Cyber Security (CS-503 (C)) Unit 4 Notes

How unit 4 is examined

This unit covers how electronic records and signatures are recognised and proved in court; digital signatures carry the most marks, then proof of records and admissibility.

Status of Electronic Records as Evidence

<span style="display:inline-block;padding:.16em .6em;border:1.5px solid currentColor;border-radius:999px;font-size:.68em;font-weight:700;letter-spacing:.06em;text-transform:uppercase;opacity:.75">Low weight</span>

Definition. <mark>An electronic record is data, record or generated image or sound stored, received or sent in electronic form, and Section 4 of the IT Act 2000 gives it the same legal status as a written or printed record.</mark>

Key points.

Section 4 says that where the law requires information to be in writing or typed or printed, an electronic record that is accessible for later reference satisfies that requirement.
Section 5 gives an electronic signature the same recognition as a handwritten signature, and Section 3 lets a subscriber authenticate a record with a digital signature.
The IT Act amended the Indian Evidence Act 1872 through its Second Schedule, so "evidence" in Section 3 now includes electronic records and "document" includes them too.
Section 65B of the Evidence Act makes a computer output admissible as a document, without producing the original, if the conditions and certificate of that section are met.
Sections 6 and 10A extend the same status to electronic filing with government and to contracts formed by electronic means.

Indian Evidence Act 1872 in brief. It is the law of evidence for courts: it says which facts are relevant, how they are proved and who bears the burden. It was drafted by James Fitzjames Stephen, came into force on 1 September 1872, has 167 sections in three parts and does not govern arbitration or affidavits. The IT Act 2000 inserted Sections 22A, 45A, 47A, 65A, 65B, 67A, 73A, 81A, 85A, 85B, 85C, 88A and 90A for electronic evidence.

Comparison (electronic records).

Basis	Indian Evidence Act 1872	IT Act 2000
Nature	Procedural law of proof in courts	Enabling law giving legal recognition to e-records
Key sections	3, 22A, 45A, 65A, 65B, 85A-90A	3, 4, 5, 7, 10A, 17, 35
Admissibility	Section 65B certificate and conditions	Declares e-record equal to paper (Section 4)
Digital signature	Proof and presumptions (67A, 73A, 85B)	Creation, certification, CA licensing
Relation	Amended by the IT Act Second Schedule	Amends the Evidence Act to fit e-records
Authority	Courts weigh evidence	Controller and CAs regulate signatures

Pitfall: Writing that the IT Act itself decides admissibility; admissibility of electronic evidence is decided by Section 65B of the Evidence Act.

Asked: [7 marks] (Jun 2025) Explain records as evidence, status of electronic term according to IT Act 2000. Asked: [7 marks] (Dec 2025) Compare the Indian Evidence Act, 1872 and the Information Technology Act, 2000 with respect to electronic records. Asked: [7 marks] (Jun 2025) Explain in brief note on Indian Evidence Act of 1872?

Proof and Management of Electronic Records

Definition. <mark>Proof of an electronic record means establishing before the court that it is genuine and unaltered, and management means keeping it secure, retrievable and traceable so that it stays provable.</mark>

Key points.

Hashing computes a fixed-length digest such as SHA-256 of the record at seizure, and a matching digest later proves the record is unchanged.
A digital signature on the record proves who created it and that it was not altered after signing.
A trusted timestamp fixes when the record existed, which supports proof of the date and time of the event.
Forensic imaging makes a bit-by-bit copy through a write-blocker, so analysis is done on the copy and the original stays untouched.
Chain of custody documents who collected, held, transferred and examined the evidence, with dates, so no gap lets the other side allege tampering.
Section 65B certificate, signed by a responsible official, identifies the record, describes how it was produced and names the device; it is needed for admissibility.
Management under IT Act Section 7 requires that records stay accessible, keep their original format, and retain details of origin, destination and date and time of dispatch; Section 7A applies this to audit.
The Controller of Certifying Authorities and the licensed CAs keep the signature and certificate infrastructure that gives records legal validity.

Answer frame. Open with the definition; list the techniques 1-6 in order of collection to court; then management points 7-8; close with the line that proof plus managed retention gives legal validity.

Asked: [7 marks] (Nov 2023, Dec 2024, Dec 2025) What are the various techniques for proofing evidence of digital record? Discuss the management of Electronic records. Describe the proof and management of electronic messages and records.

