Can a Screenshot Be Evidence? | Understanding the Reliability of Digital Evidence
Forensic Reality Check
A screenshot shows what appeared on a screen. It does not automatically prove who created the content, whether it was altered, or what happened outside the frame.
Introduction
In today's period of time ,we observe that a screenshot seems like evidence. A screenshot can feel like proof. The screenshot comes with a name, a timestamp, a profile picture and a message all neatly placed inside an app we know well. In cases involving fraud, harassment, workplace conflicts or cybercrime individuals often send a screenshot first to the police, a company or a lawyer. This makes sense. When something troubling shows up on a phone or computer taking a screenshot feels like the thing to do. The screenshot captures the moment like a photo.
There is another side to evidence. A screenshot only shows what was on the screen at that moment. The screenshot does not tell us where the content came from. The screenshot does not show who had control of the account. The screenshot does not say if the image was edited. The screenshot does not reveal what happened before or after the screenshot was taken. The Bharatiya Sakshya Adhiniyam 2023 recognizes records. The Bharatiya Sakshya Adhiniyam also sets out rules for proving them. That means the real question is not just "Is this screenshot real?" The bigger question is, "Can we explain and verify the story behind it?”
A screenshot is evidence - but not automatically the whole story
Think of a common situation. A person receives a screenshot of a chat in which someone appears to demand money and threaten to publish private documents. The image looks genuine. Yet an investigator would still ask: Was the message actually sent? From which account or device? Does the date and time match the service records? Is the conversation complete?
Those questions do not make the screenshot useless. They make the investigation stronger.
Digital information can be copied, compressed, cropped, forwarded, or edited with little visible sign. NIST describes digital evidence as information of probative value stored or transmitted in binary form and emphasises preservation because digital files are easy to change. [3][4] The forensic mindset is simple: ask whether an image’s origin, context and integrity can be explained.
What makes a screenshot more reliable?
A stronger evidence package normally answers five practical questions:
• Source - Where did the image come from: a phone, laptop, messaging application, email client, cloud account, or another person?
• Context - Does it preserve the relevant username, number, URL, date, time, surrounding messages, and sequence?
• Integrity - Has the original file been retained, and can later changes be detected?
• Corroboration - Do other records support the same event, such as device artifacts, email headers, transaction data, or witness accounts?
• Chain of custody - Who collected it, when, how was it transferred, and where was it stored?
Hashing helps with integrity. A cryptographic hash acts like a digital fingerprint for a file. If the file changes, its hash value changes. NIST recommends hashing digital images and other evidence objects and securely preserving the resulting hash values. [4][5] A hash does not prove the content is truthful; it helps show that the file examined is the file that was preserved.
The Indian legal angle: admissibility is not the same as authenticity
India’s current evidence framework is equally important. The Bharatiya Sakshya Adhiniyam, 2023 came into force on 1 July 2024. Section 61 says an electronic or digital record cannot be denied admissibility merely because it is electronic, subject to the Act. Section 62 directs that electronic records are proved in accordance with Section 63. [1]
Section 63 sets out conditions for admissibility and, where it applies, requires a certificate to accompany the electronic record when submitted for admission. The Schedule includes device details and fields for the relevant hash value and algorithm. [2]
There is an important practical nuance: not every screenshot automatically requires the same proof route. Treatment can depend on what is produced, how it was obtained, and how it is tendered. Investigators should preserve the underlying source wherever lawfully possible rather than treat a screenshot as a self-proving substitute for the original record.
In Pooranmal v. State of Rajasthan, decided on 10 March 2026, the Supreme Court considered call detail records rather than screenshots and held, in that case, that the certificate requirement under Section 63 was mandatory for the electronic record relied upon there. [6] The broader lesson is that digital evidence must be presented through the legal proof framework that applies to it.
REALISTIC EXAMPLE A screenshot arrives. The investigation starts.
Consider a realistic cyber-fraud complaint. A victim receives a screenshot showing what appears to be a message from a senior company executive asking an employee to transfer money urgently. The safest response is not to decide immediately whether it “looks genuine.” The investigator can preserve the original image, record its source, calculate a hash, and look for supporting material: the actual chat or email, device data, account identifiers, timestamps, transaction records, or login history.
