Digital Evidence Seized by ED: Phones, Emails, WhatsApp and Accounting Software Under PMLA

Modern Enforcement Directorate investigations frequently involve mobile phones, laptops, email accounts, messaging records, cloud storage, accounting software, ERP systems, spreadsheets, digital invoices and server backups.

The fact that electronic material was found on a seized device does not automatically establish who created it, whether it is complete, whether it was altered or what legal conclusion may properly be drawn from it.

A digital-evidence defence must separately examine lawful acquisition, source, integrity, attribution, context, corroboration, admissibility and the alleged connection with proceeds of crime.

Direct Answer

Digital evidence seized by ED is not automatically conclusive merely because it was recovered from a phone, email account, messaging database or accounting system.

The prosecution should establish:

the device, account, server or database from which the record came;
the lawful basis upon which it was searched, seized, frozen or obtained;
the manner in which the data was extracted;
the integrity of the record from seizure to production;
the person who owned, possessed, controlled or used the device or account;
the person who created, sent, received, approved or edited the record;
the completeness and context of the communication or entry;
compliance with applicable electronic-evidence requirements;
corroboration through independent records;
the connection between the digital material and alleged proceeds of crime.

A strong defence should not merely allege that digital evidence can be manipulated.

It should identify the precise defect concerning:

device identity;
account attribution;
extraction method;
hash value;
metadata;
timestamps;
chain of custody;
missing context;
shared access;
certification;
corroboration;
legal relevance.

What Counts as Digital Evidence in an ED Case?

Electronic evidence may include:

mobile phones;
laptops and desktop computers;
hard drives and flash drives;
SIM cards and memory cards;
WhatsApp and other messaging records;
emails and attachments;
cloud-storage records;
browser history;
call logs;
contact databases;
photographs and videos;
voice notes and audio files;
location and GPS records;
accounting software;
ERP databases;
spreadsheets;
electronic invoices;
payment-gateway records;
server and application logs;
user-access logs;
backups;
deleted or recovered files;
digital-signature records;
forensic-extraction reports.

Device, Account and Record Are Different

Component	Primary Question
Physical device	Who legally owned and physically possessed the phone, laptop or server?
User account	Who controlled the email, messaging, cloud or accounting account?
Login session	Which device, browser, IP address or linked system accessed the account?
Electronic record	Who created, transmitted, received, edited or approved the particular item?
Extracted copy	How was the copy generated and how does it correspond with the source?
Printed output	Who printed it, from which system and under what certification?

Ownership of a device does not necessarily establish authorship of every record found on it.

A person may also create or send a message without owning the physical device through which it was transmitted.

PMLA Search, Seizure and Retention Framework

Section 17 PMLA permits an authorised officer, subject to statutory conditions, to search premises and seize or freeze relevant records or property.

Important post-search stages include:

preparation of the panchnama and inventory;
forwarding of reasons and material under Section 17(2);
filing of the Section 17(4) application within thirty days;
passing of the relevant Section 20 or Section 21 order;
Adjudicating Authority oversight;
return or continued retention according to law.

A mobile phone or laptop may require separate analysis as:

physical property;
a container of electronic records;
a source for forensic extraction;
an instrument allegedly used in a transaction.

Immediate Steps After ED Seizes a Phone or Laptop

Obtain and preserve the panchnama.
Check whether every seized device is listed.
Record the make, model and colour.
Record the serial number and IMEI.
Record SIM and memory-card details.
Record the seal and packet number.
Identify the legal owner.
Identify regular and occasional users.
Preserve the purchase invoice and company-allocation record.
Record whether the device was locked or unlocked.
Record whether copying or imaging occurred on-site.
Record whether the device remained connected to a network.
Preserve CCTV and premises-access records concerning the search.
Preserve lawful backups without modifying the source.
Request copies of business-critical records.
Do not remotely wipe, reset or alter the device.