Relevancy, Admissibility and Probative Value of E-Evidence

Definition. <mark>Relevancy asks whether the evidence relates to a fact in issue, admissibility asks whether the law lets the court receive it, and probative value asks how much weight it deserves.</mark>

Key points.

Relevant electronic evidence is an email, log, message or file that makes a fact in issue more or less probable under Sections 5 to 55 of the Evidence Act.
Admissibility of an electronic record depends on Section 65B: the computer was in regular use, the information was regularly fed, the computer worked properly, and the output derives from that data.
The Section 65B(4) certificate is mandatory for a secondary electronic copy, as held in Anvar P.V. v. P.K. Basheer (2014) and reaffirmed in Arjun Panditrao Khotkar (2020).
Validity is checked through the hash of the original against the copy, write-blocker use, and a forensic image kept intact.
Chain of custody and complete documentation show that the evidence was not altered from seizure to court.
The forensic tool must be validated and reliable, and the opinion of the Examiner of Electronic Evidence (Section 45A, Section 79A of the IT Act) helps the court.
Probative value rises with authentication by digital signature and certificate, and the court weighs origin, reliability and integrity before it relies on the record.

Answer frame. Open by separating relevancy, admissibility and probative value; develop points 1-3 for the legal tests, 4-6 for how validity is checked; close with weight in point 7.

Asked: [7 marks] (Nov 2019, Jun 2025, Dec 2025) How can we check the validity of digital evidence? Explain relevancy, admissibility and probative value of electronic evidence.

Proving Digital Signatures

Definition. <mark>A digital signature is an electronic signature created by hashing a message and encrypting the digest with the signer's private key, so that anyone can verify it with the public key to confirm authenticity, integrity and non-repudiation.</mark>

Diagram.

