EN ISO/IEC 27037:2016

Information technology - Security techniques - Guidelines for identification, collection, acquisition and preservation of digital evidence (ISO/IEC 27037:2012)

ISO/IEC 27037:2012 provides guidelines for specific activities in the handling of digital evidence, which are identification, collection, acquisition and preservation of potential digital evidence that can be of evidential value.
It provides guidance to individuals with respect to common situations encountered throughout the digital evidence handling process and assists organizations in their disciplinary procedures and in facilitating the exchange of potential digital evidence between jurisdictions.
ISO/IEC 27037:2012 gives guidance for the following devices and circumstances:
Digital storage media used in standard computers like hard drives, floppy disks, optical and magneto optical disks, data devices with similar functions,
Mobile phones, Personal Digital Assistants (PDAs), Personal Electronic Devices (PEDs), memory cards,
Mobile navigation systems,
Digital still and video cameras (including CCTV),
Standard computer with network connections,
Networks based on TCP/IP and other digital protocols, and
Devices with similar functions as above.
The above list of devices is an indicative list and not exhaustive.

Informationstechnik - IT-Sicherheitsverfahren - Leitfaden für die Identifikation, Mitnahme, Sicherung und Erhaltung digitaler Beweismittel (ISO/IEC 27037:2012)

Technologies de l'information - Techniques de sécurité - Lignes directrices pour l'identification, la collecte, l'acquisition et la préservation de preuves numériques (ISO/IEC 27037:2012)

ISO/IEC 27037:2012 fournit des lignes directrices pour les activités spécifiques au traitement des preuves numériques que sont l'identification, la collecte, l'acquisition et la préservation des preuves numériques susceptibles de présenter une valeur probatoire. La présente Norme internationale fournit des préconisations aux personnes concernant des situations courantes rencontrées au cours du processus de traitement des preuves numériques, apporte une aide aux organismes en ce qui concerne leurs procédures disciplinaires et vise à faciliter l'échange de preuves numériques éventuelles entre les juridictions.
ISO/IEC 27037:2012 fournit des préconisations concernant les appareils et/ou fonctions suivants utilisés dans diverses circonstances:
-      supports de stockage numérique utilisés dans les ordinateurs standard comme les disques durs, disquettes, disques optiques et magnéto-optiques, supports d'informations dotés de fonctions similaires;
-      téléphones mobiles, assistants numériques personnels, appareils électroniques personnels, cartes mémoires;
-      systèmes de navigation mobiles;
-      appareils photo et caméras vidéo numériques (comprenant la télévision en circuit fermé (CCTV));
-      ordinateurs standard dotés de connexions réseau;
-      réseaux basés sur TCP/IP et d'autres protocoles numériques; et
-      appareils dotés de fonctions similaires à celles citées ci-dessus.

Informacijska tehnologija - Varnostne tehnike - Smernice za identifikacijo, izbiro, pridobivanje in hranjenje digitalnih dokazov (ISO/IEC 27037:2012)

Ta mednarodni standard podaja smernice za specifične aktivnosti pri ravnanju z digitalnimi dokazi, in sicer za identifikacijo, izbiro, pridobivanje in hranjenje digitalnih dokazov, ki so lahko dokazne vrednosti. Ta mednarodni standard podaja smernice za posameznike glede na običajne situacije, do katerih pride v postopku ravnanja z digitalnimi dokazi, ter pomaga organizacijam pri disciplinskih postopkih in izmenjavi potencialnih digitalnih dokazov med pristojnostmi.
Ta mednarodni standard podaja smernice za naslednje naprave in/ali funkcije, ki se uporabljajo v različnih okoliščinah:
 Digitalni mediji za shranjevanje, ki se uporabljajo v standardnih računalnikih, npr. trdi diski, diskete, optični in magnetnooptični nosilci, podatkovne naprave s podobnimi funkcijami,
 Mobilni telefoni, osebne digitalne beležnice (PDA), osebne elektronske naprave (PED), pomnilniške kartice,
 Mobilni navigacijski sistemi,
 Digitalni fotoaparati in video kamere (vključno s CCTV),
 Standardni računalnik z omrežnimi povezavami,
 Omrežja, ki temeljijo na protokolu TCP/IP in drugih digitalnih protokolih in
 Naprave s podobnimi funkcijami, kot je našteto zgoraj.
OPOMBA 1: zgornji seznam naprav je okviren seznam in ni popoln.
OPOMBA 2: okoliščine vključujejo zgornje naprave v različnih oblikah. Avtomobilski sistem lahko na primer vključuje mobilni navigacijski sistem, sistem za shranjevanje podatkov in senzorični sistem.