Forensic Image, Logical Extraction and Screenshot

Method	General Description	Potential Limitation
Forensic image	A technical copy intended to preserve a defined storage source.	Scope depends on the device, tool, access and imaging method.
File-system extraction	Extraction of accessible files and application-data structures.	May not contain every deleted, encrypted or protected record.
Logical extraction	Acquisition of data made available through the operating system or application interface.	May omit inaccessible system areas and deleted material.
Cloud acquisition	Collection from an online account, provider or synchronised service.	Scope depends on credentials, permissions and provider retention.
Chat export	Application-generated text and attachment export.	May omit metadata, deleted messages and linked-device information.
Screenshot	Visual image of what appeared on a screen.	May not establish origin, completeness, metadata or authorship.

Hash Values and Digital Integrity

A hash value is a digital fingerprint generated by applying an algorithm to defined electronic data.

Hash comparison may assist in determining whether:

two digital copies are identical;
a forensic image changed after acquisition;
the record produced in court corresponds with a certified output;
the prosecution and defence received the same dataset.

The following questions should be answered:

What exact source or data was hashed?
When was the hash generated?
Which algorithm was used?
Who generated it?
Where was it recorded?
Does the same value appear in later reports?
Does the hash relate to the complete image, an extraction or selected files?

A missing hash does not automatically render every record inadmissible.

A mismatched hash should be examined to determine whether it resulted from:

alteration;
different extraction scope;
file conversion;
metadata change;
reporting error;
use of a different source file.

Chain of Custody

The chain of custody should explain the movement and handling of the physical device and extracted data.

Review:

date and time of seizure;
officer who seized the device;
seal and packet number;
transfer to the ED office;
transfer to the forensic laboratory;
receipt by the examiner;
date of opening the seal;
condition of the seal;
tool and version used;
acquisition date;
storage location;
copy supplied to investigators;
copy relied upon in the prosecution complaint;
production before the court.

A meaningful challenge should identify an actual break, unexplained access or integrity risk.

Merely stating that several officers handled a device may be insufficient.

Shared, Company-Owned and Family Devices

A phone or laptop may be:

owned by a company;
issued to an employee;
used by several employees;
shared by family members;
used through remote-access software;
linked with several messaging or email accounts;
accessible through a common password;
managed by an IT administrator.

Prepare a device-user matrix:

Device	Legal Owner	Primary User	Other Users	Accounts Logged In	Relevant Period
________	________	________	________	________	________

Supporting records may include:

purchase invoice;
company asset register;
device-allocation form;
mobile-device-management logs;
SIM subscription record;
employment role;
password and access policy;
linked-device history;
remote-access logs.

WhatsApp Evidence

WhatsApp evidence may consist of:

screenshots;
chat exports;
application databases;
backups;
notification records;
linked-device records;
recipient-side data;
sender-side data;
forensic reports.

Questions to ask

Which phone number was registered to the account?
Who controlled the SIM during the relevant period?
Was the account used on another linked device?
Was the displayed contact name merely saved locally?
Was the message sent, received, forwarded or quoted?
Was the message edited?
Were disappearing messages enabled?
Are messages missing before or after the relied-upon extract?
Were attachments recovered?
Does the other participant’s device corroborate the chat?
Does the message correspond with banking, location or transaction evidence?

A displayed contact name is not necessarily proof of the legal identity of the person using the account.

Selected WhatsApp Messages and Missing Context

A message should be read with enough surrounding conversation to understand:

the subject being discussed;
defined abbreviations;
earlier instructions;
subsequent corrections;
sarcasm or hypothetical discussion;
forwarded information;
business shorthand;
negotiations that did not result in transactions;
amounts relating to lawful transactions;
messages sent by another user of the device.

The defence may request:

the complete relevant chat range;
attachment files;
database or extraction reference;
deleted-message indicators;
linked-device information where available;
the other participant’s corresponding record;
the forensic report explaining the extraction.

Email Evidence

Email evidence should be examined through the complete electronic record, not only a printed body or screenshot.

Relevant material may include:

full headers;
sender and recipient addresses;
Message-ID;
date and time;
timezone;
sending and receiving servers;
reply and forwarding chain;
attachments;
mailbox rules;
delegated access;
shared-mailbox permissions;
login and access records;
recipient-side copy.

Potential attribution issues

shared corporate mailbox;
assistant or employee access;
automatic forwarding;
compromised credentials;
spoofed sender information;
mobile synchronisation;
draft created by one person and sent by another;
attachment modified after receipt.