<figure class="ds-fig" style="margin:1.4rem 0;overflow-x:auto"><svg xmlns="http://www.w3.org/2000/svg" id="dsfig-u4-01" viewBox="0 0 474 80" width="474" height="80" role="img" aria-label="Signing: message is hashed, the digest is encrypted with the private key to give the signature; the receiver decrypts with the public key and compares hashes"><style>#dsfig-u4-01 .e{stroke:#454C5A;stroke-width:1.4;fill:none}#dsfig-u4-01 .e.hi{stroke:#2340B8;stroke-width:2.6}#dsfig-u4-01 .n{fill:#FFFFFF;stroke:#16181D;stroke-width:1.4}#dsfig-u4-01 .n.hi{fill:#E3E9FC;stroke:#2340B8;stroke-width:2.2}#dsfig-u4-01 .n.rb-b{fill:#16181D;stroke:#16181D}#dsfig-u4-01 .n.rb-r{fill:#BD3227;stroke:#BD3227}#dsfig-u4-01 text{font-family:"JetBrains Mono",ui-monospace,Menlo,Consolas,monospace;font-size:13px}#dsfig-u4-01 .t{fill:#16181D;font-weight:500}#dsfig-u4-01 .t.inv{fill:#FFFFFF;font-weight:700}#dsfig-u4-01 .kd{stroke:#16181D;stroke-width:1.2}#dsfig-u4-01 .dot{fill:#16181D}#dsfig-u4-01 .ann{fill:#2340B8;font-size:11px;font-weight:700}#dsfig-u4-01 .lbl{fill:#6F7787;font-family:system-ui,-apple-system,sans-serif;font-size:12px;font-weight:700}#dsfig-u4-01 .ptr{fill:#2340B8;font-size:12px;font-weight:700}#dsfig-u4-01 .ah{fill:#454C5A}#dsfig-u4-01 .ah.hi{fill:#2340B8}#dsfig-u4-01 .wl rect{fill:#FFFFFF;stroke:#DCE0E7}#dsfig-u4-01 .wl .t{font-size:12px;font-weight:700}#dsfig-u4-01 .wl.hi rect{fill:#2340B8;stroke:#2340B8}#dsfig-u4-01 .wl.hi .t{fill:#FFFFFF}html.dark #dsfig-u4-01 .e{stroke:#B1B7C3}html.dark #dsfig-u4-01 .e.hi{stroke:#8FA3FF}html.dark #dsfig-u4-01 .n{fill:#161920;stroke:#E6E8ED}html.dark #dsfig-u4-01 .n.hi{fill:#1E2748;stroke:#8FA3FF}html.dark #dsfig-u4-01 .n.rb-b{fill:#E6E8ED;stroke:#E6E8ED}html.dark #dsfig-u4-01 .n.rb-r{fill:#FF7E71;stroke:#FF7E71}html.dark #dsfig-u4-01 .t{fill:#E6E8ED}html.dark #dsfig-u4-01 .t.inv{fill:#0F1115}html.dark #dsfig-u4-01 .kd{stroke:#E6E8ED}html.dark #dsfig-u4-01 .dot{fill:#E6E8ED}html.dark #dsfig-u4-01 .ann{fill:#8FA3FF}html.dark #dsfig-u4-01 .lbl{fill:#858D9C}html.dark #dsfig-u4-01 .ptr{fill:#8FA3FF}html.dark #dsfig-u4-01 .ah{fill:#B1B7C3}html.dark #dsfig-u4-01 .ah.hi{fill:#8FA3FF}html.dark #dsfig-u4-01 .wl rect{fill:#161920;stroke:#2A2E37}html.dark #dsfig-u4-01 .wl.hi rect{fill:#8FA3FF;stroke:#8FA3FF}html.dark #dsfig-u4-01 .wl.hi .t{fill:#0F1115}</style><defs><marker id="ah7" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path class="ah" d="M0,1 L9,5 L0,9 z"/></marker><marker id="ahh7" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path class="ah hi" d="M0,1 L9,5 L0,9 z"/></marker></defs><path class="e" d="M59,40 L141,40" marker-end="url(#ah7)"/><path class="e" d="M195,40 L277,40" marker-end="url(#ah7)"/><path class="e" d="M317,40 L406,40" marker-end="url(#ah7)"/><g class="wl"><rect x="206.4" y="31" width="54.3" height="18" rx="9"/><text class="t" x="233.5" y="40" dy=".35em" text-anchor="middle">digest</text></g><g class="wl"><rect x="331.8" y="31" width="61.5" height="18" rx="9"/><text class="t" x="362.5" y="40" dy=".35em" text-anchor="middle">privkey</text></g><circle class="n" cx="40" cy="40" r="18"/><text class="t" x="40" y="40" dy=".35em" text-anchor="middle">Msg</text><rect class="n" x="144" y="25" width="50" height="30" rx="15"/><text class="t" x="169" y="40" dy=".35em" text-anchor="middle">Hash</text><circle class="n" cx="298" cy="40" r="18"/><text class="t" x="298" y="40" dy=".35em" text-anchor="middle">Enc</text><circle class="n" cx="427" cy="40" r="18"/><text class="t" x="427" y="40" dy=".35em" text-anchor="middle">Sig</text></svg><figcaption style="font-size:.82em;opacity:.72;margin-top:.45rem">Signing: message is hashed, the digest is encrypted with the private key to give the signature; the receiver decrypts with the public key and compares hashes</figcaption></figure>

Key points.

Components are the message, a hash function, the signer's private key, the matching public key, and a digital signature certificate issued by a CA under a PKI.
Signing hashes the message and encrypts the digest with the private key; verification decrypts the signature with the public key and compares it with a fresh hash, and a match proves origin and integrity.
Role in evidence: it authenticates the sender, protects integrity because any change alters the hash, and gives non-repudiation because only the key holder could sign.
In court, Section 67A of the Evidence Act requires proof of a digital signature unless it is a secure one, Section 73A lets the court verify it, and Section 85B presumes a secure signature belongs to the subscriber.
Under the IT Act, the Central Government appoints a Controller of Certifying Authorities (Section 17), and licensed CAs issue Digital Signature Certificates on an application and fee (Section 35); the government itself does not issue them directly.
An Electronic Signature Certificate contains the subscriber's name, public key, serial number, validity period, issuing CA and its signature, and it binds the key to the person.
Duties of the subscriber: generate the key pair with a secure system (Section 40), accept the certificate only after checking its details (Section 41), keep the private key secret and inform the CA at once of compromise (Section 42), and never give false information.
In SSL/TLS, the server sends its certificate, the client checks the CA chain up to a trusted root, the server proves key ownership by a signature, and both derive a session key, giving authentication, integrity and confidentiality.
Pros: strong security, legal validity, speed and paperless efficiency; cons: private key management, certificate cost, dependency on CAs and loss if the key is stolen.

Answer frame. For role-in-evidence, define, draw the diagram, then points 2-4 and close with court proof. For components or CA questions, list 1, 5, 6, 7. For SSL/TLS, point 8 as handshake steps. For pros and cons, define, significance from point 3, then point 9.