General Information

• Status: Published
• Publication Date: 23-Aug-2016
• Withdrawal Date: 27-Feb-2017
• ICS: 35.030 - IT Security
• ICS: 35.040 - Information coding
• Technical Committee: CEN/CLC/TC 13 - Cybersecurity and Data Protection
• Drafting Committee: CEN/CLC/TC 13 - Cybersecurity and Data Protection
• Current Stage: 6060 - Definitive text made available (DAV) - Publishing
• Start Date: 24-Aug-2016
• Due Date: 02-Sep-2017
• Completion Date: 24-Aug-2016
• Ref Project: SIST EN ISO/IEC 27037:2017 - Information technology - Security techniques - Guidelines for identification, collection, acquisition and preservation of digital evidence (ISO/IEC 27037:2012)

Standards Content (Sample)

SLOVENSKI STANDARD
01-januar-2017
Informacijska tehnologija - Varnostne tehnike - Smernice za identifikacijo, izbiro,
pridobivanje in hranjenje digitalnih dokazov (ISO/IEC 27037:2012)
Information technology - Security techniques - Guidelines for identification, collection,
acquisition and preservation of digital evidence (ISO/IEC 27037:2012)
Informationstechnik - IT-Sicherheitsverfahren - Leitfaden für die Identifikation,
Sammlung, Erhebung und Erhaltung der digitalen Beweissicherung (ISO/IEC
27037:2012)
Technologies de l'information - Techniques de sécurité - Lignes directrices pour
l'identification, la collecte, l'acquisition et la préservation de preuves numériques
(ISO/IEC 27037:2012)
Ta slovenski standard je istoveten z: EN ISO/IEC 27037:2016
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EN ISO/IEC 27037
EUROPEAN STANDARD
NORME EUROPÉENNE
August 2016
EUROPÄISCHE NORM
ICS 35.040
English Version
Information technology - Security techniques - Guidelines
for identification, collection, acquisition and preservation
of digital evidence (ISO/IEC 27037:2012)
Technologies de l'information - Techniques de sécurité Informationstechnik - IT-Sicherheitsverfahren -
- Lignes directrices pour l'identification, la collecte, Leitfaden für die Identifikation, Sammlung, Erhebung
l'acquisition et la préservation de preuves numériques und Erhaltung der digitalen Beweissicherung (ISO/IEC
(ISO/IEC 27037:2012) 27037:2012)
This European Standard was approved by CEN on 19 June 2016.

CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions
for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic,
Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden,
Switzerland, Turkey and United Kingdom.

EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATIO N

EUROPÄISCHES KOMITEE FÜR NORMUN G

CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2016 CEN and CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 27037:2016 E
reserved worldwide for CEN and CENELEC national
Members.
Contents Page
European foreword . 3
European foreword
The text of ISO/IEC 27037:2012 has been prepared by Technical Committee ISO/IEC JTC 1 “Information
technology” of the International Organization for Standardization (ISO) and the International
Electrotechnical Commission (IEC) and has been taken over as EN ISO/IEC 27037:2016.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by February 2017, and conflicting national standards
shall be withdrawn at the latest by February 2017.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent
rights.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia,
France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta,
Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and the United Kingdom.
Endorsement notice
The text of ISO/IEC 27037:2012 has been approved by CEN as EN ISO/IEC 27037:2016 without any
modification.
INTERNATIONAL ISO/IEC
STANDARD 27037
First edition
2012-10-15
Information technology — Security
techniques — Guidelines for
identification, collection, acquisition, and
preservation of digital evidence
Technologies de l'information — Techniques de sécurité — Lignes
directrices pour l'identification, la collecte, l'acquisition et la préservation
de preuves numériques
Reference number
ISO/IEC 27037:2012(E)
©
ISO/IEC 2012
ISO/IEC 27037:2012(E)
©  ISO/IEC 2012
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
ISO's member body in the country of the requester.
ISO copyright office
Case postale 56  CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail [e-mail]
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2012 – All rights reserved

