evidence?
If you think a screenshot might matter later — in a workplace complaint, a police report, a family dispute, or any formal process — the responsible approach is preservation, not alteration. Keep the original app conversation intact rather than deleting it once you have the screenshot. Where the app allows it, use a proper chat-export function rather than relying solely on a cropped image. Note down when and how you took the screenshot. Avoid renaming files, editing images, or stripping any information from them in an attempt to "clean up" the evidence — this can undermine its credibility rather than help it. If the matter is serious, consult a lawyer or approach the appropriate authority early, so that preservation and certification requirements can be handled correctly from the outset.
The Future of Screenshot Evidence in the Age of AI
Generative AI tools capable of producing convincing fake chat interfaces, synthetic images, and manipulated conversations are becoming more accessible, which raises the stakes for authentication generally. This does not mean forensic science has lost the ability to detect manipulation — examiners continue to rely on the layered approach described earlier, and legal frameworks have been adapting in response. The current certificate regime under Section 63 of the BSA, for instance, was specifically challenged as excessive and was upheld by the Supreme Court, which described the hash value requirement as functioning like an "electronic fingerprint" for verifying that a record has not been tampered with. [Source: Pune Bar Association v. Union of India, Writ Petition (Civil) No. 599 of 2026, Supreme Court of India, May 2026, as reported by LiveLaw and Verdictum] What this points to is not that screenshots are becoming unusable as evidence, but that provenance, certification, and forensic verification are becoming more central to how any digital record — screenshot or otherwise — is treated going forward. Current forensic capabilities remain limited in some respects, and claims about AI-detection should not be overstated.
Final Verdict: Can a Screenshot Really Be Used as Evidence?
A screenshot can be important evidence, but a screenshot is not automatically unquestionable proof.
The central lesson is not that screenshots are worthless, nor that they are automatically reliable. It is that a screenshot's evidentiary weight is earned, not assumed — through preservation, corroboration, and, where the law requires it, proper certification under the Bharatiya Sakshya Adhiniyam, 2023. The next time your thumb reaches for that screenshot shortcut, it is worth remembering: what you are capturing is a picture of a moment, not the moment itself — and how you handle it afterward often matters as much as the screenshot did in the first place.
Sources & References
Primary Legal Sources
- Bharatiya Sakshya Adhiniyam, 2023, Section 61 (Electronic or digital record). India Code / Ministry of Home Affairs. indiacode.nic.in
- Bharatiya Sakshya Adhiniyam, 2023, Section 62 (Special provisions as to evidence relating to electronic record). India Code.
- Bharatiya Sakshya Adhiniyam, 2023, Section 63 (Admissibility of electronic records). India Code / Indian Kanoon. In force from 1 July 2024.
Case Law
- Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1. Supreme Court of India, three-judge bench, 14 July 2020. indiankanoon.org
- Pune Bar Association v. Union of India, Writ Petition (Civil) No. 599 of 2026. Supreme Court of India, three-judge bench, May 2026 (upholding Section 63(4) certificate and hash-value requirements). Reported via Verdictum.
Forensic / Technical Sources
- Scientific Working Group on Digital Evidence (SWGDE), Guidelines for Forensic Image Analysis, 16-I-002. swgde.org
- SWGDE, Best Practices for Image Authentication, 18-I-001. swgde.org
- SWGDE, Best Practices for Maintaining the Integrity of Imagery, 17-I-001. swgde.org
Academic / Journalism Sources
- Agarwal, Priyanka. "Electronic evidence under the BSA, 2023." iPleaders, 1 July 2026. blog.ipleaders.in
- "Section 63 Bharatiya Sakshya Adhiniyam, 2023." ksandk.com (Law Firm). ksandk.com
Sources accessed August 2026. This article is for general educational purposes and does not constitute legal advice.