Presumption Concerning Electronic Messages

Section 90 of the Bharatiya Sakshya Adhiniyam permits a court to presume that an electronic message forwarded through an electronic-mail server corresponds with the message fed into the system for transmission.

The provision does not create a corresponding presumption identifying the human sender.

Sender attribution may therefore require:

account ownership;
login history;
device access;
IP or server evidence;
recipient testimony;
surrounding conduct;
business records;
other corroboration.

Accounting Software, Tally and ERP Records

Accounting and ERP systems may contain:

ledgers;
vouchers;
journal entries;
payment and receipt entries;
stock records;
sales and purchase registers;
invoice records;
user IDs;
role permissions;
audit trails;
alteration history;
deleted vouchers;
backups;
data imports;
attachments;
bank reconciliations;
tax reports.

Critical questions

Which company or entity database was examined?
What was the financial period?
Was the data live, archived, restored or exported?
Who had administrator rights?
Which user ID created or altered the entry?
Could several people use the same ID?
Was audit-trail functionality active?
Was the voucher approved or only drafted?
Was the entry later reversed?
Does the bank statement support the entry?
Does the invoice, contract or tax return corroborate it?

Electronic Books of Account Are Relevant but Not Conclusive

Under Section 28 of the Bharatiya Sakshya Adhiniyam, entries in regularly kept books of account, including those maintained electronically, are relevant where they concern the matter under inquiry.

Such entries are not alone sufficient to charge a person with liability.

An accounting entry should therefore be tested against:

bank statements;
payment instructions;
invoices;
purchase orders;
contracts;
delivery records;
tax filings;
beneficiary accounts;
authorised approvals;
actual goods or services;
witness evidence.

An unexplained narration may justify investigation but should not automatically be treated as proof of an unlawful transaction.

Spreadsheets, PDFs and Digital Invoices

Investigations frequently rely upon:

Excel spreadsheets;
PDF invoices;
scanned vouchers;
Word documents;
presentation files;
digitally signed records;
photographs of handwritten ledgers.

Review:

file-creation date;
last-modified date;
author field;
revision history;
formula cells;
hidden rows or sheets;
external links;
file path;
cloud version history;
digital signature;
source attachment;
corresponding accounting entry.

Metadata should be interpreted cautiously because it may change during:

copying;
conversion;
email transmission;
cloud synchronisation;
restoration from backup;
export into another format.

Cloud Storage and Server Evidence

A phone may provide credentials or synchronised copies without containing the complete cloud record.

Cloud and server analysis should identify:

account owner;
administrators;
shared users;
folder permissions;
upload and modification logs;
version history;
deleted-item history;
access IP or device information where available;
provider-retention limitations;
local synchronised copies;
backup source;
legal method of acquisition.

The existence of a file in a shared cloud folder does not automatically establish who uploaded, authored or approved it.

Deleted and Recovered Data

Forensic tools may recover:

deleted files;
database fragments;
thumbnail images;
cached documents;
temporary files;
unallocated-space fragments;
deleted chat records;
browser-cache material.

Recovery of deleted material does not automatically establish:

who deleted it;
when it was deleted;
why it was deleted;
that the person knew it remained recoverable;
that the file was complete;
that it was ever opened or used;
that deletion occurred after knowledge of the ED inquiry.

The prosecution and defence should examine operating-system behaviour, application retention, automatic deletion, storage reuse and user access.

Timestamps and Timezone Issues

Electronic records may use:

device local time;
server time;
UTC;
application-specific time;
cloud-provider time;
database time;
file-system time.

A chronology should account for:

timezone conversion;
incorrect device clock;
server synchronisation;
restoration from backup;
file copying;
message-delivery delay;
offline creation and later synchronisation.

A timestamp discrepancy should be investigated technically rather than treated automatically as fabrication.

Section 22 PMLA Presumptions

Section 22 may create presumptions concerning records found, produced, resumed, seized or frozen.

Depending upon the facts, it may be presumed that:

the record belongs to the person in possession or control;
its contents are true;
its apparent signature or execution is attributable as stated.

