More than simply providing integrity, the processes must provide assurance that nothing untoward can have occurred. As with conventional physical evidence, it is crucial for the first and subsequent responders (defined as “Digital Evidence First Responders” and “Digital Evidence Specialists”) to maintain the chain of custody of all digital forensic evidence, ensuring that it is gathered and protected through structured processes that are acceptable to the courts. One of the most critical issues in forensic investigations is the acquisition and preservation of evidence in such a way as to ensure its integrity. While individual investigators, organizations and jurisdictions may well retain certain methods, processes and controls, it is hoped that standardization will (eventually) lead to the adoption of similar if not identical approaches internationally, making it easier to compare, combine and contrast the results of such investigations even when performed by different people or organizations and potentially across different jurisdictions. The fundamental purpose of the ISO27k digital forensics standards is to promote good practice methods and processes for forensic capture and investigation of digital evidence. “digital data that may be of evidential value” for use in court.

This standard provides guidance on identifying, gathering/collecting/acquiring, handling and protecting/preserving digital forensic evidence i.e. It provides guidance to individuals with respect to common situations encountered throughout the digital evidence handling process and assists organizations in their disciplinary procedures and in facilitating the exchange of potential digital evidence between jurisdictions.” Introduction

ISO/IEC 27037:2012 - Information technology - Security techniques - Guidelines for identification, collection, acquisition and preservation of digital evidence Abstract “Provides guidelines for specific activities in the handling of digital evidence that can be of evidential value.

Digital forensic process