Asked: [7 marks] (Nov 2019) Discuss the components of digital signature. Asked: [7 marks] (Dec 2020, Dec 2025) What is the role of digital signature in digital evidence? Explain how digital signatures and electronic agreements are proved in courts. Asked: [7 marks] (Nov 2022) Discuss the importance of digital signatures and certificates in the formation of SSL/TLS-based sessions. Asked: [7 marks] (Nov 2022) Explain Electronic Signature Certificate. What are the duties of subscriber in relation to it? Asked: [7 marks] (Nov 2023) What is the Information Technology Act 2000 dealing with who issues the digital signature under the Information Technology Act 2000? Asked: [7 marks] (Dec 2024) Give a note on significance of digital signature. What are the pros and cons of digital signatures?

Proof of Electronic Agreements

Definition. <mark>An electronic agreement is a contract formed by electronic means, valid under Section 10A of the IT Act, and it is proved by producing the electronic records and signatures that show offer, acceptance and consent.</mark>

Key points.

Types of evidence are digital signatures of the parties, emails and messages, server and audit logs, and certificates from a CA.
Section 85A of the Evidence Act presumes that an electronic agreement with a digital signature was concluded by affixing the signatures.
Section 65B certificate is needed to produce these records in court, and Sections 11 to 13 of the IT Act settle attribution, acknowledgment and time and place of dispatch.
Protection comes from encryption for confidentiality, hashing and signatures for integrity, and secure storage with backups and access control.

Asked: [7 marks] (Nov 2023) What are the different types of evidences required for proving the electronic agreements and how it is protected?

Proving Electronic Messages

Definition. <mark>An electronic message such as an email or SMS is proved through the record of its transmission, and Section 88A of the Evidence Act lets the court presume it matches what the originator fed into the computer.</mark>

Key points.

The court presumes the message forwarded is the message fed for transmission, but it does not presume who sent it.
The sender is proved by digital signature, email headers, server logs and the Section 65B certificate.
Section 22A makes oral admissions about the content of an electronic record irrelevant unless its genuineness is in question.
Section 90A presumes an electronic record five years old and from proper custody to be genuine.

Last-minute revision

Section 4 IT Act: electronic record equals written or printed record.
Section 5 IT Act: electronic signature equals handwritten signature.
Section 65B Evidence Act: computer output admissible only with the certificate.
Anvar P.V. v. Basheer (2014): 65B certificate mandatory.
Section 67A proves a signature; 73A verifies it; 85B presumes secure records and signatures.
Section 85A presumes electronic agreements; 88A presumes electronic messages.
Controller of Certifying Authorities (Section 17) supervises licensed CAs, who issue certificates (Section 35).
Subscriber duties: Sections 40, 41, 42.
Signing hashes then encrypts with the private key; verification uses the public key.
Evidence checks: hash, write-blocker, forensic image, chain of custody.

Memory hooks

4-5 = Recognition: Section 4 records, Section 5 signatures.
65B = "Bring the Bit certificate".
85A, 85B, 85C, 88A, 90A = presumptions: agreement, secure, certificate, message, old.
Subscriber 40-41-42: Generate, Accept, Guard.
Evidence tests: Relevant, Admissible, Weighty.

Coverage checklist

Status of Electronic Records as Evidence: Jun 2025 records as evidence; Dec 2025 comparison; Jun 2025 note on Evidence Act.
Proof and Management of Electronic Records: Nov 2023, Dec 2024, Dec 2025 proof techniques and management.
Relevancy, Admissibility and Probative Value of E-Evidence: Nov 2019, Jun 2025, Dec 2025 validity and admissibility.
Proving Digital Signatures: Nov 2019 components; Dec 2020, Dec 2025 role; Nov 2022 SSL/TLS; Nov 2022 certificate and duties; Nov 2023 who issues; Dec 2024 pros and cons.
Proof of Electronic Agreements: Nov 2023 types of evidence and protection.
Proving Electronic Messages: not asked recently, covered.

Account

Cyber Security (CS-503 (C)) - Unit 4 Short Notes

How unit 4 is examined

Status of Electronic Records as Evidence

Proof and Management of Electronic Records

Relevancy, Admissibility and Probative Value of E-Evidence

Proving Digital Signatures

Proof of Electronic Agreements

Proving Electronic Messages

Last-minute revision

Memory hooks

Coverage checklist