EN ISO/IEC 27037:2016
(Main)Information technology - Security techniques - Guidelines for identification, collection, acquisition and preservation of digital evidence (ISO/IEC 27037:2012)
Information technology - Security techniques - Guidelines for identification, collection, acquisition and preservation of digital evidence (ISO/IEC 27037:2012)
This International Standard provides guidelines for specific activities in handling digital evidence, which are
identification, collection, acquisition and preservation of digital evidence that may be of evidential value. This
International Standard provides guidance to individuals with respect to common situations encountered
throughout the digital evidence handling process and assists organizations in their disciplinary procedures and
in facilitating the exchange of potential digital evidence between jurisdictions.
This International Standard gives guidance for the following devices and/or functions that are used in various
circumstances:
Digital storage media used in standard computers like hard drives, floppy disks, optical and magneto
optical disks, data devices with similar functions,
Mobile phones, Personal Digital Assistants (PDAs), Personal Electronic Devices (PEDs), memory cards,
Mobile navigation systems,
Digital still and video cameras (including CCTV),
Standard computer with network connections,
Networks based on TCP/IP and other digital protocols, and
Devices with similar functions as above.
NOTE 1 The above list of devices is an indicative list and not exhaustive.
NOTE 2 Circumstances include the above devices that exist in various forms. For example, an automotive system may
include mobile navigation system, data storage and sensory system.
Informationstechnik - IT-Sicherheitsverfahren - Leitfaden für die Identifikation, Mitnahme, Sicherung und Erhaltung digitaler Beweismittel (ISO/IEC 27037:2012)
Technologies de l'information - Techniques de sécurité - Lignes directrices pour l'identification, la collecte, l'acquisition et la préservation de preuves numériques (ISO/IEC 27037:2012)
Informacijska tehnologija - Varnostne tehnike - Smernice za identifikacijo, izbiro, pridobivanje in hranjenje digitalnih dokazov (ISO/IEC 27037:2012)
Ta mednarodni standard podaja smernice za specifične aktivnosti pri ravnanju z digitalnimi dokazi, in sicer za identifikacijo, izbiro, pridobivanje in hranjenje digitalnih dokazov, ki so lahko dokazne vrednosti. Ta mednarodni standard podaja smernice za posameznike glede na običajne situacije, do katerih pride v postopku ravnanja z digitalnimi dokazi, ter pomaga organizacijam pri disciplinskih postopkih in izmenjavi potencialnih digitalnih dokazov med pristojnostmi.
Ta mednarodni standard podaja smernice za naslednje naprave in/ali funkcije, ki se uporabljajo v različnih okoliščinah:
Digitalni mediji za shranjevanje, ki se uporabljajo v standardnih računalnikih, npr. trdi diski, diskete, optični in magnetnooptični nosilci, podatkovne naprave s podobnimi funkcijami,
Mobilni telefoni, osebne digitalne beležnice (PDA), osebne elektronske naprave (PED), pomnilniške kartice,
Mobilni navigacijski sistemi,
Digitalni fotoaparati in video kamere (vključno s CCTV),
Standardni računalnik z omrežnimi povezavami,
Omrežja, ki temeljijo na protokolu TCP/IP in drugih digitalnih protokolih in
Naprave s podobnimi funkcijami, kot je našteto zgoraj.
OPOMBA 1: zgornji seznam naprav je okviren seznam in ni popoln.
OPOMBA 2: okoliščine vključujejo zgornje naprave v različnih oblikah. Avtomobilski sistem lahko na primer vključuje mobilni navigacijski sistem, sistem za shranjevanje podatkov in senzorični sistem.
