+91 85277 09690Enrol

ISO/IEC 27037:2012 Guidelines for Identification, Collection, Acquisition and Preservation of Digital Evidence

ISO/IEC 27037:2012 is the international standard for the first hours of digital evidence handling, from spotting a device to keeping it unchanged. This page explains what it asks for and how a laboratory in India puts it to work.

StandardISO/IEC2012 (first edition)Current edition, confirmed 2018Reviewed 2 November 2026
ISO/IEC 27037:2012 Guidelines for Identification, Collection, Acquisition and Preservation of Digital Evidence, DFRTI

ISO/IEC 27037:2012, Information technology, Security techniques, Guidelines for identification, collection, acquisition and preservation of digital evidence, is published jointly by the International Organization for Standardization and the International Electrotechnical Commission through their joint technical committee ISO/IEC JTC 1/SC 27, the committee that also looks after ISO/IEC 27001. It is the first of four linked standards on digital investigation, the others being ISO/IEC 27041:2015, ISO/IEC 27042:2015 and ISO/IEC 27043:2015.

Its subject is the part of an investigation that happens before any analysis: recognising that a device or a data source may hold evidence, deciding whether to take the device or copy its contents, making that copy and keeping both the original and the copy in a state that can be trusted later. The abstract lists the kinds of equipment it has in mind, including computers and storage media, mobile phones and memory cards, navigation units, digital cameras and CCTV, networked computers and TCP/IP networks, and says the list is indicative, not complete.

The standard is written so that it can be used across jurisdictions. It avoids the legal terms of any one country and leaves admissibility to local law, which is why a laboratory in India, the UK and Singapore can all describe their collection work in its vocabulary.

Status and Edition

The ISO catalogue lists the first edition as published in October 2012 and states that it was last reviewed and confirmed in 2018, so the 2012 text remains the current version. The catalogue's life-cycle record also shows a systematic review that closed on 3 December 2023, and as of our check on 2 November 2026 the catalogue does not show a result for that review or announce a second edition. The document is 38 pages and is sold by ISO, IEC and national member bodies.

Because the text is paid, this page describes its structure and principles from the official abstract, the free preview, the ISO catalogue record and reputable secondary summaries. We do not quote clauses we have not read. A laboratory that intends to work to the standard should buy the current text and keep it in its controlled document list.

The Four Processes

The title names four activities. They are not always done in this order, and the standard treats collection and acquisition as alternatives rather than a sequence.

  • Identification

    Recognising the devices, media and data that may hold potential digital evidence, including things that are not obvious such as a router's logs, a smart TV or a memory card inside a camera. The person doing this has to decide what to prioritise when volatile data is at risk.

  • Collection

    Taking the physical device away from its location so that it can be acquired later in a controlled setting. The standard expects the choice between collection and acquisition on site to be made on the facts, for example whether the system can be powered down and whether evidence would be lost by moving it.

  • Acquisition

    Producing a copy of the data, such as a bit-stream image of a disk or a logical copy of a running server, and showing by a verification function such as a hash that the copy is faithful. Where a full copy is impossible, a partial acquisition is acceptable if the choice is justified and documented.

  • Preservation

    Keeping the original and the copy safe from change, loss and unauthorised access from the moment of identification onwards, with a chain of custody that records every person who handled them and why.

Key Terms

Terms the standard defines or relies on, in plain words. The formal definitions are in its terms clause.

A
Auditable, Repeatable, Reproducible, Justifiable
The four qualities the standard expects of any handling process: a reviewer can follow what was done, the same examiner can repeat it with the same result, a different examiner with a different tool can reproduce it and every decision can be explained.
C
Chain of Custody
The record of who had the evidence, from when to when, where it was kept and what was done to it. The standard treats it as continuous from identification to the end of the matter, and Annex B sets out minimum documentation for a transfer.
D
Digital Evidence First Responder (DEFR)
The person authorised, trained and qualified to act first at the scene, who identifies, collects or acquires and preserves the evidence. Annex A of the standard lists the core skills and competencies a DEFR should have.
Digital Evidence Specialist (DES)
A person with the skills of a DEFR plus specialist knowledge of a technology, for example a mobile phone or a network device, who is called in when the first responder's competence runs out.
P
Potential Digital Evidence
The standard's careful term for data that may later be admitted as evidence. Calling it potential reminds everyone that a court, not the examiner, decides what counts.
V
Verification Function
A method such as a cryptographic hash used to show that an acquired copy matches the source. Our hash verification tutorial under Insights goes into the choice of algorithm and when to compute it.

