Record hash values for the Tally files on receipt, examine only a working copy and hash the original again at the end.
If the values match, nothing changed during the work. A read-only tool avoids the writes that opening data in TallyPrime can cause, and the hash report supports a Section 63 certificate.
A disk arrives from a raid or an audit request, and one folder on it holds a company's books. Whatever you do next must be explainable months later, to a second examiner or in a hearing, by someone who was not in the room. That is the whole discipline. Everything below serves it.
Who Needs a Forensic Method for Tally Data?
Where does your case start?
The company folder is one of many items on the disk, and you must be able to show later that nobody altered it after seizure.
Follow the method →The record you hand over must come with a certificate, and the certificate asks you for a hash value and the algorithm behind it.
See what is needed →The question you were given is who changed or deleted vouchers, and when.
Use the Edit Log →Accounting software exists to run the books. It is not built to preserve them as evidence, and it does not pretend to be. The steps below keep the examination repeatable, which is the one property a second examiner or a court will ask you about.
Why Opening Evidence in Tally Is Risky
The vendor's data migration FAQ explains that moving to TallyPrime 3.0 builds a fresh six-digit company beside the old five-digit one, and that the data size grows in the process. So opening a folder in the software can change what is on disk. A changed file has a new hash, and a new hash is a question you do not want to answer in court.
The same page adds that a lower release refuses a company saved by a higher one, so an examiner with an older install may not get the data open at all. Both problems disappear when you read the files instead of loading them.
A Six Step Method for Examining Tally Data
The method follows the habits in ISO/IEC 27037, the guideline for identifying, collecting and preserving digital evidence. We name it as a model only. The software certifies no standard, and we do not claim it does.
- Log the receiptNote who handed over the data, when, from which device and under which file names. Do this before any file is opened.
- Hash every source fileLoad the company folder or backup into Univik Tally Data Forensic Analyzer. It computes MD5, SHA-1 and SHA-256 for each file. Save that report straight away.
- Make a working copySeal the original. Run the review on a duplicate and hash the duplicate to confirm it matches.
- Review read-onlyOpen the Day Book and the ledgers. Use the deleted and edited voucher views to see what changed. The copy is never modified.
- Export the extractSave the vouchers you need as Excel, CSV, JSON or a print page that you turn into PDF. Keep the hash report beside them.
- Hash again at the endRecompute the values on the original. If they equal the first set, the file was not changed during the work.
Univik Tally Data Forensic Analyzer opens folders and backups read-only and records three hash values per file.
We checked this ourselves on a TallyPrime company of 8,542 vouchers saved twice, one save apart: 6 records differed inside the file, the decoded content was identical and the export was identical byte for byte. The hash of the file changed. The hash of the export did not. That's exactly why you hash both.
Download Free Trial Forensics Licence - $599For Windows 10 and 11 with .NET 4.8. Forensics is the tier built for police units and digital forensic examiners. Analyzer page
Which Hash Value Should You Quote?
SHA-256 is the safe main value. NIST's FIPS 180-4 describes the digests as a way to detect whether a message has changed. MD5 is weaker, as RFC 6151 records, but it remains in the list of algorithms on the Schedule, so reports often carry it as well. Note: quote all three when you have them. It costs nothing and it answers the question before anyone asks it.
| Value | Use it for | Note |
|---|---|---|
| SHA-256 | The main integrity value in your notes | Preferred for new work |
| SHA-1 | Forms and tools that still request it | Listed by the Schedule |
| MD5 | Matching older records or forms | Collision weaknesses are documented |
What a Section 63 Certificate Asks For
The Bharatiya Sakshya Adhiniyam, 2023 replaced the older Section 65B route. Section 63(4) accepts a certificate signed jointly by the officer in charge of the device and an expert. The Schedule has lines for the hash value and the algorithm used.
The hash report supplies those two lines. It does not sign for anyone, and it does not make the certificate valid on its own. We are not lawyers, so take advice on your own filing.
Using the Edit Log in an Examination
Edit Log reached TallyPrime in Release 2.1 and records each version of a voucher or master with activity, user name and time, as the Edit Log FAQ describes. For the Companies Act audit trail rule, the ICAI implementation guide reproduces the wording of Rule 3(1).
Limitations: absence of a log proves nothing either way. Data from before 2.1, or saved with Edit Log off in regular TallyPrime, holds no history at all. User names appear only when security was on for that company. For a worked look at deleted vouchers, read Edit Log and deleted vouchers.
- The receipt note names the person, the date and the device
- A first hash report exists and was saved outside the evidence folder
- The working copy hash equals the original
- Every export carries the date it was made
- The final hash of the original equals the first one
ICAI's FAIS 420 guidance, as reproduced here, asks for a detailed record of how evidence moves. These checks are the practical form of that record.
If the Examination Hits a Snag
Do this: Check you pointed at the numbered folder. See the guide to a missing company.
Do this: Do not run a repair on evidence. The vendor says repair removes what it cannot recover. Read the repair guide first.
Do this: Open the .001 as it is. Reading a backup without a restore explains how.
Working a live case? Write to support with the file names and the Tally release.
FAQ: Examining Tally Data as Evidence
This guide is a method note and not legal advice. On October 12, 2026 we read the Act, the RFC and the NIST text. Tally behaviour comes from its own help pages.
Pages we read: Tally data migration FAQ · Edit Log FAQ · Bharatiya Sakshya Adhiniyam, 2023 · NIST FIPS 180-4 · RFC 6151