Potential rebuttal evidence may include:

company ownership of the device;
multiple authorised users;
shared passwords or accounts;
remote administration;
linked-device access;
account compromise;
another user’s admission;
inconsistent server or bank records;
forensic evidence identifying another operator;
incomplete or manipulated data;
absence of individual benefit or transaction involvement.

Bharatiya Sakshya Adhiniyam Sections 61 to 63

Electronic and digital records have legal effect as documents, subject to the statutory rules governing proof.

Where a computer output, copy, export or electronically reproduced record is relied upon, Section 63 analysis may require:

identification of the electronic record;
description of how it was produced;
particulars of the relevant device or system;
regular use and lawful control;
ordinary-course data entry;
proper operation of the system;
confirmation that the output reproduces or derives from the relevant information;
the prescribed certificate;
device-source and hash particulars.

The legal treatment of an original device or native electronic source should be assessed separately rather than mechanically treating every electronic record as a printout.

Section 63 Certificate Checklist

Review whether the certificate identifies:

the electronic record produced;
the manner of production;
the computer, phone, server, storage media or cloud source;
the person having lawful control;
the relevant period;
the ordinary use of the system;
proper operation of the system;
make and model;
serial number;
IMEI, MAC, cloud ID or other source identity where applicable;
hash value;
hash algorithm;
hash report;
responsible-person certification;
expert component where applicable.

The certificate should correspond with the actual electronic record relied upon rather than refer generically to an undefined collection of data.

Earlier Evidence Act Proceedings

Where a proceeding was already pending before 1 July 2024, the saving clause may preserve the Indian Evidence Act, 1872.

In such proceedings, the earlier jurisprudence concerning Section 65B may remain relevant.

The defence should identify:

when the relevant proceeding commenced;
when the electronic evidence was collected;
when the complaint was filed;
when cognizance or trial commenced;
which evidence statute governs the issue.

Advocate-Client and Litigation-Preparation Material

A seized phone or email account may contain:

legal opinions;
communications seeking legal advice;
draft replies to ED;
draft pleadings;
bail strategy;
conference notes;
internal legal-investigation material;
communications with advocates.

Potentially privileged material should be:

identified specifically;
listed in a privilege log;
segregated from ordinary commercial records;
preserved without alteration;
placed under a controlled or sealed review process where appropriate.

Privilege does not protect communications made in furtherance of an unlawful purpose.

Right to Copies and Business Continuity

Section 21 PMLA recognises the right of the person from whom records were seized or frozen to obtain copies.

A written request should identify:

search date;
panchnama reference;
device or record description;
serial number;
specific folders, databases or periods required;
tax, payroll, statutory or litigation deadline;
preferred format;
willingness to bear reasonable copying costs where applicable;
undertaking not to alter the seized source.

Possible relief may include:

forensic or logical copy of business data;
export of accounting records;
copy of emails or documents;
temporary access for statutory compliance;
return of physical hardware after necessary imaging;
replacement of physical retention with controlled preservation.

No automatic right to immediate physical return arises merely because imaging has occurred.

Section 50 Questioning Based on Digital Evidence

A person may be confronted with:

WhatsApp extracts;
email printouts;
accounting entries;
spreadsheets;
photographs;
cloud records;
call or location data;
forensic reports.

Before answering, identify

the precise record being shown;
the device or account source;
the complete conversation or document;
the relevant date and timezone;
whether it is an original, export, printout or screenshot;
whether the person recognises it;
whether the person has personal knowledge;
whether another user had access;
whether supporting records are required.

The person should answer truthfully and avoid:

guessing;
accepting authorship without verification;
reflexively denying an authentic record;
giving technical opinions without expertise;
creating a false alternative explanation;
coordinating answers with other witnesses.

Digital-Evidence Defence Matrix

Prosecution Record	Defence Questions	Corroboration Required
WhatsApp message	Number, device, linked access, complete chat, sender, editing and context.	Recipient data, bank record, location, witness or transaction.
Email	Header, Message-ID, mailbox access, delegation, server and attachment.	Recipient copy, server log, contract or conduct.
Accounting voucher	User, approval, audit trail, reversal and supporting transaction.	Bank, invoice, tax record, delivery or beneficiary.
Spreadsheet	Author, revision, formula, source, purpose and status.	Underlying books, emails and transactions.
Deleted file	Completeness, deletion date, user, automatic deletion and prior use.	File-system evidence and independent records.
Cloud document	Owner, permissions, uploader, editor and version history.	Access logs and account records.