ISO/IEC 27037:2012(E)
Contents Page
Foreword . v
Introduction . vi
1 Scope . 1
2 Normative reference . 1
3 Terms and definitions . 2
4 Abbreviated terms . 4
5 Overview . 6
5.1 Context for collecting digital evidence . 6
5.2 Principles of digital evidence . 6
5.3 Requirements for digital evidence handling . 6
5.3.1 General. 6
5.3.2 Auditability . 7
5.3.3 Repeatability . 7
5.3.4 Reproducibility . 7
5.3.5 Justifiability . 7
5.4 Digital evidence handling processes . 8
5.4.1 Overview . 8
5.4.2 Identification . 8
5.4.3 Collection . 9
5.4.4 Acquisition . 9
5.4.5 Preservation. 10
6 Key components of identification, collection, acquisition and preservation of digital
evidence . 10
6.1 Chain of custody . 10
6.2 Precautions at the site of incident . 11
6.2.1 General. 11
6.2.2 Personnel . 11
6.2.3 Potential digital evidence . 12
6.3 Roles and responsibilities . 12
6.4 Competency . 13
6.5 Use reasonable care . 13
6.6 Documentation . 14
6.7 Briefing . 14
6.7.1 General. 14
6.7.2 Digital evidence specific . 14
6.7.3 Personnel specific . 15
6.7.4 Real-time incidents . 15
6.7.5 Other briefing information . 15
6.8 Prioritizing collection and acquisition . 16
6.9 Preservation of potential digital evidence . 17
6.9.1 Overview . 17
6.9.2 Preserving potential digital evidence . 17
6.9.3 Packaging digital devices and potential digital evidence . 17
6.9.4 Transporting potential digital evidence . 18
7 Instances of identification, collection, acquisition and preservation . 19
7.1 Computers, peripheral devices and digital storage media . 19
7.1.1 Identification . 19
7.1.2 Collection . 21
© ISO/IEC 2012 – All rights reserved iii

ISO/IEC 27037:2012(E)
7.1.3 Acquisition .25
7.1.4 Preservation .29
7.2 Networked devices .29
7.2.1 Identification .29
7.2.2 Collection, acquisition and preservation .31
7.3 CCTV collection, acquisition and preservation .33
Annex A (informative) DEFR core skills and competency description .35
Annex B (informative) Minimum documentation requirements for evidence transfer .37
Bibliography .38

iv © ISO/IEC 2012 – All rights reserved

ISO/IEC 27037:2012(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members of
ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information
technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as
an International Standard requires approval by at least 75 % of the national bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
ISO/IEC 27037 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
© ISO/IEC 2012 – All rights reserved v

