ISO/IEC 27037:2012

INTERNATIONAL ISO/IEC
STANDARD 27037
First edition
2012-10-15
Information technology — Security
techniques — Guidelines for
identification, collection, acquisition, and
preservation of digital evidence
Technologies de l'information — Techniques de sécurité — Lignes
directrices pour l'identification, la collecte, l'acquisition et la préservation
de preuves numériques
Reference number
©
ISO/IEC 2012
©  ISO/IEC 2012
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
ISO's member body in the country of the requester.
ISO copyright office
Case postale 56  CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2012 – All rights reserved

Contents Page
Foreword . v
Introduction . vi
1 Scope . 1
2 Normative reference . 1
3 Terms and definitions . 2
4 Abbreviated terms . 4
5 Overview . 6
5.1 Context for collecting digital evidence . 6
5.2 Principles of digital evidence . 6
5.3 Requirements for digital evidence handling . 6
5.3.1 General. 6
5.3.2 Auditability . 7
5.3.3 Repeatability . 7
5.3.4 Reproducibility . 7
5.3.5 Justifiability . 7
5.4 Digital evidence handling processes . 8
5.4.1 Overview . 8
5.4.2 Identification . 8
5.4.3 Collection . 9
5.4.4 Acquisition . 9
5.4.5 Preservation. 10
6 Key components of identification, collection, acquisition and preservation of digital
evidence . 10
6.1 Chain of custody . 10
6.2 Precautions at the site of incident . 11
6.2.1 General. 11
6.2.2 Personnel . 11
6.2.3 Potential digital evidence . 12
6.3 Roles and responsibilities . 12
6.4 Competency . 13
6.5 Use reasonable care . 13
6.6 Documentation . 14
6.7 Briefing . 14
6.7.1 General. 14
6.7.2 Digital evidence specific . 14
6.7.3 Personnel specific . 15
6.7.4 Real-time incidents . 15
6.7.5 Other briefing information . 15
6.8 Prioritizing collection and acquisition . 16
6.9 Preservation of potential digital evidence . 17
6.9.1 Overview . 17
6.9.2 Preserving potential digital evidence . 17
6.9.3 Packaging digital devices and potential digital evidence . 17
6.9.4 Transporting potential digital evidence . 18
7 Instances of identification, collection, acquisition and preservation . 19
7.1 Computers, peripheral devices and digital storage media . 19
7.1.1 Identification . 19
7.1.2 Collection . 21
© ISO/IEC 2012 – All rights reserved iii

7.1.3 Acquisition .25
7.1.4 Preservation .29
7.2 Networked devices .29
7.2.1 Identification .29
7.2.2 Collection, acquisition and preservation .31
7.3 CCTV collection, acquisition and preservation .33
Annex A (informative) DEFR core skills and competency description .35
Annex B (informative) Minimum documentation requirements for evidence transfer .37
Bibliography .38

iv © ISO/IEC 2012 – All rights reserved

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members of
ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information
technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as
an International Standard requires approval by at least 75 % of the national bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
ISO/IEC 27037 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
© ISO/IEC 2012 – All rights reserved v