How a Laboratory Applies It

A generic case: a company asks a laboratory to examine a staff laptop and a pen drive after a data leak. The standard shapes the first day like this.

  1. 01
    Confirm Authority Before Touching Anything

    The engagement letter, the company policy that gives it the right to examine the device and any consent or court order are read and filed. The standard assumes the DEFR acts within a legal authorisation; it does not supply one.

  2. 02
    Identify and Prioritise

    The DEFR records the laptop, the pen drive, the user's cloud accounts and the office network as potential sources, notes which are volatile and decides that the running laptop's memory should be captured before power-off.

  3. 03
    Choose Collection or Acquisition for Each Item

    The pen drive is collected in an evidence bag. The laptop's memory is acquired on site, then the laptop is collected and its SSD acquired in the laboratory through a write blocker. Each choice and its reason go in the notes.

  4. 04
    Acquire With Verification

    Every copy gets a SHA-256 value computed at acquisition and recorded with the tool name and version, the date and time and the examiner's name. If a sector could not be read, the log says so.

  5. 05
    Preserve and Document the Transfer

    Originals and copies go into a store with controlled access. When the pen drive moves from the field kit to the evidence store, the transfer record carries at least the fields the standard's Annex B asks for: what, from whom, to whom, when and the condition of the seal.

  6. 06
    Keep the DEFR Competent

    The laboratory keeps training and competency records for each person allowed to act as a DEFR, which is also what an accreditation assessor under ISO/IEC 17025 will ask to see.

What It Does Not Do and Common Misunderstandings

  • It stops at preservation. Analysis, interpretation and reporting belong to ISO/IEC 27042:2015.
  • It does not decide admissibility or the weight of evidence. In India those questions are answered by the Bharatiya Sakshya Adhiniyam, 2023 and the court, not by the standard.
  • It is a guideline, not a law. No Indian statute requires compliance with it, and following it does not by itself make evidence admissible.
  • It is not a certificate. A laboratory cannot be certified to ISO/IEC 27037:2012. Laboratory accreditation is a separate thing, assessed against ISO/IEC 17025 by an accreditation body, which in India is the National Accreditation Board for Testing and Calibration Laboratories (NABL).
  • It does not name tools or mandate a method. Hashing, write blocking and image formats are up to the laboratory, provided the result is auditable and verified.
  • It was written in 2012. Cloud services, vehicle systems and encrypted phones are not addressed the way a reader in 2026 would expect, so the laboratory's own procedures must fill those gaps.

How It Fits With the Other Standards on This Site

Think of the four ISO/IEC investigation standards as one process cut into parts. ISO/IEC 27043:2015 gives the overall model from readiness to closure, ISO/IEC 27037:2012 covers the acquisitive part, ISO/IEC 27042:2015 covers analysis and interpretation and ISO/IEC 27041:2015 sits across all of them to assure that the methods used are fit for purpose. A laboratory that writes its procedures to these four has a vocabulary that assessors and foreign counterparts recognise.

The SWGDE best practices for digital evidence collection and for computer forensic acquisitions say many of the same things in more practical, tool-aware language, and NIST SP 800-86 covers the collection phase from an incident response point of view. Where ISO/IEC 27037:2012 wins is as the neutral reference to cite in a procedure or a report when the reader may be outside India.

Common Questions

Do we have to buy the standard to follow it?

To claim that a procedure follows it, yes. The abstract and preview are free, but the clauses that define the processes, the roles and the minimum documentation are in the paid text.

Is there an Indian adoption?

The Bureau of Indian Standards is India's member of ISO and adopts many ISO/IEC standards as Indian Standards. Check the BIS catalogue for the current position rather than assuming; the international text is the one we teach from.

Can a police first responder use it?

Yes. It was written for first responders of every kind, from police officers to IT staff and incident handlers, and Annex A describes the skills expected of them.

Does following it make our laboratory NABL accredited?

No. Accreditation is assessed against ISO/IEC 17025 by NABL. ISO/IEC 27037:2012 can be the technical basis of your collection procedure, which is one of the many things an assessor examines.

Official sources

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Disciplines where this applies

Courses that teach it

Go deeper with DFRTI

Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.

Explore the AcademyAbout membershipTalk to a counsellor