IEC 27037:2012 offers guidelines for specific activities related to the handling of digital evidence, including the identification, collection, acquisition, and preservation of digital evidence that may hold evidential value. It serves as a resource for individuals facing common scenarios during the digital evidence handling process and aids organizations in their disciplinary actions as well as in facilitating the transfer of potential digital evidence across different jurisdictions.
The Standard provides guidance for a variety of devices and functions utilized in different contexts, including:
- Digital storage media commonly found in standard computers, such as hard drives, floppy disks, optical disks, and magneto-optical disks, along with data devices that serve similar purposes.
- Mobile phones, Personal Digital Assistants (PDAs), Personal Electronic Devices (PEDs), and memory cards.
- Mobile navigation systems.
- Digital still and video cameras, including closed-circuit television (CCTV).
- Standard computers with network connectivity.
- Networks that operate on TCP/IP and other digital protocols.
- Devices that perform similar functions as those listed above.
NOTE 1: The devices mentioned above are representative examples and do not constitute an exhaustive list.
NOTE 2: The circumstances refer to the various forms in which the aforementioned devices may exist. For instance, an automotive system could incorporate a mobile navigation system, data storage, and sensory systems.