Introduction
This International Standard provides guidelines for specific activities in handling potential digital evidence;
these processes are: identification, collection, acquisition and preservation of potential digital evidence. These
processes are required in an investigation that is designed to maintain the integrity of the digital evidence – an
acceptable methodology in obtaining digital evidence that will contribute to its admissibility in legal and
disciplinary actions as well as other required instances. This International Standard also provides general
guidelines for the collection of non-digital evidence that may be helpful in the analysis stage of the potential
digital evidence.
This International Standard intends to provide guidance to those individuals responsible for the identification,
collection, acquisition and preservation of potential digital evidence. These individuals include Digital Evidence
First Responders (DEFRs), Digital Evidence Specialists (DESs), incident response specialists and forensic
laboratory managers. This International Standard ensures that responsible individuals manage potential digital
evidence in practical ways that are acceptable worldwide, with the objective to facilitate investigation involving
digital devices and digital evidence in a systematic and impartial manner while preserving its integrity and
authenticity.
This International Standard also intends to inform decision-makers who need to determine the reliability of
digital evidence presented to them. It is applicable to organizations needing to protect, analyze and present
potential digital evidence. It is relevant to policy-making bodies that create and evaluate procedures relating to
digital evidence, often as part of a larger body of evidence.
The potential digital evidence referred to in this International Standard may be sourced from different types of
digital devices, networks, databases, etc. It refers to data that is already in a digital format. This International
Standard does not attempt to cover the conversion of analog data into digital format.
Due to the fragility of digital evidence, it is necessary to carry out an acceptable methodology to ensure the
integrity and authenticity of the potential digital evidence. This International Standard does not mandate the
use of particular tools or methods. Key components that provide credibility in the investigation are the
methodology applied during the process, and individuals qualified in performing the tasks specified in the
methodology. This International Standard does not address the methodology for legal proceedings,
disciplinary procedures and other related actions in handling potential digital evidence that are outside the
scope of identification, collection, acquisition and preservation.
Application of this International Standard requires compliance with national laws, rules and regulations. It
should not replace specific legal requirements of any jurisdiction. Instead, it may serve as a practical guideline
for any DEFR or DES in investigations involving potential digital evidence. It does not extend to the analysis of
digital evidence and it does not replace jurisdiction-specific requirements that pertain to matters such as
admissibility, evidential weighting, relevance and other judicially controlled limitations on the use of potential
digital evidence in courts of law. This International Standard may assist in the facilitation of potential digital
evidence exchange between jurisdictions. In order to maintain the integrity of the digital evidence, users of this
International Standard are required to adapt and amend the procedures described in this International
Standard in accordance with the specific jurisdiction’s legal requirements for evidence.
Although this International Standard does not include forensic readiness, adequate forensic readiness can
largely support the identification, collection, acquisition, and preservation process of digital evidence. Forensic
readiness is the achievement of an appropriate level of capability by an organization in order for it to be able
to identify, collect, acquire, preserve, protect and analyze digital evidence. Whereas the processes and
activities described in this International Standard are essentially reactive measures used to investigate an
incident after it occurred, forensic readiness is a proactive process of attempting to plan for such events.
vi © ISO/IEC 2012 – All rights reserved

This International Standard complements ISO/IEC 27001 and ISO/IEC 27002, and in particular the control
requirements concerning potential digital evidence acquisition by providing additional implementation
guidance. In addition, this International Standard will have applications in contexts independent of
ISO/IEC 27001 and ISO/IEC 27002. This International Standard should be read in conjunction with other
standards related to digital evidence and the investigation of information security incidents.
© ISO/IEC 2012 – All rights reserved vii

INTERNATIONAL STANDARD ISO/IEC 27037:2012(E)

Information technology — Security techniques — Guidelines for
identification, collection, acquisition, and preservation of digital
evidence
1 Scope
This International Standard provides guidelines for specific activities in handling digital evidence, which are
identification, collection, acquisition and preservation of digital evidence that may be of evidential value. This
International Standard provides guidance to individuals with respect to common situations encountered
throughout the digital evidence handling process and assists organizations in their disciplinary procedures and
in facilitating the exchange of potential digital evidence between jurisdictions.
This International Standard gives guidance for the following devices and/or functions that are used in various
circumstances:
 Digital storage media used in standard computers like hard drives, floppy disks, optical and magneto
optical disks, data devices with similar functions,
 Mobile phones, Personal Digital Assistants (PDAs), Personal Electronic Devices (PEDs), memory cards,
 Mobile navigation systems,
 Digital still and video cameras (including CCTV),
 Standard computer with network connections,
 Networks based on TCP/IP and other digital protocols, and
 Devices with similar functions as above.
NOTE 1 The above list of devices is an indicative list and not exhaustive.
NOTE 2 Circumstances include the above devices that exist in various forms. For example, an automotive system may
include mobile navigation system, data storage and sensory system.
2 Normative reference
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
ISO/TR 15801, Document management — Information stored electronically — Recommendations for
trustworthiness and reliability
ISO/IEC 17020, Conformity assessment — Requirements for the operation of various types of bodies
performing inspection
ISO/IEC 17025:2005, General requirements for the competence of testing and calibration laboratories
© ISO/IEC 2012 – All rights reserved 1