ISO/IEC 27037:2012(E)
Introduction
This International Standard provides guidelines for specific activities in handling potential digital evidence;
these processes are: identification, collection, acquisition and preservation of potential digital evidence. These
processes are required in an investigation that is designed to maintain the integrity of the digital evidence – an
acceptable methodology in obtaining digital evidence that will contribute to its admissibility in legal and
disciplinary actions as well as other required instances. This International Standard also provides general
guidelines for the collection of non-digital evidence that may be helpful in the analysis stage of the potential
digital evidence.
This International Standard intends to provide guidance to those individuals responsible for the identification,
collection, acquisition and preservation of potential digital evidence. These individuals include Digital Evidence
First Responders (DEFRs), Digital Evidence Specialists (DESs), incident response specialists and forensic
laboratory managers. This International Standard ensures that responsible individuals manage potential digital
evidence in practical ways that are acceptable worldwide, with the objective to facilitate investigation involving
digital devices and digital evidence in a systematic and impartial manner while preserving its integrity and
authenticity.
This International Standard also intends to inform decision-makers who need to determine the reliability of
digital evidence presented to them. It is applicable to organizations needing to protect, analyze and present
potential digital evidence. It is relevant to policy-making bodies that create and evaluate procedures relating to
digital evidence, often as part of a larger body of evidence.
The potential digital evidence referred to in this International Standard may be sourced from different types of
digital devices, networks, databases, etc. It refers to data that is already in a digital format. This International
Standard does not attempt to cover the conversion of analog data into digital format.
Due to the fragility of digital evidence, it is necessary to carry out an acceptable methodology to ensure the
integrity and authenticity of the potential digital evidence. This International Standard does not mandate the
use of particular tools or methods. Key components that provide credibility in the investigation are the
methodology applied during the process, and individuals qualified in performing the tasks specified in the
methodology. This International Standard does not address the methodology for legal proceedings,
disciplinary procedures and other related actions in handling potential digital evidence that are outside the
scope of identification, collection, acquisition and preservation.
Application of this International Standard requires compliance with national laws, rules and regulations. It
should not replace specific legal requirements of any jurisdiction. Instead, it may serve as a practical guideline
for any DEFR or DES in investigations involving potential digital evidence. It does not extend to the analysis of
digital evidence and it does not replace jurisdiction-specific requirements that pertain to matters such as
admissibility, evidential weighting, relevance and other judicially controlled limitations on the use of potential
digital evidence in courts of law. This International Standard may assist in the facilitation of potential digital
evidence exchange between jurisdictions. In order to maintain the integrity of the digital evidence, users of this
International Standard are required to adapt and amend the procedures described in this International
Standard in accordance with the specific jurisdiction’s legal requirements for evidence.
Although this International Standard does not include forensic readiness, adequate forensic readiness can
largely support the identification, collection, acquisition, and preservation process of digital evidence. Forensic
readiness is the achievement of an appropriate level of capability by an organization in order for it to be able
to identify, collect, acquire, preserve, protect and analyze digital evidence. Whereas the processes and
activities described in this International Standard are essentially reactive measures used to investigate an
incident after it occurred, forensic readiness is a proactive process of attempting to plan for such events.
vi © ISO/IEC 2012 – All rights reserved

ISO/IEC 27037:2012(E)
This International Standard complements ISO/IEC 27001 and ISO/IEC 27002, and in particular the control
requirements concerning potential digital evidence acquisition by providing additional implementation
guidance. In addition, this International Standard will have applications in contexts independent of
ISO/IEC 27001 and ISO/IEC 27002. This International Standard should be read in conjunction with other
standards related to digital evidence and the investigation of information security incidents.
© ISO/IEC 2012 – All rights reserved vii

INTERNATIONAL STANDARD ISO/IEC 27037:2012(E)

Information technology — Security techniques — Guidelines for
identification, collection, acquisition, and preservation of digital
evidence
1 Scope
This International Standard provides guidelines for specific activities in handling digital evidence, which are
identification, collection, acquisition and preservation of digital evidence that may be of evidential value. This
International Standard provides guidance to individuals with respect to common situations encountered
throughout the digital evidence handling process and assists organizations in their disciplinary procedures and
in facilitating the exchange of potential digital evidence between jurisdictions.
This International Standard gives guidance for the following devices and/or functions that are used in various
circumstances:
 Digital storage media used in standard computers like hard drives, floppy disks, optical and magneto
optical disks, data devices with similar functions,
 Mobile phones, Personal Digital Assistants (PDAs), Personal Electronic Devices (PEDs), memory cards,
 Mobile navigation systems,
 Digital still and video cameras (including CCTV),
 Standard computer with network connections,
 Networks based on TCP/IP and other digital protocols, and
 Devices with similar functions as above.
NOTE 1 The above list of devices is an indicative list and not exhaustive.
NOTE 2 Circumstances include the above devices that exist in various forms. For example, an automotive system may
include mobile navigation system, data storage and sensory system.
2 Normative reference
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
ISO/TR 15801, Document management — Information stored electronically — Recommendations for
trustworthiness and reliability
ISO/IEC 17020, Conformity assessment — Requirements for the operation of various types of bodies
performing inspection
ISO/IEC 17025:2005, General requirements for the competence of testing and calibration laboratories
© ISO/IEC 2012 – All rights reserved 1