Potential Grounds of Challenge

device omitted or incorrectly described in the panchnama;
IMEI or serial-number discrepancy;
unexplained broken or changed seal;
source device not identified;
forensic report does not disclose the extraction method;
hash mismatch or undefined hash scope;
data copied outside the documented custody chain;
selected chats relied upon without context;
contact name treated as proof of identity;
shared-device or linked-device access ignored;
email relied upon without relevant headers or account evidence;
screenshot relied upon without underlying data;
accounting entry treated as sole proof of liability;
user ID treated automatically as proof of the human operator;
deleted data treated automatically as concealment;
metadata interpreted without considering copying or conversion;
Section 63 certificate absent, defective or unrelated to the output;
privileged legal material indiscriminately reviewed;
copies denied despite Section 21;
continued physical retention without demonstrated necessity;
Section 17(4), Section 20 or Section 21 requirements not followed;
Section 22 presumptions applied without considering rebuttal evidence.

Complete Defence Document Checklist

Search and custody records

search-authorisation details;
panchnama;
device inventory;
seal record;
transfer memorandum;
forensic-laboratory receipt;
extraction report;
hash report;
Section 17(4) application;
retention orders;
copies request and response.

Device and user records

purchase invoice;
asset register;
device-allocation record;
SIM record;
employment role;
user-access policy;
mobile-device-management record;
linked-device history;
remote-access logs.

WhatsApp and email records

complete relevant conversation;
attachments;
chat export;
database reference;
email headers;
Message-ID;
mailbox permissions;
recipient-side copies;
server and login records where available.

Accounting records

native company database;
backup files;
audit trail;
user-role matrix;
vouchers;
ledgers;
bank statements;
invoices;
contracts;
tax returns;
reconciliation schedules.

Common Mistakes

remotely wiping a seized phone;
deleting email or cloud data;
changing passwords to obstruct lawful access;
creating replacement chats or screenshots;
altering accounting entries after the search;
assuming every message is inadmissible without a hash;
accepting every displayed contact name as identity proof;
failing to preserve complete conversation context;
ignoring company and shared-device access;
using only screenshots for the defence;
failing to request copies under Section 21;
giving speculative Section 50 answers;
claiming privilege over ordinary business communications;
filing generic objections without identifying the forensic defect;
relying upon promises of automatic exclusion of digital evidence.

Frequently Asked Questions

Can ED seize a mobile phone?

Yes, where statutory search-and-seizure requirements are invoked and the device or records are considered relevant.

Does seizure of my phone prove that every record belongs to me?

No automatic factual conclusion should be drawn without examining ownership, possession, users, accounts and the operation of Section 22.

Can ED examine WhatsApp messages?

Data available on a lawfully accessed device, backup, linked system or another lawfully obtained source may be examined subject to the applicable framework.

Is a WhatsApp screenshot sufficient evidence?

A screenshot may be relevant, but source, completeness, authorship, metadata, certification and corroboration should be examined.

Does a saved WhatsApp contact name prove identity?

No. A contact name may have been saved locally by another user. Number control and other attribution evidence remain relevant.

Can forwarded messages be used against the recipient?

They may be examined, but receipt, forwarding, knowledge, agreement and action are distinct legal questions.

Can deleted WhatsApp messages be recovered?

Recovery depends on the device, database, backup, application behaviour and forensic access.

Does deleted data prove destruction of evidence?

No. The prosecution should establish who deleted it, when, why and whether the deletion was intentional or automatic.

Can ED rely upon an email printout?

The source, headers, account control, certification and surrounding evidence should be examined.

Does an email address prove the human sender?

No automatic presumption identifies the human sender merely from transmission of an electronic message.

Can a shared corporate email account create attribution problems?

Yes. Delegated access, assistants, administrators, mailbox rules and shared credentials may be relevant.

Can a Tally entry prove payment?

An electronic-book entry is relevant but should be corroborated through banking, invoice, contract, tax or other evidence.