ISO/IEC 27000, Information technology — Security techniques — Information security management
systems — Overview and vocabulary
3 Terms and definitions
For the purposes of this document, the terms and definitions in ISO/IEC 27000, ISO/IEC 17020,
ISO/IEC 17025 and ISO/TR 15801, as well as the following apply.
3.1
acquisition
process of creating a copy of data within a defined set
NOTE The product of an acquisition is a potential digital evidence copy.
3.2
allocated space
area on digital media, including primary memory, which is in use for the storage of data, including metadata
3.3
collection
process of gathering the physical items that contain potential digital evidence
3.4
digital device
electronic equipment used to process or store digital data
3.5
digital evidence
information or data, stored or transmitted in binary form that may be relied on as evidence
3.6
digital evidence copy
copy of the digital evidence that has been produced to maintain the reliability of the evidence by including both
the digital evidence and verification means where the method of verifying it can be either embedded in or
independent from the tools used in doing the verification
3.7
Digital Evidence First Responder
DEFR
individual who is authorized, trained and qualified to act first at an incident scene in performing digital
evidence collection and acquisition with the responsibility for handling that evidence
NOTE Authority, training and qualification are the expected requirements necessary to produce reliable digital
evidence, but individual circumstances may result in an individual not adhering to all three requirements. In this case, the
local law, organizational policy and individual circumstances should be considered.
3.8
Digital Evidence Specialist
DES
individual who can carry out the tasks of a DEFR and has specialized knowledge, skills and abilities to handle
a wide range of technical issues
NOTE A DES may have additional niche skills, for example, network acquisition, RAM acquisition,
operating system software or Mainframe knowledge.
2 © ISO/IEC 2012 – All rights reserved

3.9
digital storage medium
device on which digital data may be recorded
[Adapted from ISO/IEC 10027:1990]
3.10
evidence preservation facility
secure environment or a location where collected or acquired evidence is stored
NOTE An evidence preservation facility should not be exposed to magnetic fields, dust, vibration, moisture or any
other environmental elements (such as extreme temperature or humidity) that may damage the potential digital evidence
within the facility.
3.11
hash value
string of bits which is the output of a hash-function
[ISO/IEC 10118-1:2000]
3.12
identification
process involving the search for, recognition and documentation of potential digital evidence
3.13
imaging
process of creating a bitwise copy of digital storage media
NOTE The bitwise copy is also called a physical copy.
EXAMPLE When imaging a hard drive, the DEFR would also copy data that has been deleted.
3.14
peripheral
device attached to a digital device in order to expand its functionality
3.15
preservation
process to maintain and safeguard the integrity and/or original condition of the potential digital evidence
3.16
reliability
property of consistent intended behaviour and results
[ISO/IEC 27000:2009]
3.17
repeatability
property of a process conducted to get the same test results on the same testing environment (same
computer, hard drive, mode of operation, etc.)
3.18
reproducibility
property of a process to get the same test results on a different testing environment (different computer, hard
drive, operator, etc.)
3.19
spoliation
act of making or allowing change(s) to the potential digital evidence that diminishes its evidential value
© ISO/IEC 2012 – All rights reserved 3