ISO/IEC 27037:2012(E)
ISO/IEC 27000, Information technology — Security techniques — Information security management
systems — Overview and vocabulary
3 Terms and definitions
For the purposes of this document, the terms and definitions in ISO/IEC 27000, ISO/IEC 17020,
ISO/IEC 17025 and ISO/TR 15801, as well as the following apply.
3.1
acquisition
process of creating a copy of data within a defined set
NOTE The product of an acquisition is a potential digital evidence copy.
3.2
allocated space
area on digital media, including primary memory, which is in use for the storage of data, including metadata
3.3
collection
process of gathering the physical items that contain potential digital evidence
3.4
digital device
electronic equipment used to process or store digital data
3.5
digital evidence
information or data, stored or transmitted in binary form that may be relied on as evidence
3.6
digital evidence copy
copy of the digital evidence that has been produced to maintain the reliability of the evidence by including both
the digital evidence and verification means where the method of verifying it can be either embedded in or
independent from the tools used in doing the verification
3.7
Digital Evidence First Responder
DEFR
individual who is authorized, trained and qualified to act first at an incident scene in performing digital
evidence collection and acquisition with the responsibility for handling that evidence
NOTE Authority, training and qualification are the expected requirements necessary to produce reliable digital
evidence, but individual circumstances may result in an individual not adhering to all three requirements. In this case, the
local law, organizational policy and individual circumstances should be considered.
3.8
Digital Evidence Specialist
DES
individual who can carry out the tasks of a DEFR and has specialized knowledge, skills and abilities to handle
a wide range of technical issues
NOTE A DES may have additional niche skills, for example, network acquisition, RAM acquisition,
operating system software or Mainframe knowledge.
2 © ISO/IEC 2012 – All rights reserved

ISO/IEC 27037:2012(E)
3.9
digital storage medium
device on which digital data may be recorded
[Adapted from ISO/IEC 10027:1990]
3.10
evidence preservation facility
secure environment or a location where collected or acquired evidence is stored
NOTE An evidence preservation facility should not be exposed to magnetic fields, dust, vibration, moisture or any
other environmental elements (such as extreme temperature or humidity) that may damage the potential digital evidence
within the facility.
3.11
hash value
string of bits which is the output of a hash-function
[ISO/IEC 10118-1:2000]
3.12
identification
process involving the search for, recognition and documentation of potential digital evidence
3.13
imaging
process of creating a bitwise copy of digital storage media
NOTE The bitwise copy is also called a physical copy.
EXAMPLE When imaging a hard drive, the DEFR would also copy data that has been deleted.
3.14
peripheral
device attached to a digital device in order to expand its functionality
3.15
preservation
process to maintain and safeguard the integrity and/or original condition of the potential digital evidence
3.16
reliability
property of consistent intended behaviour and results
[ISO/IEC 27000:2009]
3.17
repeatability
property of a process conducted to get the same test results on the same testing environment (same
computer, hard drive, mode of operation, etc.)
3.18
reproducibility
property of a process to get the same test results on a different testing environment (different computer, hard
drive, operator, etc.)
3.19
spoliation
act of making or allowing change(s) to the potential digital evidence that diminishes its evidential value
© ISO/IEC 2012 – All rights reserved 3

