Quick Answer

  • ISO/IEC 27037:2012 defines the digital evidence lifecycle in 4 stages: Identification, Collection, Acquisition, and Preservation.
  • In the Identification stage, potential digital evidence sources (disk, RAM, logs, mobile devices, cloud) are determined and prioritized.
  • In the Collection and Acquisition stages, a write blocker is mandatory, a bit-level image is taken, and integrity is sealed with a SHA-256 hash.
  • In the Preservation stage, a chain of custody document is maintained, and every handover is recorded with date, person, and hash.
  • It aligns with CMK 134 in Turkey; the hash chain, write blocker use, and chain of custody document are mandatory for admissibility in court.

Whether digital evidence holds up in court depends far less on which devices the laboratory used than on its ability to document when it took custody of the evidence, how it labeled it, and where it was stored. The foundational standard the world relies on for this documentation chain is the international guideline titled ISO/IEC 27037 "Guidelines for identification, collection, acquisition and preservation of digital evidence". In Turkey, digital forensics expert witnesses, KVKK reviews, corporate investigations, and cyber incident response teams must work according to the four core stages of this standard. In this article, we at DSET explain the workflow we apply daily in our Hacettepe Teknokent laboratory, under the standard's original headings.

What Is ISO/IEC 27037, and Why Does It Exist

ISO/IEC 27037 is a guideline published by the International Organization for Standardization in 2012 that covers the first phase of digital evidence, from the scene to the laboratory. The standard's goal is to ensure that when different countries, different law enforcement units, and different private laboratories handle the same digital evidence, they produce a mutually recognizable, reproducible, and court-admissible result. The standard does not define the analysis stage; it defines the four critical steps that come before analysis. The complementary standard for the analysis side, ISO/IEC 27042 "Guidelines for the analysis and interpretation of digital evidence", is published as a separate document.

There is no direct equivalent of this standard in Turkey, but Articles 134-135 of the CMK (Code of Criminal Procedure) and Article 187 of the HMK (Code of Civil Procedure) emphasize "the manner in which evidence was obtained and its integrity." A significant portion of Court of Cassation (Yargıtay) rulings effectively reference ISO/IEC 27037 principles when questioning the integrity of digital evidence. For a detailed process map, our article The Digital Forensics Process 2026: KVKK, Chain of Custody, and the Courtroom is the foundational resource.

The four stages defined by the standard are: Identification, Collection, Acquisition, Preservation. The inline SVG workflow below shows the order of these four stages as they play out in laboratory practice.

The Four-Stage Workflow (SVG Infographic)

ISO/IEC 27037 Digital Evidence Flow Horizontal workflow showing the Identification, Collection, Acquisition, and Preservation stages ISO/IEC 27037 Digital Evidence Lifecycle 1. IDENTIFICATION Detection Device inventory Location sketch Photo, video Witness statement Risk priority 2. COLLECTION Collection Faraday bag Label, seal CoC record Cover photo Transport log 3. ACQUISITION Acquisition Write blocker Bit-by-bit image SHA-256 hash E01, AFF, dd Verification 4. PRESERVATION Preservation Air-gapped vault Access log Periodic hash AES at-rest Disposal record Every stage requires integrity, traceability, and reproducibility. DSET Digital Forensics Laboratory, Hacettepe Teknokent, Ankara

1. Identification

The Identification stage means mapping out, physically and logically, everything that could be digital evidence. At this stage, no device is touched yet; devices are listed, photographed, and prioritized. The standard refers to the person handling this stage as the DEFR (Digital Evidence First Responder).

When the DEFR enters the scene, they first take overview photographs of the scene, then record each device's power state, network connection, on-screen content, and physical damage. If a computer is on, the decision to pull the plug is not automatic; because the contents of volatile memory (RAM) would be lost, the team evaluates whether live analysis is needed. If live RAM capture is required, the workflow we describe in our article RAM Dump Memory Forensics with the Volatility Framework comes into play afterward.

The Identification output typically includes the following: a device inventory list, a photo set, a location sketch, witness statements, screen captures of devices that are on, network topology notes, and risk priority. Risk priority matters, because in an office with 10 devices, the decision of which one to image first depends on it. ISO/IEC 27037 clause 5.4.2 explicitly defines "volatility ordering." The order runs from RAM, the network connection table, and running processes, to swap on disk, and finally disk contents.

In Turkish practice, the Identification step is usually carried out by the prosecutor's team or the crime scene investigation unit of law enforcement, but in cases where we are called as expert witnesses we apply the same record-keeping discipline. In KVKK audits, the data controller's IT manager steps into the DEFR role, but the quality of the records is often inadequate; this is precisely the point at which our Ankara Digital Forensics Expert Witness Opinion service is first requested.

2. Collection

Collection is the process of packaging identified devices for physical transport to the laboratory. At this stage, the team decides whether the device will be transported powered on or off, how the connection cables will be labeled, where the seal will be placed, and who will sign it.