3.20
system time
time generated by the system clock and used by the operating system, not the time computed by the
operating system
3.21
tampering
act of deliberately making or allowing change(s) to digital evidence (i.e. intended or purposeful spoliation)
3.22
timestamp
time variant parameter which denotes a point in time with respect to a common time reference
[ISO/IEC 11770-1:1996]
3.23
unallocated space
area on digital media, including primary memory, which has not been allocated by the operating system, and
which is available for the storage of data, including metadata
3.24
validation
confirmation, through the provision of objective proof, that the requirements for a specific intended use or
application have been fulfilled
[ISO/IEC 27004:2009]
3.25
verification function
function which is used to verify that two sets of data are identical
NOTE 1 No two non-identical data sets should produce an identical match from a verification function.
NOTE 2 Verification functions are commonly implemented using hash functions such as MD5, SHA1, etc., but other
methods may be used.
3.26
volatile data
data that is especially prone to change and can be easily modified
NOTE A change can be switching off the power or passing through a magnetic field. Volatile data also includes data
that changes as the system state changes. Examples include data stored in RAM and dynamic IP addresses.
4 Abbreviated terms
AVI  Audio Video Interleave
CCTV Closed Circuit Television
CD  Compact Disk
DNA Deoxyribonucleic Acid
DEFR Digital Evidence First Responder
DES Digital Evidence Specialist
DVD Digital Video/Versatile Disk
4 © ISO/IEC 2012 – All rights reserved

ESN Electronic Serial Number
GPS Global Positioning System
GSM Global System for Mobile Communication
IMEI International Mobile Equipment Identity
IP  Internet Protocol
ISIRT Information Security Incident Response Team
LAN Local Area Network
MD5 Message-Digest Algorithm 5
MP3 MPEG Audio Layer 3
MPEG Moving Picture Experts Group
NAS Network Attached Storage
PDA Personal Digital Assistant
PED Personal Electronic Device
PIN  Personal Identification Number
PUK PIN Unlock Key
RAID Redundant Array of Independent Disks
RAM  Random Access Memory
RFID Radio Frequency Identification
SAN Storage Area Network
SHA Secure Hash Algorithm
SIM  Subscriber Identity Module
USB Universal Serial Bus
UPS Uninterruptible Power Supply
USIM Universal Subscriber Identity Module
UV  Ultraviolet
Wi-Fi Wireless Fidelity
© ISO/IEC 2012 – All rights reserved 5

5 Overview
5.1 Context for collecting digital evidence
Digital evidence can be required for use in a number of distinct scenarios, each of which has a different
balance between the drivers of evidential quality, timeliness of analysis, restoration of service and cost of
digital evidence collection. Organizations will therefore be required to have a prioritization process that
identifies the needs and balances evidential quality, timeliness and service restoration before tasking DEFR
resources. A prioritization process involves carrying out an evaluation of the material available to determine
the possible evidential value and the order in which potential digital evidence should be collected, acquired or
preserved. Prioritization is carried out to minimize the risk of potential digital evidence being spoiled and
maximize evidentiary value of the potential digital evidence collected.
5.2 Principles of digital evidence
In most jurisdictions and organizations, digital evidence is governed by three fundamental principles:
relevance, reliability and sufficiency. These three principles are important to all investigations, not just those
for digital evidence to be admissible in court. Digital evidence is relevant when it goes towards proving or
disproving an element of the specific case being investigated. Although the detailed definition of “reliable”
varies among jurisdictions, the general meaning of the principle, “to ensure digital evidence is what it purports
to be” is widely held. It is not always necessary for the DEFR to collect all data or to make a complete copy of
the original digital evidence. In many jurisdictions, the concept of sufficiency means the DEFR needs to collect
enough potential digital evidence to allow the elements of the matter to be adequately examined or
investigated. Understanding this concept is important for the DEFR to prioritize the effort properly when time
or cost is a concern.
NOTE The DEFR should ensure that the collection of potential digital evidence is in accordance with the local
jurisdictional laws and regulations, as required by the specific circumstances.
All processes to be used by the DEFR and DES should have been validated prior to use. If the validation is
carried out externally, the DEFR or DES should verify that the validation is appropriate for their specific use of
the processes and the environment and circumstances in which the processes are about to be used. The
DEFR or DES should also:
a) document all actions;
b) determine and apply a method for establishing the accuracy and reliability of the potential digital
evidence copy compared to the original source; and
c) recognize that the act of preservation of the potential digital evidence cannot always be non-intrusive.
5.3 Requirements for digital evidence handling
5.3.1 General
The principles laid down in clause 5.2 above can be satisfied as follows:
 Relevance: It should be possible to demonstrate that material acquired is relevant to the investigation - i.e.
that it contains information of value in assisting the investigation of the particular incident and that there is
a good reason for it to have been acquired. Through auditing and justification, the DEFR should be able
to describe the procedures followed and explain how the decision to acquire each item was made.
 Reliability: All processes used in handling potential digital evidence should be auditable and repeatable.
The results of applying such processes should be reproducible.
 Sufficiency: The DEFR should have taken into consideration that enough material has been gathered to
allow a proper investigation to be carried out. The DEFR should be able, through audit and justification, to
6 © ISO/IEC 2012 – All rights reserved

