ISO IEC 27037 Information Technology - Security Techniques - Identification, Collection, Acquisition and Preservation of Digital Evidence

The ISO IEC 27037 Information technology - Security techniques - Guidelines for the identification, collection, acquisition and preservation of digital evidence standard, published by the International Organization for Standardization (ISO), provides guidance for specific activities in the processing of digital evidence. These activities include the identification, collection, acquisition, and preservation of digital evidence that may have evidentiary value. This standard provides guidance to individuals on common situations encountered in the digital evidence processing process and helps organizations facilitate the exchange of potential digital evidence in disciplinary procedures and between jurisdictions.

This standard provides guidance for the following devices or functions used in various situations:

• Digital storage media used in standard computers, such as hard drives, floppy disks, optical and magneto-optical discs, are data devices with similar functions.
• Mobile phones, personal digital assistants, personal electronic devices (PEDs), memory cards.
• Mobile navigation systems.
• Digital cameras and video cameras (including CCTV).
• Standard network-connected computers.
• Networks based on TCP/IP and other digital protocols.
• Devices with similar functions to those listed.

This device list is for illustrative purposes only and is not exhaustive. The devices listed above exist in various forms. For example, an automotive system might include a mobile navigation system, data storage, and a sensor system.

The ISO IEC 27037 standard is part of the broader ISO IEC 27000 family of standards dealing with information security management systems, but specifically focuses on the initial handling of digital evidence in the context of digital forensics and electronic discovery. This standard is primarily aimed at first responders, digital forensics practitioners, law enforcement, incident response teams, and organizations that may need to collect potential digital evidence in a forensically sound manner.

In criminal investigations, corporate investigations, civil lawsuits, or incident responses, improperly handled digital evidence can lead to the following:

• It may become inadmissible in court.
• It can get dirty or altered.
• It may lose its evidentiary value due to a weak chain of custody.

The ISO IEC 27037 standard provides a globally accepted framework for ensuring the integrity, authenticity, and reliability of the initial stages of the evidence processing process, from the moment potential evidence is identified.

This standard explicitly addresses the four fundamental stages that occur before in-depth forensic analysis begins:

• Identification: Determining which devices, data, or media may contain relevant digital evidence.
• Collection: Gathering potential evidence from the crime scene or surrounding area.
• Acquisition: Creating forensically sound copies or images of the data.
• Protection: Ensuring that evidence (both originals and copies) is protected against alteration and that the chain of custody is properly documented.

It is important to note that the ISO IEC 27037 standard does not cover laboratory analysis, examination, or reconstruction of data (these are addressed in related standards such as ISO IEC 27041, ISO IEC 27042, ISO IEC 27043, and ISO IEC 27050).

The ISO IEC 27037 standard is built around several fundamental principles:

• Honesty: Evidence must not be altered in any way that would affect its credibility.
• Authenticity: It must be possible to prove that the evidence is as claimed.
• Repeatability: The processes must be repeatable by another authorized person.
• Chain of custody: Every person processing the evidence and every action taken must be documented.
• Minimizing impact: Where possible, gather evidence without unnecessarily disrupting operations (particularly important in live corporate environments).
• Competence: Personnel must be appropriately trained and competent.

The ISO IEC 27037 standard defines the various roles involved in the initial evidence processing process:

• Digital evidence first responder: This is usually the first person to arrive at the scene.
• Digital evidence specialist: This is someone with more technical skills who can perform the data collection process.
• Investigator/requester: The person who directs the investigation.

The ISO IEC 27037 standard provides detailed guidance and checklists for common scenarios. These include:

• Securing and assessing the crime scene.
• Identifying potential sources of digital evidence (computers, mobile devices, cloud storage, IoT devices, and the like).
• Prioritizing evidence gathering (provisional and permanent data).
• Proper handling of open and closed devices.
• The use of write blockers during the acquisition process.
• Generating forensic images (bit-by-bit copies) and calculating cryptographic hash values.
• Labeling, packaging, and transporting digital media.
• Document templates (evidence records, chain of custody forms).

The ISO IEC 27037 standard is generally used by the following:

• Law enforcement agencies and state forensic laboratories.
• Corporate incident response and digital forensics teams.
• Private legal service providers.
• Information security professionals who deal with incident management.
• Legal teams managing e-discovery operations.
• All organizations that want to be prepared to properly collect digital evidence.

In conclusion, the ISO IEC 27037 standard fills a critical gap by standardizing the initial steps in digital evidence processing, which are often performed under pressure by non-specialists (first responders, IT personnel, or security officers). Taking these initial steps correctly significantly increases the likelihood that the evidence will be admissible and reliable later in court or during an investigation.

Even if an organization never faces criminal prosecution, following the ISO IEC 27037 standard helps ensure that investigations are defensible, repeatable, and reliable.

In short, if you need to seize or copy evidence from a hard drive, phone, or cloud account, the ISO IEC 27037 standard explains how to do it correctly the first time.

For many years, our organization, with its competent and experienced staff, has been understanding the needs of its clients, providing the advanced testing services they require, and assisting in the establishment, implementation, and improvement of management systems. Within this framework, we also provide testing services compliant with the "ISO IEC 27037 Information technology - Security techniques - Guidelines for the identification, collection, acquisition and preservation of digital evidence" standard.