The main practices we follow during Collection:

  • Faraday bag: Wireless devices such as mobile phones and tablets are placed in a signal-blocking bag so they cannot be remotely wiped. SWGDE practical guidelines (swgde.org) list Faraday use as best practice at this point.
  • Labeling: Every device, every cable, and every storage medium is given a unique evidence number. This number is recorded in the report along with a photograph.
  • Seal: The device cover or the mouth of the bag is sealed with a tamper-evident label bearing the date, time, and signature. Breaking the seal raises doubts about integrity at the next stage.
  • Chain of Custody record: A chain form showing who took custody of the device, at what time, and from whom. In CMK 134 reviews, the court requests this form.
  • Transport: Conveyance inside antistatic protection, away from shock and magnetic fields, in an air-conditioned vehicle.

NIST's SP 800-86 "Guide to Integrating Forensic Techniques into Incident Response" document details the steps that minimize the risk of data loss during the collection stage, and specifically emphasizes that volatile data must be acquired before the disk image.

At the end of the Collection stage, all devices are brought to the laboratory sealed, labeled, and documented. With instant messaging content such as WhatsApp, the collection stage is more complex, because the physical device, the cloud backup, and screenshots must each be collected separately. We detailed this specific workflow in our article Is WhatsApp Admissible as Evidence? The Legal Process and Digital Forensics.

3. Acquisition

Acquisition is the stage of taking a bit-level copy of the digital evidence. This is the most technical step of the standard and the core skill area of a digital forensics laboratory. A flawed acquisition invalidates all subsequent findings.

3.1 The Write Blocker Requirement

To prevent any writes to the source disk, a hardware or software write blocker is used. The Tableau, WiebeTech, and CRU brands are the industry standard. A write blocker may come in a different model for each disk interface, such as SATA, SAS, USB, or NVMe. The standard requires that the use of a write blocker be recorded in the report and that the device's serial number be logged.

3.2 Bit-by-Bit Imaging

A disk image is not a logical copy; it is a sector-by-sector copy of the entire surface, including unused areas. Slack space and deleted file remnants are thereby preserved. Common tools: FTK Imager, Guymager, EnCase, dc3dd, X-Ways.

3.3 Hash Verification

The standard requires demonstrating the equivalence of the source and target image with at least one cryptographic hash algorithm. In practice we use SHA-256; MD5 alone is no longer considered sufficient. The hash value is recorded in the report, and any expert who later images the same disk must produce the same hash. Otherwise, the integrity of the evidence becomes disputable.

3.4 Image Format

ISO/IEC 27037 does not mandate a format, but it requires the format to be open and verifiable. Three formats are used in the DSET laboratory: raw dd (no extra metadata, the most portable), E01 (Expert Witness, includes compression and hashing), and AFF4 (a modern open format that supports multiple hashes and metadata). Which format was chosen is stated in the report header, because different analysis tools read different formats.

3.5 Live System Acquisition

If the device cannot be shut down (for example, a production server), live acquisition is performed. RAM is captured first, then the disk image is taken while the system is live. In this case, the report explicitly states that "the image could not be taken without touching the source." The standard accepts this, because the real world does not always conform to the "ideal powered-off device" scenario.

4. Preservation

The Preservation stage means storing the acquired images and physical evidence unchanged until the investigation is concluded and, if necessary, until the appeal period has expired. This stage is often underestimated, yet in the majority of cases where the Court of Cassation rejected expert reports, a "break in the chain of preservation" appears as the reason. We examined this pattern, with case rulings, in our article Pattern Analysis of Court of Cassation Rejections of Digital Forensics Expert Reports.

Preservation controls in the DSET laboratory:

  • Air-gapped storage: The storage holding the evidence images is completely separated from any internet-connected network. Transfers are made only manually, with controlled media.
  • Access log: Which expert touched which image and on what date is written to a log server. The log server is itself a separate device.
  • Periodic hash checks: The hashes of stored images are recomputed every 30 days and compared against the original hash. Disk corruption is caught early.
  • Encryption at rest: Image disks are kept encrypted with LUKS or BitLocker. The encryption key is stored in a separate hardware module.
  • Backup: At least two copies, one in a separate physical location, against the risk of fire or flooding at a single point.
  • Disposal record: Evidence whose retention period has expired is destroyed after being returned to the prosecutor's office, and a record is kept.

ISO/IEC 27037 additionally anticipates that the media type may change during long-term storage. An LTO-7 tape may become unreadable after 15 years; for this reason, a media refresh plan is also part of the preservation policy.

The Relationship with ISO/IEC 27042: The Analysis Stage

ISO/IEC 27037 is not analysis. The standard explicitly ends at the preservation stage. After the image is acquired, steps such as timeline extraction, file carving, malware reversing, and log correlation fall within the scope of ISO/IEC 27042. In addition, ISO/IEC 27035 incident management and ISO/IEC 27050 e-discovery complete the chain. A good laboratory runs these four standards in concert.