give an indication of how much material, in total, was considered and the procedures used to decide how
much and which material to acquire.
NOTE The materials may be gathered via acquisition and/or collection activities.
There are four key aspects in digital evidence handling: auditability, justifiability and either repeatability or
reproducibility depending on particular circumstances.
5.3.2 Auditability
It should be possible for an independent assessor or other authorized interested parties to evaluate the
activities performed by a DEFR and DES. This will be made possible by appropriately documenting all actions
taken. The DEFR and DES should be able to justify the decision-making process in selecting a given course
of action. Processes performed by a DEFR and DES should be available for independent assessment to
determine if an appropriate scientific method, technique or procedure was followed.
5.3.3 Repeatability
Repeatability is established when the same test results are produced under the following conditions:
 Using the same measurement procedure and method;
 Using the same instruments and under the same conditions; and
 Can be repeated at any time after the original test.
A suitably skilled and experienced DEFR should be able to undertake all processes described in the
documentation and arrive at the same results, without guidance or interpretation. The DEFR should be aware
that there might be circumstances where it would not be possible to repeat the test, e.g. when an original hard
drive has been copied and returned into use, or when an item involves volatile memory. In this case, the
DEFR should assure the acquisition process is reliable. To achieve repeatability, quality control and
documentation of the process should be in place.
5.3.4 Reproducibility
Reproducibility is established when the same test results are produced under the following conditions:
 Using the same measurement method;
 Using different instruments and under different conditions; and
 Can be reproduced at any time after the original test.
The needs to reproduce results vary according to jurisdictions and circumstances, so the DEFR, or the
individual doing the reproduction will need to be informed about the applicable conditions.
5.3.5 Justifiability
The DEFR should be able to justify all actions and methods used in handling the potential digital evidence.
The justification can be achieved by demonstrating that the decision was the best choice to get all the
potential digital evidence. Another DEFR or DES could also demonstrate this by successfully reproducing or
validating the actions and methods used.
It is in the best interest of the individual organization to employ a DEFR or DES who possesses core skills and
competency as described in Annex A of this International Standard. This will ensure that the correct processes
and procedures are followed when handling potential digital evidence to ensure the eventual preservation of
digital evidence that may have evidentiary value. This will also ensure that organizations are able to use the
© ISO/IEC 2012 – All rights reserved 7