General Information
Standards Content (Sample)
SLOVENSKI STANDARD
SIST EN ISO/IEC 27037:2017
01-januar-2017
Informacijska tehnologija - Varnostne tehnike - Smernice za identifikacijo, izbiro,
pridobivanje in hranjenje digitalnih dokazov (ISO/IEC 27037:2012)
Information technology - Security techniques - Guidelines for identification, collection,
acquisition and preservation of digital evidence (ISO/IEC 27037:2012)
Informationstechnik - IT-Sicherheitsverfahren - Leitfaden für die Identifikation,
Sammlung, Erhebung und Erhaltung der digitalen Beweissicherung (ISO/IEC
27037:2012)
Technologies de l'information - Techniques de sécurité - Lignes directrices pour
l'identification, la collecte, l'acquisition et la préservation de preuves numériques
(ISO/IEC 27037:2012)
Ta slovenski standard je istoveten z: EN ISO/IEC 27037:2016
ICS:
35.030 Informacijska varnost IT Security
SIST EN ISO/IEC 27037:2017 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
SIST EN ISO/IEC 27037:2017
---------------------- Page: 2 ----------------------
SIST EN ISO/IEC 27037:2017
EN ISO/IEC 27037
EUROPEAN STANDARD
NORME EUROPÉENNE
August 2016
EUROPÄISCHE NORM
ICS 35.040
English Version
Information technology - Security techniques - Guidelines
for identification, collection, acquisition and preservation
of digital evidence (ISO/IEC 27037:2012)
Technologies de l'information - Techniques de sécurité Informationstechnik - IT-Sicherheitsverfahren -
- Lignes directrices pour l'identification, la collecte, Leitfaden für die Identifikation, Sammlung, Erhebung
l'acquisition et la préservation de preuves numériques und Erhaltung der digitalen Beweissicherung (ISO/IEC
(ISO/IEC 27037:2012) 27037:2012)
This European Standard was approved by CEN on 19 June 2016.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions
for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic,
Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden,
Switzerland, Turkey and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATIO N
EUROPÄISCHES KOMITEE FÜR NORMUN G
CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2016 CEN and CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 27037:2016 E
reserved worldwide for CEN and CENELEC national
Members.
---------------------- Page: 3 ----------------------
SIST EN ISO/IEC 27037:2017
EN ISO/IEC 27037:2016 (E)
Contents Page
European foreword . 3
2
---------------------- Page: 4 ----------------------
SIST EN ISO/IEC 27037:2017
EN ISO/IEC 27037:2016 (E)
European foreword
The text of ISO/IEC 27037:2012 has been prepared by Technical Committee ISO/IEC JTC 1 “Information
technology” of the International Organization for Standardization (ISO) and the International
Electrotechnical Commission (IEC) and has been taken over as EN ISO/IEC 27037:2016.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by February 2017, and conflicting national standards
shall be withdrawn at the latest by February 2017.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent
rights.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia,
France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta,
Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and the United Kingdom.
Endorsement notice
The text of ISO/IEC 27037:2012 has been approved by CEN as EN ISO/IEC 27037:2016 without any
modification.
3
---------------------- Page: 5 ----------------------
SIST EN ISO/IEC 27037:2017
---------------------- Page: 6 ----------------------
SIST EN ISO/IEC 27037:2017
INTERNATIONAL ISO/IEC
STANDARD 27037
First edition
2012-10-15
Information technology — Security
techniques — Guidelines for
identification, collection, acquisition, and
preservation of digital evidence
Technologies de l'information — Techniques de sécurité — Lignes
directrices pour l'identification, la collecte, l'acquisition et la préservation
de preuves numériques
Reference number
ISO/IEC 27037:2012(E)
©
ISO/IEC 2012
---------------------- Page: 7 ----------------------
SIST EN ISO/IEC 27037:2017
ISO/IEC 27037:2012(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2012
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
ISO's member body in the country of the requester.