ISO/IEC 27037:2012(E)
3.20
system time
time generated by the system clock and used by the operating system, not the time computed by the
operating system
3.21
tampering
act of deliberately making or allowing change(s) to digital evidence (i.e. intended or purposeful spoliation)
3.22
timestamp
time variant parameter which denotes a point in time with respect to a common time reference
[ISO/IEC 11770-1:1996]
3.23
unallocated space
area on digital media, including primary memory, which has not been allocated by the operating system, and
which is available for the storage of data, including metadata
3.24
validation
confirmation, through the provision of objective proof, that the requirements for a specific intended use or
application have been fulfilled
[ISO/IEC 27004:2009]
3.25
verification function
function which is used to verify that two sets of data are identical
NOTE 1 No two non-identical data sets should produce an identical match from a verification function.
NOTE 2 Verification functions are commonly implemented using hash functions such as MD5, SHA1, etc., but other
methods may be used.
3.26
volatile data
data that is especially prone to change and can be easily modified
NOTE A change can be switching off the power or passing through a magnetic field. Volatile data also includes data
that changes as the system state changes. Examples include data stored in RAM and dynamic IP addresses.
4 Abbreviated terms
AVI  Audio Video Interleave
CCTV Closed Circuit Television
CD  Compact Disk
DNA Deoxyribonucleic Acid
DEFR Digital Evidence First Responder
DES Digital Evidence Specialist
DVD Digital Video/Versatile Disk
4 © ISO/IEC 2012 – All rights reserved

ISO/IEC 27037:2012(E)
ESN Electronic Serial Number
GPS Global Positioning System
GSM Global System for Mobile Communication
IMEI International Mobile Equipment Identity
IP  Internet Protocol
ISIRT Information Security Incident Response Team
LAN Local Area Network
MD5 Message-Digest Algorithm 5
MP3 MPEG Audio Layer 3
MPEG Moving Picture Experts Group
NAS Network Attached Storage
PDA Personal Digital Assistant
PED Personal Electronic Device
PIN  Personal Identification Number
PUK PIN Unlock Key
RAID Redundant Array of Independent Disks
RAM  Random Access Memory
RFID Radio Frequency Identification
SAN Storage Area Network
SHA Secure Hash Algorithm
SIM  Subscriber Identity Module
USB Universal Serial Bus
UPS Uninterruptible Power Supply
USIM Universal Subscriber Identity Module
UV  Ultraviolet
Wi-Fi Wireless Fidelity
© ISO/IEC 2012 – All rights reserved 5

ISO/IEC 27037:2012(E)
5 Overview
5.1 Context for collecting digital evidence
Digital evidence can be required for use in a number of distinct scenarios, each of which has a different
balance between the drivers of evidential quality, timeliness of analysis, restoration of service and cost of
digital evidence collection. Organizations will therefore be required to have a prioritization process that
identifies the needs and balances evidential quality, timeliness and service restoration before tasking DEFR
resources. A prioritization process involves carrying out an evaluation of the material available to determine
the possible evidential value and the order in which potential digital evidence should be collected, acquired or
preserved. Prioritization is carried out to minimize the risk of potential digital evidence being spoiled and
maximize evidentiary value of the potential digital evidence collected.
5.2 Principles of digital evidence
In most jurisdictions and organizations, digital evidence is governed by three fundamental principles:
relevance, reliability and sufficiency. These three principles are important to all investigations, not just those
for digital evidence to be admissible in court. Digital evidence is relevant when it goes towards proving or
disproving an element of the specific case being investigated. Although the detailed definition of “reliable”
varies among jurisdictions, the general meaning of the principle, “to ensure digital evidence is what it purports
to be” is widely held. It is not always necessary for the DEFR to collect all data or to make a complete copy of
the original digital evidence. In many jurisdictions, the concept of sufficiency means the DEFR needs to collect
enough potential digital evidence to allow the elements of the matter to be adequately examined or
investigated. Understanding this concept is important for the DEFR to prioritize the effort properly when time
or cost is a concern.
NOTE The DEFR should ensure that the collection of potential digital evidence is in accordance with the local
jurisdictional laws and regulations, as required by the specific circumstances.
All processes to be used by the DEFR and DES should have been validated prior to use. If the validation is
carried out externally, the DEFR or DES should verify that the validation is appropriate for their specific use of
the processes and the environment and circumstances in which the processes are about to be used. The
DEFR or DES should also:
a) document all actions;
b) determine and apply a method for establishing the accuracy and reliability of the potential digital
evidence copy compared to the original source; and
c) recognize that the act of preservation of the potential digital evidence cannot always be non-intrusive.
5.3 Requirements for digital evidence handling
5.3.1 General
The principles laid down in clause 5.2 above can be satisfied as follows:
 Relevance: It should be possible to demonstrate that material acquired is relevant to the investigation - i.e.
that it contains information of value in assisting the investigation of the particular incident and that there is
a good reason for it to have been acquired. Through auditing and justification, the DEFR should be able
to describe the procedures followed and explain how the decision to acquire each item was made.
 Reliability: All processes used in handling potential digital evidence should be auditable and repeatable.
The results of applying such processes should be reproducible.
 Sufficiency: The DEFR should have taken into consideration that enough material has been gathered to
allow a proper investigation to be carried out. The DEFR should be able, through audit and justification, to
6 © ISO/IEC 2012 – All rights reserved

