A digital diary, a mob boss's number, and a court that smelled a setup

The police said they found Dawood Ibrahim's number in his digital diary. His lawyer said—they put it there.

The search party arrived at Som Nath Thapa's house on a routine morning in Maharashtra. The officers' boots left mud on the floor. One of them picked up the Digital Diary from a desk cluttered with papers and a half-empty cup of tea. They left with that device—a handheld electronic organizer, the kind that stored contacts, notes, and appointments before smartphones took over. Months later, when the prosecution filed its chargesheet, that diary contained a single explosive entry: the telephone number of Dawood Ibrahim, India's most wanted fugitive, the man accused of masterminding the 1993 Mumbai bombings.

The problem? Thapa's lawyer, Mr. Shri Shirodhkar, told the Supreme Court the number had never been there. The investigating agency, he alleged, had typed it in themselves.

The question that hung over the case

Could a court trust digital evidence when the very agency that seized it stood accused of planting it? And if the police could type a mob boss's number into a seized device, what else could they type? The Supreme Court would have to decide whether the investigation had crossed the line from diligent to over-zealous—and what that meant for Thapa's liberty.

When the search party arrived

The facts began with a search. Police officers arrived at Thapa's residence, recovered a Digital Diary—a portable device storing contact numbers, memos, and schedules. The device was seized, bagged, and sent for forensic analysis. The mud on the floor from the officers' boots dried as the day wore on, but the questions about what they had taken would not dry so quickly.

At some point during the investigation, the diary was examined. Inside it, the prosecution found a contact entry for Dawood Ibrahim—the underworld don who had fled India and was believed to be orchestrating criminal operations from abroad. For the prosecution, this was a smoking gun. For Thapa, it was a frame-up.

His lawyer argued that the investigating agency had taken recourse to manufacturing evidence. The telephone number of Dawood Ibrahim, he said, was intentionally fed into the Digital Diary after it was seized. The device had been tampered with. The evidence was not genuine.

The argument that forced the court to look closer

Mr. Shri Shirodhkar did not merely allege tampering in the abstract. He pointed to the specific act: the number was not part of the original data on the device. It had been added later, by someone with access to the diary after the search. The investigating agency, he submitted, was actively trying to implicate his client.

Shirodhkar stood before the bench, his voice steady, holding a photocopy of the diary's data log. The courtroom fell silent as he laid out the allegation. The prosecution, presumably, countered that the diary was seized in a lawful search, that the chain of custody (the documented record of who handled the evidence from seizure to court) was intact, and that the entry was genuine. But the silence after Shirodhkar's allegation hung in the air—a silence that suggested the bench was listening, not dismissing.

The allegation was specific, and it was serious. If true, it meant that the police had not merely collected evidence—they had created it.

What the Supreme Court saw

The Supreme Court did not dismiss the allegation as a routine defence tactic. Instead, the bench observed something that cut to the heart of how investigations are conducted in India.

The court noted that investigation at times can be either sluggish or over-zealous. Both are dangerous. A sluggish investigation lets evidence decay and witnesses disappear. But an over-zealous investigation—one too eager to get a result—can overshoot the process. It can cut corners. It can manufacture evidence.

The court's observation was not a finding of fact against the police in this specific case. But it was a warning. The bench acknowledged that concerns regarding unauthorized modification of digital evidence are not merely theoretical. When an accused person alleges that evidence has been planted using digital means, the court cannot simply wave it away. It must scrutinize the actions and procedures of the investigating parties.

The bench's tone was measured, but the weight of the observation was unmistakable. The judges did not need to raise their voices. The implication was clear: an investigation that manufactures evidence is no investigation at all—it is a frame-up wearing a badge.

Why digital evidence is different

This case, State of Maharashtra v. Som Nath Thapa, sits at the intersection of two powerful forces: the state's need to investigate crime, and the accused's right to a fair trial. Digital evidence—data stored on phones, laptops, diaries, and servers—is uniquely vulnerable. Unlike a signed document or a fingerprint, digital data can be altered without leaving visible traces. A single keystroke can add a contact. A few clicks can delete a message. And once the data is changed, proving the original state of the device becomes a forensic battle.

The Supreme Court's observation in this case did not lay down a new rule of law. But it did something equally important: it put investigating agencies on notice. If you seize a digital device, you must be able to prove that the data on it is exactly as it was when you found it. If you cannot, the court will entertain the possibility that the evidence was manufactured.

The broader implications for digital evidence law are significant. Every seizure of a phone, a laptop, a hard drive now carries an implicit burden: the investigating agency must demonstrate not just that the device was seized, but that its contents were preserved in their original state. The chain of custody must be documented with precision—who handled the device, when, where, and what software was used to examine it. Any gap in that chain becomes an opening for the defence to argue tampering.

This is not merely a procedural formality. In a system where digital evidence is increasingly central to prosecutions—from terrorism cases to financial fraud to cybercrime—the integrity of that evidence is the foundation on which convictions rest. If the foundation is cracked, the entire case can collapse.

The case also raises a deeper question about the culture of investigation in India. The Supreme Court's observation that investigations can be "over-zealous" was not an isolated remark. It was a recognition that the pressure to secure convictions—especially in high-profile cases involving organized crime or national security—can lead investigators to cut corners. When the end is seen as justifying the means, the means themselves become corrupted. And when the means are corrupted, the end—a conviction—loses its moral and legal legitimacy.

The court's warning was therefore not just for this case, but for all cases. It was a reminder that the process matters as much as the result. A conviction obtained through manufactured evidence is not justice. It is a travesty of justice.

THE PLAY: When digital evidence is seized, immediately secure a forensic image of the device—a bit-by-bit copy that preserves the original data exactly as it existed at the moment of seizure—and ensure the chain of custody is documented in writing from the search site to the forensic lab.

The walk-off

The court ended where it began: with a device, a number, and the question of who put it there. The mud on the floor had long since been cleaned, but the stain of the allegation remained. The Supreme Court did not resolve the factual dispute in this case—that was for the trial court. But it did something more enduring: it put the investigating agency on notice that the court would not look the other way when digital evidence was challenged. The diary sat in evidence, its data log a silent witness to the argument that had unfolded in the courtroom. And the question—who put the number there?—would echo through every future case where digital evidence is seized and challenged.