potential digital evidence, for example, in their disciplinary procedures or in facilitating the exchange of
potential digital evidence between jurisdictions.
NOTE The competency described in the Annex A is limited to DEFR function which is aligned with the role of DES as
defined in Clause 3.8.
5.4 Digital evidence handling processes
5.4.1 Overview
Although the complete digital evidence handling process includes other activities (i.e. presentation, disposal,
etc.), the scope of this International Standard relates only to the initial handling process which consists of
identification, collection, acquisition, and preservation of potential digital evidence.
Digital evidence can be fragile in nature. It may be altered, tampered with or destroyed through improper
handling or examination. Handlers of digital evidence should be competent to identify and manage the risks
and consequences of potential courses of action when dealing with digital evidence. Failure to handle digital
devices in an appropriate manner may render the potential digital evidence contained on those digital devices
to be unusable.
The DEFR and DES should follow documented procedures to ensure that the integrity and reliability of
potential digital evidence are maintained. The procedures should include handling guidelines for sources of
potential digital evidence and should include the following fundamental principles:
 Minimize handling of the original digital device or potential digital evidence;
 Account for any changes and document actions taken (to the extent that an expert is able to form an
opinion on reliability);
 Comply with the local rules of evidence; and
 The DEFR and DES should not take actions beyond their competence.
By complying with the fundamental principles and requirements of handling potential digital evidence, the
evidence should be preserved. Specifically in the case where unavoidable changes were to be made, all
actions and rationale need to be documented. Each process of the digital evidence handling, i.e. identification,
collection, acquisition and preservation, is discussed in more detail in the clauses to follow.
5.4.2 Identification
Digital evidence is represented in physical and logical form. The physical form includes the representation of
data within a tangible device. The logical form of the potential digital evidence refers to the virtual
representation of data within a device.
The identification process involves the search for, recognition and documentation of potential digital evidence.
The identification process should identify digital storage media and processing devices that may contain
potential digital evidence relevant to the incident. This process also includes an activity to prioritize the
evidence collection based on their volatility. The volatility of the data should be identified to ensure the correct
order of the collection and acquisition processes to minimize the damage to the potential digital evidence and
to obtain the best evidence. In addition, the process should identify the possibility of hidden potential digital
evidence. The DEFR and DES should be aware that not all types of digital storage media can be easily
identified and located, for example cloud computing, NAS and SAN - all add a virtual component to the
identification process.
The DEFR should systematically carry out a thorough search for items that may contain potential digital
evidence. Different types of digital devices that may contain potential digital evidence can easily be
overlooked (e.g. due to small size), disguised or co-mingled amongst other irrelevant material.
8 © ISO/IEC 2012 – All rights reserved

Clauses 6.1 and 6.6 provide more information on the chain of custody, packaging and labelling aspects of
digital evidence identification. Clause 7 specifies guidelines relevant to specific instances of identification,
collection, acquisition and preservation of digital evidence.
5.4.3 Collection
Once the digital devices that may contain potential digital evidence are identified, the DEFR and DES should
decide whether to collect or acquire during the next process. There are a number of decision factors for this,
which is discussed in more detail in Clause 7. The decision should be based on the circumstances.
Collection is a process in the digital evidence handling process where devices that may contain potential
digital evidence are removed from their original location to a laboratory or another controlled environment for
later acquisition and analysis. Devices containing potential digital evidence may be in one of two states: when
the system is powered on or when the system is powered off. Different approaches and tools are required,
depending on the state of the device. Local procedures may apply to the approaches and tools used for the
collection process.
This process includes documenting the whole approach, as well as the packaging of these devices prior to
transportation. It is important for the DEFR and DES to collect any material that might relate to the potential
digital information (e.g. paper with passwords noted down, cradles and power connectors for embedded
system devices). Potential digital evidence may be lost or damaged if reasonable care is not applied. The
DEFR and DES should adopt the best possible collection method based on the situation, cost and time, and
document the decision for using a particular method.
NOTE 1 Removal of digital storage media is not always recommended and the DEFR should be sure they are
competent to remove storage media, and recognize when it is appropriate and permitted to do so.
NOTE 2 Details on digital devices not collected should be documented with justification for their exclusion, in
accordance with requirements of applicable jurisdiction.
5.4.4 Acquisition
The acquisition process involves producing a digital evidence copy (e.g. complete hard disk, partition,
selected files) and documenting the methods used and activities performed. The DEFR should adopt a
suitable acquisition method based on the situation, cost and time, and document the decision for using a
particular method or tool appropriately.
The methods used to acquire potential digital evidence should be clearly documented in detail and, as far as
practically possible, be reproducible or verifiable by a competent DEFR. A DEFR or DES should acquire the
potential digital evidence in the least intrusive manner in order to avoid introducing changes where possible. In
carrying out this process, the DEFR should consider the most appropriate method to use. If the process
results to unavoidable alteration to the digital data, the activities performed should be documented to account
for the changes to the data.
The acquisition method used should produce a digital evidence copy of the potential digital evidence or digital
devices that may contain potential digital evidence. Both the original source and the digital evidence copy
should be verified with a proven verification function (proven accurate at that point in time) that is acceptable
to the individual who will use the evidence. The original source and each digital evidence copy should produce
the same verification function output.
In circumstances where the verification process cannot be performed, for example when acquiring a running
system, the original copy contains error sectors, or the acquisition time period is limited. In such instances, the
DEFR should use the best possible method available and be able to justify and defend the selection of the
method. If the imaging cannot be verified, then this needs to be documented and justified. If necessary, the
acquisition method used should be able to obtain the allocated and unallocated space.
NOTE 1 When the verification process cannot be performed on the full source due to errors on the source, then
verification using those parts of the source that can be reliably read, may be used.
© ISO/IEC 2012 – All rights reserved 9

