Examine Tally data as evidence by recording hash values on receipt, working only on a copy and hashing the original again at the end.
If the values match, nothing changed during the work. A read-only tool avoids the edits that opening data in TallyPrime can cause, and the Tally hash report supports a Section 63 certificate.
A disk arrives from a raid or an audit request, and one folder on it holds a company's books. Whatever you do next must be explainable months later, to a second examiner or in a hearing, by someone who was not in the room. That is the entire discipline. Everything below serves it.
Who Needs to Examine Tally Data as Evidence?
Where does your case start?
The company folder is one of many items on the disk, and you must be able to show later that nobody altered it after seizure.
Follow the method →The record you hand over must come with a certificate, and the certificate asks you for a hash value and the algorithm behind it.
See what is needed →The question you were given is who changed or deleted vouchers, and when.
Use the Edit Log →Accounting software exists to keep the books. It is not built to preserve them as evidence, and it does not pretend to be. The steps below keep the examination repeatable, which is the one property a second examiner or a court will ask you about.
Why Opening Evidence in Tally Is Risky
The vendor's data migration FAQ explains that moving to TallyPrime 3.0 builds a fresh six-digit company beside the old five-digit one, and that the data size grows in the process. So opening a folder in TallyPrime can change what is on disk. A changed file has a new hash, and a new hash is a question you do not want to answer in court.
The same FAQ adds that a lower release refuses a company saved by a higher one, so an examiner with an older install may not get the data open at all. Both problems disappear when you open the files read-only instead of loading them.
A Six Step Method to Examine Tally Data as Evidence
The method follows the habits in ISO/IEC 27037, the guideline for identifying, collecting and preserving digital evidence. We name it as a model only. Univik Software certifies no standard, and we make no such claim.
- Log the receiptNote who handed over the data, when, from which device and under which file names. Do this before any file is opened.
- Hash every source fileLoad the company folder or backup into Univik Tally Data Forensic Analyzer to compute MD5, SHA-1 and SHA-256 for every source file. Save that Tally hash report straight away.
- Make a working copySeal the original. Work on a duplicate and hash the duplicate to confirm it matches.
- Review read-onlyOpen the Day Book and the ledgers. Use the deleted and edited voucher views to see what changed. The copy is never modified.
- Export the extractCreate Excel, CSV, JSON or PDF files of the vouchers you need. Keep the hash report beside them.
- Hash again at the endRecompute the values on the original. If they equal the first set, the file was not changed during the work.
Univik Software examines folders and backups read-only and records three hash values per file in the Tally hash report.
We checked this ourselves on a TallyPrime company of 8,542 vouchers saved twice, one save apart: 6 records differed inside the file, the decoded content was identical and the export was identical byte for byte. The hash of the file changed. The hash of the export did not. That's exactly why you hash both.
Download Free Trial Forensics Licence - $599For Windows 10 and 11 with .NET 4.8. Forensics is the tier built for police units and digital forensic examiners.
Which Hash Value Should You Quote?
SHA-256 is the safe main value. NIST's FIPS 180-4 describes the digests as a way to detect whether a message has changed. MD5 is weaker, as RFC 6151 records, but it remains in the list of algorithms on the Schedule, so reports often carry it as well. Note: quote all three when you have them. It costs nothing and it answers the question before anyone asks it.
| Value | Use it for | Note |
|---|---|---|
| SHA-256 | The main integrity value in your notes | Preferred for new work |
| SHA-1 | Forms and tools that still request it | Listed by the Schedule |
| MD5 | Matching older records or forms | Collision weaknesses are documented |
What a Section 63 Certificate Asks For
The Bharatiya Sakshya Adhiniyam, 2023 replaced the older Section 65B route. Section 63(4) accepts a certificate signed jointly by the officer in charge of the device and an expert. The Schedule has lines for the hash value and the algorithm used.
The hash report supplies those two lines. It does not sign for anyone, and it does not make the certificate valid on its own. We are not lawyers, so take advice on your own filing.
Using the Edit Log in an Examination
Edit Log reached TallyPrime in Release 2.1 and records every version of a voucher or master with activity, user name and time, as the Edit Log FAQ describes. For the Companies Act audit trail rule, the ICAI implementation guide reproduces the wording of Rule 3(1).
Limitations: absence of a log proves nothing either way. Data from before 2.1, or saved with Edit Log off in regular TallyPrime, holds no history at all. User names appear only when security was on for that company. For a worked look at deleted vouchers, see Tally Edit Log: Deleted and Altered Vouchers.
- The receipt note names the person, the date and the device
- A first hash report exists and was saved outside the evidence folder
- The working copy hash equals the original
- Every export carries the date it was made
- The final hash of the original equals the first one
ICAI's draft guidance note on FAIS 420 asks for a detailed record of how evidence moves. These checks are the practical form of that record.
If the Examination Hits a Snag
1. The folder will not list a company
Do this: Check you pointed at the company data folder. See Tally Company Not Showing in the List.
2. The data shows File Damaged in Tally
Do this: Do not repair evidence. The vendor says repair removes what it cannot recover. See Tally File Damaged or Repair Required first.
3. You only have a backup file
Do this: Examine the .001 as it is. How to Open Tally Backup File Without Restoring explains how.
Working a live case? Contact Univik support with the file names and the Tally release.
FAQ: Examining Tally Data as Evidence
This guide is a method note and not legal advice. On October 12, 2026 we checked the Act, the RFC and the NIST text. Tally behaviour comes from its own help articles.
Sources we read: Tally data migration FAQ · Edit Log FAQ · Bharatiya Sakshya Adhiniyam, 2023 · NIST FIPS 180-4 · RFC 6151