How a Computer Holds Information

Files, folders and file systems

A file is a named block of data that the operating system keeps track of. The file system is the index: it records where on the disk each file's data physically sits, what it is called, when it was created, when it was last modified, and who may read it.

Deleting a file usually removes the index entry, not the data. The operating system marks the space as available for reuse and stops showing the file. Until something else is written over that space, the content is still there, and forensic software recovers it by reading the disk directly instead of asking the file system. This is why an investigator images a disk rather than browsing it, and why an accused who deleted a file has not necessarily destroyed the evidence.

Overwriting is different from deleting. Software that writes random data over the space repeatedly does destroy the content. Deliberate overwriting after an investigation begins is the electronic equivalent of destroying a document, and section 65 of the Act makes the destruction of source code required to be maintained by law an offence in its own right.

Metadata

Metadata is data about the data. A photograph taken on a phone carries, inside the same file, the date and time it was taken, the make and model of the phone, the camera settings and, if location services were on, the latitude and longitude. A word processing document carries the author's name, the times of creation and last modification, and often a record of earlier edits.

Metadata is frequently the most useful evidence in the file, and it is also the least considered. A defence that a photograph was taken in one place is answered by the coordinates inside it. A claim that a document was drafted before a certain date is answered by its creation timestamp.

It is also fragile. Sending a photograph through some messaging applications strips the metadata, uploading it to some websites strips it, and opening and saving a document changes the modification time. That is why the rule in forensics is to work on an image of the original medium, and why a copy forwarded by WhatsApp is a much weaker exhibit than the file taken off the device.

The hash: a fingerprint for data

A hash function takes any amount of data and produces a short fixed-length number from it. Feed it a one-page letter or a two-hour film and you get, in the widely used SHA-256 function, the same 256 bits out.

Three properties make it useful in law. It is deterministic: the same input always gives the same output. It is one way: from the output you cannot work back to the input. And it is collision resistant: it is not practically possible to find two different inputs that produce the same output.

So the hash behaves as a fingerprint for a body of data. Change one character anywhere in a ten thousand page file and the hash changes completely. Two files with the same hash are, for practical purposes, the same file.

This is used at three points in this subject. It is how a digital signature works, because what is actually signed is the hash rather than the document, and chapter 280 works that in detail. It is how a forensic image is proved to be a true copy: the examiner records the hash of the original medium and of the image, and if the two match, the image is unaltered. And it is how a court can be shown that an exhibit produced at trial is the same file that was seized months earlier.

The University set a short note on "the importance of Hash Value" on the 2024-25 paper, and the three properties above are the answer.

Logs

A log is a file in which a system records what happened, with times. A web server logs each request with the requesting address and the time. An operating system logs each login. A bank logs each transaction. A router may log which internal device used which external address.

Logs are the ordinary evidence of a cyber offence, because the offence usually leaves no other trace. They are also the reason the law imposes retention duties on people who did nothing wrong: rule 3(1)(g) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 requires an intermediary to preserve information for one hundred and eighty days, section 67C of the Act requires intermediaries to preserve and retain information as prescribed, and the CERT-In directions of 28 April 2022 require logs to be maintained for one hundred and eighty days within India. Chapter 1240 owns section 67C and the retention rules, and chapter 770 owns the CERT-In directions.

Logs are also easy to lose. Many systems overwrite them after days. That is the practical reason a complaint made a week after an incident often cannot be investigated at all, and it is the reason the Budapest Convention has an article devoted to expedited preservation.

Encoding, encryption and compression, which are three different things

Students routinely call an encoded file encrypted. They are not the same and the legal consequences differ sharply. Section 69 of the Act gives a power to require decryption assistance and section 84A empowers the Central Government to prescribe modes and methods of encryption. Neither has anything to say about encoding. Chapters 800 and 830 own those two.

A worked example

Arjun, an auditor, is asked to prove that a spreadsheet produced by a company in 2026 is the same one it produced to him in 2024.

He compares hashes. In 2024 he recorded the SHA-256 hash of the file he received. In 2026 he computes the hash of the file produced. If the two are identical, the file is byte for byte the same and nothing has been altered. If they differ, something changed, though the hash does not tell him what.

He looks at metadata. The 2026 file shows a modification timestamp in March 2025, which is after the 2024 delivery. That alone suggests alteration, although a timestamp can be changed by someone who sets out to change it, so it corroborates the hash comparison rather than replacing it.

He asks for the logs. The company's document management system logs each save with the user account. Those entries, if kept, name the person and the time.

None of the three is a legal conclusion, but between them they turn "the file looks different" into evidence that a court can act on. Chapter 1270 works how such evidence is actually admitted.

What this does NOT mean

It does not mean a hash proves who made a change. It proves only that a change was made. Attributing it to a person needs logs, metadata or a signature.

It does not mean deleted data is always recoverable. Solid state drives reorganise themselves and may erase deleted blocks quickly, encrypted storage becomes unreadable once the key is gone, and deliberate overwriting destroys content. Recoverability is a question of fact for the examiner, not a rule of law.

It does not mean metadata is conclusive. It can be edited, and a court treats it as evidence to be weighed and not as an incontrovertible fact.

Quick revision

• Bit is one binary digit; eight bits are a byte. Text, images and sound are all numbers by convention.
• A copy is exact, and an alteration leaves no visible trace. Chapter II of the Act exists because of that.
• Deleting removes the pointer, not the data. Overwriting removes the data.
• Metadata is data about the data: author, timestamps, device, location. Powerful and fragile.
• A hash is a short fixed-length fingerprint. Deterministic, one way, collision resistant. Used for digital signatures, forensic imaging, and proving an exhibit is unchanged. Asked as a short note in 2024-25.
• Logs record what happened and when, are the ordinary evidence of a cyber offence, and are subject to retention duties under section 67C, rule 3(1)(g) and the CERT-In directions.
• Encoding, compression and encryption are three different things. Only encryption is meant to keep a secret.

Test yourself

1. Why does the law need a special rule for proving an electronic record when it has no such rule for a letter? Because an electronic copy is identical to its source and an alteration leaves no physical trace, so the ordinary reasons for trusting a document, its handwriting, its paper and its wear, do not exist. Section 63 of the Bharatiya Sakshya Adhiniyam supplies a substitute assurance.

2. State the three properties of a hash function and give one legal use of each. Deterministic, so the same file always yields the same value and an exhibit can be matched to a seized original. One way, so publishing the hash of a document does not disclose the document. Collision resistant, so a party cannot produce a different document with the same value, which is what makes a digital signature meaningful.

3. A witness says he deleted the file, so nothing can be recovered. Is he right? Not necessarily. Deletion normally removes the file system's index entry while leaving the content on the medium until it is overwritten, so the data is often recoverable by imaging the disk. Whether it is recoverable in the particular case is a question for the examiner.

4. Distinguish encoding from encryption. Encoding represents data in an agreed format and is undone by anyone who knows the format; it keeps no secret. Encryption transforms data so that it can be read only with a key. Section 69 of the Act deals with decryption; encoding is not addressed at all.

5. Why do retention obligations exist for intermediaries who have done nothing wrong? Because the evidence of an offence exists only in logs and records that systems overwrite in the ordinary course, and by the time a complaint is investigated it would otherwise be gone. Hence section 67C, rule 3(1)(g) of the 2021 Rules and the CERT-In direction on one hundred and eighty day log retention.