CBDT releases Digital Evidence Investigation Manual

Introduction & Background

1.1. Introduction

One of the most significant and influential inventions of 20th century was the Computer. There has been a sea change in the purposes and the manner in which computers are used with advent of microprocessor technology and digital communication. The computer started with being a giant calculating machine. It then metamorphosed itself into a stand­alone personal tool for performing assorted routine tasks like word processing and accounting and then to toZaD\s FN Qork ZNvicN LI

NrllNa iFg virtually everything including instantaneous and global personal and business interaction. The way business is conducted and records are maintained today is a far cry from days past. Accordingly, in enforcement agencies including the Income tax department, more and more information is being stored, transmitted or processed in digital form.

The law of the country has also taken cognizance of this reality. The Information Technology Act, 2000 has been enacted recognising electronic records as evidence, governing access to and acquisition of digital and electronic evidence from individuals, corporate bodies and/ or from the public domain. By way of this enactment, amendments were also brought in other laws like Indian Penal Code, Indian Evidence Act and Criminal Procedure Code, (Cr.PC). The Income-tax Act, 1961 has also been amended thrice by way of Finance Act 2001, Finance Act 2002 and Finance Act 2009 thereby according recognition to electronic evidence, facilitating access to them and giving when need be, powers to impound and seize them. By Finance Act, 2001, Clause (22AA) was inserted in Section 2 to provide that the term “document” in Income Tax Act, 1961, includes an electronic record as defined in clause (t) of sub-section (1) of section 2 of the Information Technology Act, 2000. By Finance Act, 2002, Clause (iib) was inserted in Sub-Section (1) of Section 132 requiring any person who is found to be in possession or control of any books of account or other documents maintained in the form of electronic record as defined in clause (t) of sub-section (1) of section 2 of the Information Technology Act, 2000 (21 of 2000), to afford the authorised officer the necessary facility to inspect such books of account or other documents; and by Finance Act, 2009, clause (c) was inserted in sub-section (1) of Section 282 providing that service of notice in the form of any electronic record as provided in Chapter IV of the Information Technology Act, 2000 (21 of 2000) will constitute valid service

Maintaining the integrity of electronic evidence through various processes such as identification of evidence, retrieval of deleted evidence, examination of such evidence, etc., presents problems which are different from the problems encountered in handling of traditional physical or documentary evidence. This Manual attempts to recommend basic operating procedures for handling digital evidence. This includes procedures for getting access to digital evidence, acquisition of the same, their analyses and seizure maintaining the integrity of information taken from stand-alone electronic media, servers and networks where digital information! evidence may be stored.

1.2. The Challenges:

·      The records including books of account maintained on papers are mostly replaced by documents in digital form.

·      Most organisations use networks connecting different PCs, and servers spread across geographical locations and even sovereign jurisdictions not only for communication but also for conduct of day to day business.

·      Computer data including books of account are easy to modify, alter, delete or hide.

·      It is very easy to protect data by passwords and encryption making deciphering of real data an extremely difficult task

·      The data storage devices come in a large variety of technology, shapes and sizes e.g. Hard disks- IDE/ATA/PATA/SATA/SCSI/SAS

Laptop Hard Disks – 2.5 & 1.8

USB Pen-drives and various types of Flash drives.

USB i-Pods, USB MP3 players

CD & DVD Media, Floppy Media

Mobile SIM cards, Memory Card & Device‘s internal memory

Discovery of these devices and retrieval of the data stored therein presents a challenge.

·         Different kind of software, platforms and customized applications used for varied business purposes.

·         Digital data being often stored on networked servers which are normally! remotely accessed. Instances of such data being placed on shared International Networks and Platforms having transnational jurisdictions have come to light. The server may not be available for seizure during survey or search. Instead, all data may be stored in, what they call, ―cloud server‖, i.e , a server located in even a foreign country thousands of miles away and the searched ! surveyed party is sitting merely with a monitor! laptop.

·         Specialised skills are required to identify relevant data, safely retrieve them, properly analyze them for their evidentiary value, and to subsequently produce them in a manner that their integrity can be established in any formal proceedings such as assessment! appeals and prosecution, etc. With ever changing and improving technology, skills are also required to be honed and updated regularly.

·         The environments in which Income-tax Authorities function during field actions are different from other law enforcement agencies. Thus, the requirement of standard procedure for Income-tax Department is slightly different and needs to be flexible as compared to other agencies dealing with other crimes laws.

1.3.   Current practices in the department

There are at present no uniform instructions on how to access computer systems, other digital devices and retrieve digital data during a search operation. Different practices are being followed-

·              Taking hard copies of data and seizing the same

·              Using a CD writer or USB pen drive or USP Portable Hard Drive to take copy of data on the original hard disk

·              Seizing Hard disks or computers and taking them to office

Very often, copying is done with Windows utilities and without any forensic software.y or mandatory to be used

Download / Read Full text of the Manual

CBDT releases Digital Evidence Investigation Manual

- See more at: http://taxguru.in/income-tax/cbdt-releases-digital-evidence-investigation-manual.html#sthash.aY8cKoCA.dpuf


- See more at: http://taxguru.in/income-tax/cbdt-releases-digital-evidence-investigation-manual.html#sthash.aY8cKoCA.dpuf