ISO/IEC 27037:2012(E)
give an indication of how much material, in total, was considered and the procedures used to decide how
much and which material to acquire.
NOTE The materials may be gathered via acquisition and/or collection activities.
There are four key aspects in digital evidence handling: auditability, justifiability and either repeatability or
reproducibility depending on particular circumstances.
5.3.2 Auditability
It should be possible for an independent assessor or other authorized interested parties to evaluate the
activities performed by a DEFR and DES. This will be made possible by appropriately documenting all actions
taken. The DEFR and DES should be able to justify the decision-making process in selecting a given course
of action. Processes performed by a DEFR and DES should be available for independent assessment to
determine if an appropriate scientific method, technique or procedure was followed.
5.3.3 Repeatability
Repeatability is established when the same test results are produced under the following conditions:
 Using the same measurement procedure and method;
 Using the same instruments and under the same conditions; and
 Can be repeated at any time after the original test.
A suitably skilled and experienced DEFR should be able to undertake all processes described in the
documentation and arrive at the same results, without guidance or interpretation. The DEFR should be aware
that there might be circumstances where it would not be possible to repeat the test, e.g. when an original hard
drive has been copied and returned into use, or when an item involves volatile memory. In this case, the
DEFR should assure the acquisition process is reliable. To achieve repeatability, quality control and
documentation of the process should be in place.
5.3.4 Reproducibility
Reproducibility is established when the same test results are produced under the following conditions:
 Using the same measurement method;
 Using different instruments and under different conditions; and
 Can be reproduced at any time after the original test.
The needs to reproduce results vary according to jurisdictions and circumstances, so the DEFR, or the
individual doing the reproduction will need to be informed about the applicable conditions.
5.3.5 Justifiability
The DEFR should be able to justify all actions and methods used in handling the potential digital evidence.
The justification can be achieved by demonstrating that the decision was the best choice to get all the
potential digital evidence. Another DEFR or DES could also demonstrate this by successfully reproducing or
validating the actions and methods used.
It is in the best interest of the individual organization to employ a DEFR or DES who possesses core skills and
competency as described in Annex A of this International Standard. This will ensure that the correct processes
and procedures are followed when handling potential digital evidence to ensure the eventual preservation of
digital evidence that may have evidentiary value. This will also ensure that organizations are able to use the
© ISO/IEC 2012 – All rights reserved 7