Suppose the screenshot says 3:14 p.m., but the underlying account record shows the message was never sent. That contradiction becomes an investigative lead. If the screenshot matches the original device data and independent records, its evidentiary value becomes stronger.
The human side matters too. A victim should not be criticised for taking a screenshot. In many incidents, it is the quickest way to show another person what happened. The forensic response is simply to go one step further: preserve first, verify next, interpret last.
A small checklist can prevent a big evidentiary problem
The bigger lesson
Screenshots are valuable because they can preserve a moment that may later disappear: a threat, a suspicious payment instruction, a spoofed webpage, or a social-media post. But a convincing image is not the same thing as a complete digital record.
Good digital forensics connects the artifact to a source, a timeline, a method of collection, and independent facts. NIST’s work on digital evidence emphasises preservation, controlled handling, and awareness of the limits of forensic conclusions. [3][4] Confidence should follow the evidence, not replace it.
Conclusion
So, can a screenshot be evidence? The important question is whether the screenshot can be verified, put into context and backed up by evidence when the case needs it. For citizens the practical advice is clear: keep the screenshot, do not delete the screenshot, keep the screenshot and do not rely only on a forwarded copy. Preserving the source device or original platform record were lawful and possible.
For investigators and organisations, the standard is higher. Record the source and collection details preserve the screenshot, calculate and document hashes, maintain chain of custody and seek corroboration. A screenshot can open the door to an investigation. Good forensic practice is what helps establish what happened on the side of that door.
References
[1] India Code, The Bharatiya Sakshya Adhiniyam, 2023, Sections 61-62; commencement from 1 July 2024. Source
[2] India Code, The Bharatiya Sakshya Adhiniyam, 2023, Section 63 and Schedule - certificate for electronic records, including device particulars and hash value fields. Source
[3] NIST, Digital Evidence, overview of digital evidence and forensic challenges. Source
[4] NIST, Digital Evidence Preservation: Considerations for Evidence Handlers, NISTIR 8387, 2022. Source
[5] NIST / OSAC Lexicon, “Hash, Hash Value,” 2025. Source
[6] Supreme Court of India, Pooranmal v. State of Rajasthan & Anr., 2026 INSC 217, judgment dated 10 March 2026. Source
[7] NIST, ANSI/ASTM E3016-18 Standard Guide for Establishing Confidence in Digital and Multimedia Evidence Forensic Results by Error Mitigation Analysis. Source
Related Blogs
Introduction
Google’s search engine is widely known for its ability to tailor its search results based on user activity, enhancing the relevance of search outcomes. Recently, Google introduced the ‘Try Without Personalisation’ feature. This feature allows users to view results independent of their prior activity. This change marks a significant shift in platform experiences, offering users more control over their search experience while addressing privacy concerns.
However, even in this non-personalised mode, certain contextual factors including location, language, and device type, continue to influence results. This essentially provides the search with a baseline level of relevance. This feature carries significant policy implications, particularly in the areas of privacy, consumer rights, and market competition.
Understanding the Feature
When users engage with this option of non-personalised search, it will no longer show them helpful individual results that are personalisation-dependent and will instead provide unbiased search results. Essentially,this feature provides users with neutral (non-personalised) search results by bypassing their data.
This feature allows the following changes:
- Disables the user’s ability to find past searches in Autofill/Autocomplete.
- Does not pause or delete stored activity within a user’s Google account. Users, because of this feature, will be able to pause or delete stored activity through data and privacy controls.
- The feature doesn't delete or disable app/website preferences like language or search settings are some of the unaffected preferences.
- It also does not disable or delete the material that users save.
- When a user is signed in, they can ‘turn off the personalisation’ by clicking on the search option at the end of the webpage. These changes, offered by the feature, in functionality, have significant implications for privacy, competition, and user trust.
Policy Implications: An Analysis
This feature aligns with global privacy frameworks such as the GDPR in the EU and the DPDP Act in India. By adhering to principles like data minimisation and user consent, it offers users control over their data and the choice to enable or disable personalisation, thereby enhancing user autonomy and trust.