There may be instances in which it is not feasible or permissible to create a digital evidence copy of an
evidence source, such as when the source is too large. In these instances, a DEFR may perform a logical
acquisition, which targets only specific data types, directories or locations. This generally takes place on a file
and partition level. During logical acquisition, active files and non-file-based allocated space on the digital
storage media may be copied; deleted files and unallocated space may not be copied, depending on the
method used. Other instances where this method can be useful are when mission-critical systems are
involved that cannot be shutdown.
NOTE 2 Some jurisdictions may require special treatment for data; for example, seal it in the presence of the owner of
the data. The sealing should be done in accordance with local requirements (legislative and procedural).
5.4.5 Preservation
Potential digital evidence should be preserved to ensure its usefulness in the investigation. It is important to
protect the integrity of the evidence. The preservation process involves the safeguarding of potential digital
evidence and digital devices that may contain potential digital evidence from tampering or spoliation. The
preservation process should be initiated and maintained throughout the digital evidence handling processes,
starting from the identification of the digital devices that contain potential digital evidence.
In the best-case scenario, there should be no spoliation to the data itself or any metadata associated with it
(e.g. date and time-stamps). The DEFR should be able to demonstrate that the evidence has not been
modified since it was collected or acquired, or provide the rationale and documented actions if unavoidable
changes were made.
NOTE In some cases, the confidentiality of potential digital evidence is a requirement, either a business requirement
or a legal requirement (e.g. privacy). The potential digital evidence should be preserved in a manner that ensures the
confidentiality of the data.
6 Key components of identification, collection, acquisition and preservation of
digital evidence
6.1 Chain of custody
In any investigation, the DEFR should be able to account for all the acquired data and devices at the time it is
within the custody of the DEFR. The chain of custody record is a document identifying the chronology of the
movement and handling of the potential digital evidence. It should be instituted from the collection or
acquisition process. This will typically be accomplished by tracing the history of the item from the time it was
identified, collected or acquired by the investigating team up to the present status and location.
The chain of custody record is a document or series of related documents that details the chain of custody
and records who was responsible for handling potential digital evidence, either in the form of digital data or
other formats (such as paper notes). The purpose of maintaining a chain of custody record is to enable the
identification of access and movement of potential digital evidence at any given point in time. The chain of
custody record itself may comprise more than one document, e.g. for potential digital evidence there should
be a contemporaneous document recording the acquisition of digital data to a particular device, the movement
of that device and documentation recording subsequent extracts or copies of potential digital evidence for
analysis or other purposes. The chain of custody record should contain the following information as a
minimum:
 Unique evidence identifier;
 Who accessed the evidence a
...