What if an accounting entry was later reversed?

The audit trail, reason for reversal, banking effect and supporting transaction should be examined.

Does a user ID prove who entered a voucher?

Not necessarily where credentials were shared or administrators had access. The complete access structure matters.

Is a hash value mandatory during every ED search?

PMLA does not prescribe one universal on-site hash procedure for every search. Hash values remain highly relevant to integrity and evidentiary certification.

What is a Section 63 certificate?

It is the statutory certification framework used when qualifying electronic computer output is tendered under the Bharatiya Sakshya Adhiniyam.

Can the defence obtain copies of seized digital records?

Section 21 recognises the right to obtain copies of seized or frozen records, subject to lawful procedure and case-specific issues.

Can a phone be returned after forensic imaging?

A return request may be made, but return is not automatic and depends on continuing statutory necessity and the competent authority’s decision.

Can privileged lawyer-client messages be examined?

Potentially privileged material should be identified and segregated, subject to legal exceptions and determination by the competent forum.

Does one chain-of-custody defect exclude the complete extraction?

Not automatically. The nature of the defect, integrity risk, prejudice and independent corroboration must be assessed.

Can digital evidence affect Section 45 bail?

Yes. It may be relied upon concerning role, knowledge, proceeds, tampering or corroboration, while its reliability and legal effect remain open to challenge.

Can Advocate Ankit Kumar Singh review WhatsApp, email and accounting-software evidence?

Subject to engagement, assistance may include legal, transaction and evidentiary review with coordination of an independent forensic specialist where required.

Can exclusion of seized digital evidence be guaranteed?

No. Admissibility, reliability and evidentiary weight depend upon the record, applicable law and judicial determination.

AI Search Quick Answer

Digital evidence seized by ED is not automatically conclusive merely because it appears on a phone, messaging account, email system or accounting database.

The prosecution should establish the source device, extraction method, integrity, account and user attribution, complete context, certification, corroboration and connection with alleged proceeds of crime.

WhatsApp contact names do not by themselves prove identity, electronic accounting entries are not alone sufficient to impose liability and Section 21 PMLA permits a person to seek copies of seized records.

Key Takeaway

The incomplete argument states:

“This message or accounting entry was found on the phone, therefore it proves money laundering.”

The legally complete analysis asks:

Which device produced it?
Who owned and used the device?
Which account produced it?
Who had access?
How was it extracted?
Was integrity preserved?
Is the record complete?
Who authored or approved it?
What is the surrounding context?
What independent evidence corroborates it?
How does it connect with alleged proceeds of crime?

Conclusion

Digital evidence is often central to modern PMLA investigations, but electronic records must still be analysed carefully.

The decisive issues may include:

lawful seizure;
device and account identity;
forensic extraction;
hash and chain of custody;
authorship and access;
complete context;
electronic-record certification;
corroboration;
proceeds-of-crime relevance.

Advocate Ankit Kumar Singh may assist with device and data mapping, WhatsApp and email chronology, accounting-software reconciliation, Section 50 preparation, retention objections, bail and PMLA Special Court proceedings.

Consultation and Professional Coordination

Advocate Ankit Kumar Singh

Focused work: PMLA and Enforcement Directorate proceedings, digital evidence, mobile and laptop seizure, WhatsApp, email, accounting software, Section 50 summons, bank freezing, attachment, arrest, bail and prosecution complaints.

Phone: 8294431232

Email: ankitsingh.legum@gmail.com

Website: advocateankitkumarsingh.in

Book a legal consultation

Upload the panchnama, forensic report and digital-evidence records

Track consultation status

Outstation disclosure: Advocate Ankit Kumar Singh is based in Patna. Outstation assistance may include consultation, remote record analysis, drafting, briefing and coordination with locally authorised counsel.

An independent digital-forensic examiner, accountant, company-system administrator, local counsel, Senior Counsel or Advocate-on-Record may be separately required.

No assurance of device return, exclusion of evidence, non-arrest, bail, unfreezing, attachment release, discharge or acquittal is made.

Official Sources

Follow legal updates from Advocate Ankit Kumar Singh: Add advocateankitkumarsingh.in as a Preferred Source on Google