Preserving Digital Evidence in Internal Investigations: Imaging, Hashing and Chain of Custody

Preserving digital evidence in an internal investigation means capturing devices, accounts and logs in a way that keeps them complete, unaltered and provable, before anyone has a chance to delete or change them. In practice that requires three things: forensic imaging to create verified copies, hashing to prove the copies match the originals, and a chain-of-custody record showing who handled the evidence and when. Get these right at the start and the evidence can support disciplinary action, a police complaint or civil proceedings; get them wrong and even a strong case can be undermined.

This guide sets out the steps for companies running investigations into fraud, misconduct or data leakage. For the court-facing side, see our explainer on electronic evidence and s. 63 certificates.

Why must preservation come first?

Frauds often run for a long time before they surface. The ACFE's Occupational Fraud 2026 report found that a typical fraud lasted 12 months before it was detected, and that 43% of cases were detected through tips. By the time a whistleblower complaint arrives, the relevant data may already be months or years old.

Digital evidence is also fragile. Mailboxes have retention settings, chat apps auto-delete, laptops are reimaged when staff leave, and system logs overwrite themselves. Where the CERT-In Directions of April 2022 apply, covered entities must keep logs of their ICT systems for a rolling 180 days, which means older logs are lawfully gone. Interviewing a suspect before preserving their data invites deletion.

Step 1: Identify the data sources

Start with a data map for each person and process involved:

• Endpoints: company laptops, desktops and removable media.
• Mobile devices: company phones and, where lawful, personal phones used for work.
• Email and collaboration: mailboxes, shared drives, chat and video-meeting platforms.
• Business systems: ERP, procurement, payroll and expense systems, with their audit trails.
• Infrastructure logs: VPN, firewall, badge access, print and data-loss-prevention logs.
• Third parties: cloud providers, telecom records and vendors, which may need formal requests.

Each source should be recorded with its owner, custodian, location and retention period. The data map later supports the chain of custody and any disclosure declaration.

Step 2: Create forensic images

Forensic imaging produces an exact, verifiable copy of a storage device or account. A full physical image captures every sector of a disk, including deleted and unallocated space. A logical or targeted collection captures selected folders, mailboxes or chat histories where a full image is disproportionate or impossible.

Good practice includes:

1. Do not browse the device. Switching on a laptop or opening files changes metadata.
2. Use write-blocking when imaging storage media, so the original cannot be altered.
3. Consider live acquisition where memory, encryption or running cloud sessions would be lost on shutdown.
4. Export cloud accounts forensically through administrative tools that preserve metadata, rather than forwarding emails.
5. Photograph devices and record serial numbers, IMEI numbers and condition before collection.

All analysis should then be done on working copies, never on the master image.

Step 3: Hash at acquisition and verify before use

A hash value is a fixed-length fingerprint generated from data by a mathematical algorithm. Change one bit and the hash changes. Hashing the source and the image at acquisition, and re-verifying before analysis and production, shows that nothing has changed in between.

The certificate form in the Schedule to the Bharatiya Sakshya Adhiniyam 2023 asks for hash values using SHA1, SHA256, MD5 or another legally acceptable standard, with a hash report enclosed. Hashing at the point of collection is what makes that certificate straightforward to complete later.

Step 4: Keep a chain of custody

The chain of custody is the documented history of each item of evidence from collection to court. A usable record shows:

• a unique evidence identifier and description;
• where, when and from whom it was collected;
• who collected it, with which method and tools;
• hash values at acquisition;
• every transfer, with date, time, purpose and signatures; and
• storage conditions and access controls.

ISO/IEC 27037:2012 provides internationally recognised guidelines for the identification, collection, acquisition and preservation of digital evidence. NIST SP 800-86 describes a forensic process of collection, examination, analysis and reporting. Aligning internal procedures with these references makes the process easier to explain to a court or regulator.

What should the first 24 hours look like?

When an allegation arrives, a short, disciplined sequence protects the evidence without tipping off the subject:

1. Restrict knowledge of the investigation to a small, named team, with counsel involved from the start.
2. Issue preservation instructions to IT to suspend deletion and device recycling for the relevant custodians.
3. Secure logs from systems with short retention periods first, such as VPN, firewall and access-control logs.
4. Plan collection so devices and accounts are captured at the same time, ideally before interviews begin.
5. Open the evidence register and chain-of-custody records before the first item is collected.

Where does BNSS s. 105 fit?

Section 105 of the Bharatiya Nagarik Suraksha Sanhita 2023 requires that police searches and seizures, including the preparation and signing of the seizure list, be recorded by audio-video electronic means, preferably a mobile phone, and that the recording be sent to the magistrate without delay. Section 94 allows a court or police officer to require production of documents and communication devices likely to contain digital evidence.

These provisions govern the police, not a company's own investigation. They matter in two ways. If the matter is reported, devices handed over will be seized and recorded under these rules, so the company's own records should be ready to match. And they reflect the level of transparency courts now expect, so many organisations choose to photograph or video-record their own device handovers.

What legal and privacy guardrails apply?

Authority to collect

Check the employment contract, IT and acceptable-use policies, and any bring-your-own-device policy before collecting. Company-owned devices are usually covered; personal devices generally need consent or a court process. Collection should be proportionate to the allegation, with a written scope.

The DPDP Act and its phased commencement

The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, notified on 13 November 2025, are coming into force in phases, with most Data Fiduciary obligations applying from around 13 May 2027. Section 7(i) recognises processing for employment purposes, including safeguarding the employer from loss or liability, and s. 17(1)(c) exempts processing in the interest of preventing, detecting or investigating offences from much of the Act. Even where an exemption applies, the duty to take reasonable security safeguards under s. 8(5) continues.

Until the relevant DPDP provisions commence, s. 43A of the IT Act 2000 and the related rules on sensitive personal data continue to apply. In both regimes, evidence should be stored securely, access-logged and limited to the investigation team. Our post on the DPDP Act and workplace investigations covers this in detail.

What are the most common preservation mistakes?

These risks are especially acute in insider threat cases, where the subject may have the access and knowledge to cover their tracks. For the overall investigation process, see our guide on how to investigate a whistleblower complaint.

How Spectra Forensics can help

Spectra Forensics has conducted 1,250+ investigations over 19+ years. Our digital forensics and eDiscovery service covers forensic imaging of computers, mobile devices and cloud accounts, hashing, chain-of-custody documentation and analysis by trained digital forensics examiners. Our fraud and whistleblower investigations for corporates bring that evidence together with document review, interviews and reporting.

Decisions on collecting personal devices or reporting to law enforcement need specific legal advice. To discuss a matter, contact us.