ISO copyright office
Case postale 56 CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2012 – All rights reserved
---------------------- Page: 8 ----------------------
SIST EN ISO/IEC 27037:2017
ISO/IEC 27037:2012(E)
Contents Page
Foreword . v
Introduction . vi
1 Scope . 1
2 Normative reference . 1
3 Terms and definitions . 2
4 Abbreviated terms . 4
5 Overview . 6
5.1 Context for collecting digital evidence . 6
5.2 Principles of digital evidence . 6
5.3 Requirements for digital evidence handling . 6
5.3.1 General. 6
5.3.2 Auditability . 7
5.3.3 Repeatability . 7
5.3.4 Reproducibility . 7
5.3.5 Justifiability . 7
5.4 Digital evidence handling processes . 8
5.4.1 Overview . 8
5.4.2 Identification . 8
5.4.3 Collection . 9
5.4.4 Acquisition . 9
5.4.5 Preservation. 10
6 Key components of identification, collection, acquisition and preservation of digital
evidence . 10
6.1 Chain of custody . 10
6.2 Precautions at the site of incident . 11
6.2.1 General. 11
6.2.2 Personnel . 11
6.2.3 Potential digital evidence . 12
6.3 Roles and responsibilities . 12
6.4 Competency . 13
6.5 Use reasonable care . 13
6.6 Documentation . 14
6.7 Briefing . 14
6.7.1 General. 14
6.7.2 Digital evidence specific . 14
6.7.3 Personnel specific . 15
6.7.4 Real-time incidents . 15
6.7.5 Other briefing information . 15
6.8 Prioritizing collection and acquisition . 16
6.9 Preservation of potential digital evidence . 17
6.9.1 Overview . 17
6.9.2 Preserving potential digital evidence . 17
6.9.3 Packaging digital devices and potential digital evidence . 17
6.9.4 Transporting potential digital evidence . 18
7 Instances of identification, collection, acquisition and preservation . 19
7.1 Computers, peripheral devices and digital storage media . 19
7.1.1 Identification . 19
7.1.2 Collection . 21
© ISO/IEC 2012 – All rights reserved iii
---------------------- Page: 9 ----------------------
SIST EN ISO/IEC 27037:2017
ISO/IEC 27037:2012(E)
7.1.3 Acquisition .25
7.1.4 Preservation .29
7.2 Networked devices .29
7.2.1 Identification .29
7.2.2 Collection, acquisition and preservation .31
7.3 CCTV collection, acquisition and preservation .33
Annex A (informative) DEFR core skills and competency description .35
Annex B (informative) Minimum documentation requirements for evidence transfer .37
Bibliography .38
iv © ISO/IEC 2012 – All rights reserved
---------------------- Page: 10 ----------------------
SIST EN ISO/IEC 27037:2017
ISO/IEC 27037:2012(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members of
ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information
technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as
an International Standard requires approval by at least 75 % of the national bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
ISO/IEC 27037 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
© ISO/IEC 2012 – All rights reserved v
---------------------- Page: 11 ----------------------
SIST EN ISO/IEC 27037:2017
ISO/IEC 27037:2012(E)
Introduction
This International Standard provides guidelines for specific activities in handling potential digital evidence;
these processes are: identification, collection, acquisition and preservation of potential digital evidence. These
processes are required in an investigation that is designed to maintain the integrity of the digital evidence – an
acceptable methodology in obtaining digital evidence that will contribute to its admissibility in legal and
disciplinary actions as well as other required instances. This International Standard also provides general
guidelines for the collection of non-digital evidence that may be helpful in the analysis stage of the potential
digital evidence.
This International Standard intends to provide guidance to those individuals responsible for the identification,
collection, acquisition and preservation of potential digital evidence. These individuals include Digital Evidence
First Responders (DEFRs), Digital Evidence Specialists (DESs), incident response specialists and forensic
laboratory managers. This International Standard ensures that responsible individuals manage potential digital
evidence in practical ways that are acceptable worldwide, with the objective to facilitate investigation involving
digital devices and digital evidence in a systematic and impartial manner while preserving its integrity and
authenticity.
This International Standard also intends to inform decision-makers who need to determine the reliability of
digital evidence presented to them. It is applicable to organizations needing to protect, analyze and present
potential digital evidence. It is relevant to policy-making bodies that create and evaluate procedures relating to
digital evidence, often as part of a larger body of evidence.
The potential digital evidence referred to in this International Standard may be sourced from different types of
digital devices, networks, databases, etc. It refers to data that is already in a digital format. This International
Standard does not attempt to cover the conversion of analog data into digital format.