However, there is a trade-off between user expectations for relevance and the impartiality of non-personalised results. Additionally, the introduction of such features may align with emerging regulations on data usage, transparency, and consent. Policymakers play a crucial role in encouraging innovations like these while ensuring they safeguard user rights and maintain a competitive market.
Conclusion and Future Outlook
Google's 'Try Without Personalisation' feature represents a pivotal moment for innovation by balancing user privacy with search functionality. By aligning with global privacy frameworks such as the GDPR and the DPDP Act, it empowers users to control their data while navigating the complex interplay between relevance and neutrality. However, its success hinges on overcoming technical hurdles, fostering user understanding, and addressing competitive and regulatory scrutiny. As digital platforms increasingly prioritise transparency, such features could redefine user expectations and regulatory standards in the evolving tech ecosystem.
References
Introduction
A photo circulating on social media depicting modified tractors is being misrepresented as part of the 'Delhi Chalo' farmers' protest narrative. In the recent swirl of misinformation surrounding the 'Delhi Chalo' farmers' protest. A photo, ostensibly showing a phalanx of modified tractors, has been making the rounds on social media platforms, falsely tethered to the ongoing protests. This image, accompanied by a headline suggesting a mechanical metamorphosis to resist police barricades, was allegedly published by a news agency. However, beneath the surface of this viral phenomenon lies a more complex and fabricated reality.
The Movement
The 'Delhi Chalo' movement, a clarion call that resonated with thousands of farmers from the fertile plains of Punjab, the verdant fields of Haryana, and the sprawling expanses of Uttar Pradesh, has been a testament to the agrarian community's demand for assured crop prices and legal guarantees for the Minimum Support Price (MSP). The protest, which has seen the fortification of borders and the chaos at the Punjab-Haryana border on February 13, 2024, has become a crucible for the farmers' unyielding spirit.
Yet, amidst this backdrop of civil demonstration and discourse, a nefarious narrative of misinformation has taken root. The viral image, which has been shared with the fervour of wildfire, was accompanied by a screenshot of an article allegedly published by the news agency. This article, dated February 11, 2024, quoted an anonymous official who claimed that intelligence agencies had alerted the police to the protesters' plans to outfit tractors with hydraulic tools. The implication was clear: these machines had been transformed into battering rams against the bulwark of law enforcement.
The Pursuit of Truth
However, the India TV Fact Check team, in their relentless pursuit of truth, unearthed that the viral photo of these so-called modified tractors is nothing but a chimerical creation, a figment of artificial intelligence. Visual discrepancies betrayed its AI-generated nature.
This is not the first time that the misinformation has loomed over the farmers' protest. Previous instances, including a viral video of a modified tractor, have been debunked by the same fact-checking team. These efforts are a bulwark against the tide of false narratives that seek to muddy the waters of public understanding.
The claim that the photo depicted modified tractors intended for use in the ‘Delhi Chalo’ farmers' protest rally in Delhi on February 13, 2024, was a mirage.
The Fact Check
OpIndia, in their article, clarified that the photo used was a representative image created by AI and not a real photograph. To further scrutinize this viral photo, the HIVE AI detector tool was employed, indicating a 99.4% likelihood of the image being AI-generated. Thus, the claim made in the post was misleading.
The viral photo claiming that farmers had modified their tractors to avoid tear gas shells and remove barricades put up by the police during the rally was a digital illusion. The internet has become a fertile ground for the rapid spread of misinformation, reaching millions in an instant. Social media, with its complex algorithms, amplifies this spread, as any interaction, even those intended to debunk false information, inadvertently increases its reach. This phenomenon is exacerbated by 'echo chambers,' where users are exposed to a homogenous stream of content that reinforces their pre-existing beliefs, making it difficult to encounter and consider alternative perspectives.
Conclusion
The viral image depicting modified tractors for the ‘Delhi Chalo’ farmers' protest rally was a digital fabrication, a testament to the power of AI in creating convincing yet false narratives. As we navigate the labyrinth of information in the digital era, it is imperative to remain vigilant, to question the veracity of what we see and hear, and to rely on the diligent work of fact-checkers in discerning the truth. The mirage of modified machines serves as a stark reminder of the potency of misinformation and the importance of critical thinking in the age of artificial intelligence.