ISO/IEC 27037:2012(E)
potential digital evidence, for example, in their disciplinary procedures or in facilitating the exchange of
potential digital evidence between jurisdictions.
NOTE The competency described in the Annex A is limited to DEFR function which is aligned with the role of DES as
defined in Clause 3.8.
5.4 Digital evidence handling processes
5.4.1 Overview
Although the complete digital evidence handling process includes other activities (i.e. presentation, disposal,
etc.), the scope of this International Standard relates only to the initial handling process which consists of
identification, collection, acquisition, and preservation of potential digital evidence.
Digital evidence can be fragile in nature. It may be altered, tampered with or destroyed through improper
handling or examination. Handlers of digital evidence should be competent to identify and manage the risks
and consequences of potential courses of action when dealing with digital evidence. Failure to handle digital
devices in an appropriate manner may render the potential digital evidence contained on those digital devices
to be unusable.
The DEFR and DES should follow documented procedures to ensure that the integrity and reliability of
potential digital evidence are maintained. The procedures should include handling guidelines for sources of
potential digital evidence and should include the following fundamental principles:
 Minimize handling of the original digital device or potential digital evidence;
 Account for any changes and document actions taken (to the extent that an expert is able to form an
opinion on reliability);
 Comply with the local rules of evidence; and
 The DEFR and DES should not take actions beyond their competence.
By complying with the fundamental principles and requirements of handling potential digital evidence, the
evidence should be preserved. Specifically in the case where unavoidable changes were to be made, all
actions and rationale need to be documented. Each process of the digital evidence handling, i.e. identification,
collection, acquisition and preservation, is discussed in more detail in the clauses to follow.
5.4.2 Identification
Digital evidence is represented in physical and logical form. The physical form includes the representation of
data within a tangible device. The logical form of the potential digital evidence refers to the virtual
representation of data within a device.
The identification process involves the search for, recognition and documentation of potential digital evidence.
The identification process should identify digital storage media and processing devices that may contain
potential digital evidence relevant to the incident. This process also includes an activity to prioritize the
evidence collection based on their volatility. The volatility of the data should be identified to ensure the correct
order of the collection and acquisition processes to minimize the damage to the potential digital evidence and
to obtain the best evidence. In addition, the process should identify the possibility of hidden potential digital
evidence. The DEFR and DES should be aware that not all types of digital storage media can be easily
identified and located, for example cloud computing, NAS and SAN - all add a virtual component to the
identification process.
The DEFR should systematically carry out a thorough search for items that may contain potential digital
evidence. Different types of digital devices that may contain potential digital evidence can easily be
overlooked (e.g. due to small size), disguised or co-mingled amongst other irrelevant material.
8 © ISO/IEC 2012 – All rights reserved

ISO/IEC 27037:2012(E)
Clauses 6.1 and 6.6 provide more information on the chain of custody, packaging and labelling aspects of
digital evidence identification. Clause 7 specifies guidelines relevant to specific instances of identification,
collection, acquisition and preservation of digital evidence.
5.4.3 Collection
Once the digital devices that may contain potential digital evidence are identified, the DEFR and DES should
decide whether to collect or acquire during the next process. There are a number of decision factors for this,
which is discussed in more detail in Clause 7. The decision should be based on the circumstances.
Collection is a process in the digital evidence handling process where devices that may contain potential
digital evidence are removed from their original location to a laboratory or another controlled environment for
later acquisition and analysis. Devices containing potential digital evidence may be in one of two states: when
the system is powered on or when the system is powered off. Different approaches and tools are required,
depending on the state of the device. Local procedures may apply to the approaches and tools used for the
collection process.
This process includes documenting the whole approach, as well as the packaging of these devices prior to
transportation. It is important for the DEFR and DES to collect any material that might relate to the potential
digital information (e.g. paper with passwords noted down, cradles and power connectors for embedded
system devices). Potential digital evidence may be lost or damaged if reasonable care is not applied. The
DEFR and DES should adopt the best possible collection method based on the situation, cost and time, and
document the decision for using a particular method.
NOTE 1 Removal of digital storage media is not always recommended and the DEFR should be sure they are
competent to remove storage media, and recognize when it is appropriate and permitted to do so.
NOTE 2 Details on digital devices not collected should be documented with justification for their exclusion, in
accordance with requirements of applicable jurisdiction.
5.4.4 Acquisition
The acquisition process in
...