Due to the fragility of digital evidence, it is necessary to carry out an acceptable methodology to ensure the
integrity and authenticity of the potential digital evidence. This International Standard does not mandate the
use of particular tools or methods. Key components that provide credibility in the investigation are the
methodology applied during the process, and individuals qualified in performing the tasks specified in the
methodology. This International Standard does not address the methodology for legal proceedings,
disciplinary procedures and other related actions in handling potential digital evidence that are outside the
scope of identification, collection, acquisition and preservation.
Application of this International Standard requires compliance with national laws, rules and regulations. It
should not replace specific legal requirements of any jurisdiction. Instead, it may serve as a practical guideline
for any DEFR or DES in investigations involving potential digital evidence. It does not extend to the analysis of
digital evidence and it does not replace jurisdiction-specific requirements that pertain to matters such as
admissibility, evidential weighting, relevance and other judicially controlled limitations on the use of potential
digital evidence in courts of law. This International Standard may assist in the facilitation of potential digital
evidence exchange between jurisdictions. In order to maintain the integrity of the digital evidence, users of this
International Standard are required to adapt and amend the procedures described in this International
Standard in accordance with the specific jurisdiction’s legal requirements for evidence.
Although this International Standard does not include forensic readiness, adequate forensic readiness can
largely support the identification, collection, acquisition, and preservation process of digital evidence. Forensic
readiness is the achievement of an appropriate level of capability by an organization in order for it to be able
to identify, collect, acquire, preserve, protect and analyze digital evidence. Whereas the processes and
activities described in this International Standard are essentially reactive measures used to investigate an
incident after it occurred, forensic readiness is a proactive process of attempting to plan for such events.
vi © ISO/IEC 2012 – All rights reserved
---------------------- Page: 12 ----------------------
SIST EN ISO/IEC 27037:2017
ISO/IEC 27037:2012(E)
This International Standard complements ISO/IEC 27001 and ISO/IEC 27002, and in particular the control
requirements concerning potential digital evidence acquisition by providing additional implementation
guidance. In addition, this International Standard will have applications in contexts independent of
ISO/IEC 27001 and ISO/IEC 27002. This International Standard should be read in conjunction with other
standards related to digital evidence and the investigation of information security incidents.
© ISO/IEC 2012 – All rights reserved vii
---------------------- Page: 13 ----------------------
SIST EN ISO/IEC 27037:2017
---------------------- Page: 14 ----------------------
SIST EN ISO/IEC 27037:2017
INTERNATIONAL STANDARD ISO/IEC 27037:2012(E)
Information technology — Security techniques — Guidelines for
identification, collection, acquisition, and preservation of digital
evidence
1 Scope
This International Standard provides guidelines for specific activities in handling digital evidence, which are
identification, collection, acquisition and preservation of digital evidence that may be of evidential value. This
International Standard provides guidance to individuals with respect to common situations encountered
throughout the digital evidence handling process and assists organizations in their disciplinary procedures and
in facilitating the exchange of potential digital evidence between jurisdictions.
This International Standard gives guidance for the following devices and/or functions that are used in various
circumstances:
Digital storage media used in standard computers like hard drives, floppy disks, optical and magneto
optical disks, data devices with similar functions,
Mobile phones, Personal Digital Assistants (PDAs), Personal Electronic Devices (PEDs), memory cards,
Mobile navigation systems,
Digital still and video cameras (including CCTV),
Standard computer with network connections,
Networks based on TCP/IP and other digital protocols, and
Devices with similar functions as above.
NOTE 1 The above list of devices is an indicative list and not exhaustive.
NOTE 2 Circumstances include the above devices that exist in various forms. For example, an automotive system may
include mobile navigation system, data storage and sensory system.
2 Normative reference
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
ISO/TR 15801, Document management — Information stored electronically — Recommendations for
trustworthiness and reliability
ISO/IEC 17020, Conformity assessment — Requirements for the operation of various types of bodies
performing inspection
ISO/IEC 17025:2005, General requirements for the competence of testing and calibration laboratories
© ISO/IEC 2012 – All rights reserved 1
---------------------- Page: 15 ----------------------
SIST EN ISO/IEC 27037:2017
ISO/IEC 27037:2012(E)
ISO/IEC 27000, Information technology — Security techniques — Information security management
systems — Overview and vocabulary
3 Terms and definitions
For the purposes of this document, the terms and definitions in ISO/IEC 27000, ISO/IEC 17020,
ISO/IEC 17025 and ISO/TR 15801, as well as the following apply.