References
- https://www.indiatvnews.com/fact-check/fact-check-ai-generated-tractor-photo-misrepresented-delhi-chalo-farmers-protest-narrative-msp-police-barricades-punjab-haryana-uttar-pradesh-2024-02-15-917010
- https://factly.in/this-viral-image-depicting-modified-tractors-for-the-delhi-chalo-farmers-protest-rally-is-created-using-ai/
Introduction
Cyber attacks are becoming increasingly common and most sophisticated around the world. India's Telecom operator BSNL has allegedly suffered a data breach. Reportedly, Hackers managed to steal sensitive information of BSNL customers and the same is now available for sale on the dark web. The leaked information includes names email addresses billing details contact numbers and outgoing call records of BSNL customers victims include both BSNL fibre and landline users. The threat actor using Querel has released a sample data set on a dark web forum and the data set contains 32,000 lines of leaked information the threat actor has claimed that the total number of lines across all databases amounts to approximately 2.9 Million.
The Persistent Threat to Digital Fortresses
As we plunge into the abyssal planes of the internet, where the shadowy tendrils of cyberspace stretch out like the countless arms of some digital leviathan, we find ourselves facing a stark and chilling revelation. At its murky depths lurks the dark web, a term that brings forth images of a clandestine digital netherworld where anonymity reigns supreme and the conventional rules of law struggle to cast their net. It is here, in this murky digital landscape, where the latest trophy of cyber larceny has been flagrantly displayed — the plundered data of Bharat Sanchar Nigam Ltd (BSNL), India's state-owned telecommunications colossus.
This latest breach serves not simply as a singular incident in the tapestry of cyber incursions but as a profound reminder of the enduring fragility of our digital bastions against the onslaught wielded by the ever-belligerent adversaries in cyberspace.
The Breach
Tracing the genesis of this worrisome event, we find a disconcerting story unfold. It began to surface when a threat actor, shrouded in the mystique of the digital shadows and brandishing the enigmatic alias 'Perell,' announced their triumph on the dark web. This self-styled cyber gladiator took to the encrypted recesses of this hidden domain with bravado, professing to have extracted 'critical information' from the inner sanctum of BSNL's voluminous databases. It is from these very vaults that the most sensitive details of the company's fibre network and landline customers originate.
A portion of the looted data, a mere fragment of a more extensive and damning corpus, was brandished like a nefariously obtained banner for all to see on the dark web. It was an ostentatious display, a teaser intended to tantalize and terrify — approximately 32,000 lines of data, a hint of the reportedly vast 2.9 million lines of data that 'Perell' claimed to have sequestered in their digital domain. The significance of this compromised information cannot be overstated; it is not mere bytes and bits strewn about in the cyber-wind. It constitutes the very essence of countless individuals, an amalgamation of email addresses, billing histories, contact numbers, and a myriad of other intimate details that, if weaponized, could set the stage for heinous acts of identity theft, insidious financial fraud, and precisely sculpted phishing schemes.
Ramifications
The ramifications of such a breach extend far beyond individual concerns of privacy invasion. This event signifies an alarming clarion call highlighting the susceptibility of our digital identities. In an era where the strands of our daily lives are ever more entwined with the World Wide Web, such penetrations are not merely an affront to corporate entities; they are a direct assault on the individual's inherent right to security and the implicit trust placed in the institutions that profess to shield their most private information.
Ripples of concern have emanated throughout the cybersecurity community, prompting urgent action from Cert-In, India's cyber security sentinel. Upon notification of this digital transgression, alarms were sounded, and yet, in a disconcerting turn, BSNL has remained enigmatic, adopting a silence that seems to belie the gravity of the situation. This reticence stands in contrast to the urgency for open dialogue and transparency — it is within the anvil of these principles that the foundations of trust are laid and sustained.
Conclusion
The narrative of the BSNL data breach transcends a singular tale of digital larceny or vulnerability; it unfolds as an insistent call to action, demanding a unified and proactive response to the perpetually morphing threat landscape that haunts our technologically dependent world. It is an uncomfortable reminder that in the intricately woven web of our online existence, we each stand as potential targets with our personal data held precariously as the coveted prize for those shadow-walkers and data marauders who dwell in the secretive realms of the internet's darkest corners.