3.1
acquisition
process of creating a copy of data within a defined set
NOTE The product of an acquisition is a potential digital evidence copy.
3.2
allocated space
area on digital media, including primary memory, which is in use for the storage of data, including metadata
3.3
collection
process of gathering the physical items that contain potential digital evidence
3.4
digital device
electronic equipment used to process or store digital data
3.5
digital evidence
information or data, stored or transmitted in binary form that may be relied on as evidence
3.6
digital evidence copy
copy of the digital evidence that has been produced to maintain the reliability of the evidence by including both
the digital evidence and verification means where the method of verifying it can be either embedded in or
independent from the tools used in doing the verification
3.7
Digital Evidence First Responder
DEFR
individual who is authorized, trained and qualified to act first at an incident scene in performing digital
evidence collection and acquisition with the responsibility for handling that evidence
NOTE Authority, training and qualification are the expected requirements necessary to produce reliable digital
evidence, but individual circumstances may result in an individual not adhering to all three requirements. In this case, the
local law, organizational policy and individual circumstances should be considered.
3.8
Digital Evidence Specialist
DES
individual who can carry out the tasks of a DEFR and has specialized knowledge, skills and abilities to handle
a wide range of technical issues
NOTE A DES may have additional niche skills, for example, network acquisition, RAM acquisition,
operating system software or Mainframe knowledge.
2 © ISO/IEC 2012 – All rights reserved
---------------------- Page: 16 ----------------------
SIST EN ISO/IEC 27037:2017
ISO/IEC 27037:2012(E)
3.9
digital storage medium
device on which digital data may be recorded
[Adapted from ISO/IEC 10027:1990]
3.10
evidence preservation facility
secure environment or a location where collected or acquired evidence is stored
NOTE An evidence preservation facility should not be exposed to magnetic fields, dust, vibration, moisture or any
other environmental elements (such as extreme temperature or humidity) that may damage the potential digital evidence
within the facility.
3.11
hash value
string of bits which is the output of a hash-function
[ISO/IEC 10118-1:2000]
3.12
identification
process involving the search for, recognition and documentation of potential digital evidence
3.13
imaging
process of creating a bitwise copy of digital storage media
NOTE The bitwise copy is also called a physical copy.
EXAMPLE When imaging a hard drive, the DEFR would also copy data that has been deleted.
3.14
peripheral
device attached to a digital device in order to expand its functionality
3.15
preservation
process to maintain and safeguard the integrity and/or original condition of the potential digital evidence
3.16
reliability
property of consistent intended behaviour and results
[ISO/IEC 27000:2009]
3.17
repeatability
property of a process conducted to get the same test results on the same testing environment (same
computer, hard drive, mode of operation, etc.)
3.18
reproducibility
property of a process to get the same test results on a different testing environment (different computer, hard
drive, operator, etc.)
3.19
spoliation
act of making or allowing change(s) to the potential digital evidence that diminishes its evidential value
© ISO/IEC 2012 – All rights reserved 3
---------------------- Page: 17 ----------------------
SIST EN ISO/IEC 27037:2017
ISO/IEC 27037:2012(E)
3.20
system time
time generated by the system clock and used by the operating system, not the time computed by the
operating system
3.21
tampering
act of deliberately making or allowing change(s) to digital evidence (i.e. intended or purposeful spoliation)
3.22
timestamp
time variant parameter which denotes a point in time with respect to a common time reference
[ISO/IEC 11770-1:1996]
3.23
unallocated space
area on digital media, including primary memory, which has not been allocated by the operating system, and
which is available for the storage of data, including metadata
3.24
validation
confirmation, through the provision of objective proof, that the requirements for a specific intended use or
application have been fulfilled
[ISO/IEC 27004:2009]
3.25
verification function
function which is used to verify that two sets of data are identical
NOTE 1 No two non-identical data sets should produce an identical match from a verification function.
NOTE 2 Verificat
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.