We covered in detail which step of which standard each section of an expert report should reference in our article The Structure of a Digital Forensics Expert Report: Format and Sections.

SWGDE's Practical Additions

The Scientific Working Group on Digital Evidence is a U.S.-based but internationally recognized working group that publishes practical guidelines complementing ISO/IEC 27037. In particular, the documents "Best Practices for Computer Forensic Acquisitions" and "Best Practices for Mobile Device Evidence Preservation" translate the standard's abstract clauses into concrete steps. In the DSET laboratory, these two documents are used as checklists.

Compliance with Turkish Legislation: CMK 134-135, HMK 187

In Turkey, digital evidence is used in two main branches of law: criminal and civil. CMK 134, under the heading "search, copying, and seizure of computers, computer programs, and files," states that seizure cannot be carried out without taking an image when evidence is collected. This article is, in effect, the mandate for the acquisition stage. CMK 135 regulates the procedure for the detection, interception, and recording of communications.

HMK 187 determines how evidence is presented within the framework of the "right to prove" in civil proceedings. If the integrity of digital evidence is disputed by the parties, the judge expects a record and hash comparison parallel to ISO/IEC 27037 principles. This expectation is not written into a specific article, but it appears repeatedly in Court of Cassation case law.

The Court of Cassation's Reference to the Standard

In Turkey, although the Court of Cassation does not directly cite the name ISO/IEC 27037 in its rulings, it frequently scrutinizes concepts such as "the manner in which the evidence was obtained," "whether integrity was ensured," "whether the hash value was recorded," and "the chain of seals and records." When these steps are not documented in a local court's expert reports, the Court of Cassation may find the report insufficient and issue a reversal decision. We have an analysis examining the statistical pattern of this situation.

DSET Lab Practice

Our DSET laboratory in Hacettepe Teknokent, Ankara has built the four stages of ISO/IEC 27037 into its daily workflow. For Identification, our field kit includes a digital camera, a sketch tablet, and a volatile data capture kit. For Collection, Faraday bags, antistatic packaging, tamper-evident seal labels, and Chain of Custody forms are standard. On the Acquisition side, we use Tableau write blockers, FTK Imager, Guymager, and dc3dd; every image is verified with SHA-256. On the Preservation side, there is a separate air-gapped storage room, a log server, and LUKS-encrypted storage. For laboratory imagery, you can look at our article Hacettepe Teknokent Data Recovery Laboratory Microscope Gallery.

Frequently Asked Questions (FAQ)

1. Is ISO/IEC 27037 a mandatory standard? Legally, it is not mandatory in Turkey, but in practice compliance is expected for expert reports to be accepted in court. Court of Cassation review also operates in this direction.

2. Can evidence be examined without taking an image? No. ISO/IEC 27037 and CMK 134 together prohibit direct intervention on the original media. An image is first taken with a write blocker, and analysis is performed on the image.

3. Is the MD5 hash still valid? Not recommended on its own. Because it is vulnerable to collision attacks, at least SHA-256 should be used, and where possible MD5 and SHA-256 should be recorded together.

4. Can a phone be imaged live? It depends on whether the device is locked or unlocked. On modern iOS and Android devices, a full physical image is not always possible; a logical or advanced logical image is taken. This situation is recorded in the report.

5. How is data in cloud services acquired? For cloud data, the collection stage differs; it is requested from the service provider through legal channels, captured on screen, and sealed with a hash. The 2012 version of the standard covers this topic partially, and later supplementary guidelines expand on it.

6. How does the standard handle an encrypted disk? No decryption is performed; the image is taken in its encrypted state, and the hash is computed in that state. If the password is later obtained, analysis is performed on this image.

7. What happens if the seal is broken? If the seal is broken, a photograph and a record of the moment of breakage are mandatory. Otherwise, the Chain of Custody is broken and the evidence becomes open to challenge.

8. How long is the preservation period? Generally until the case becomes final, even until the avenue of appeal is closed. In criminal files, the statute of limitations is the determining factor. In KVKK reviews, a separate retention policy applies.

Conclusion and Call to Action

The four stages of ISO/IEC 27037 are not a formality; they are the precondition for digital evidence to hold up in court. If Identification is incomplete, the evidence cannot be found; if Collection is careless, the evidence becomes disputable; if Acquisition is flawed, the evidence becomes invalid; if Preservation is neglected, the evidence decays.

The DSET Digital Forensics Laboratory, in Hacettepe Teknokent, Ankara, works with a workflow aligned with ISO/IEC 27037, ISO/IEC 27042, NIST SP 800-86, and SWGDE guidelines. It produces expert reports compliant with CMK 134-135, HMK 187, and Court of Cassation case law. For digital evidence whose integrity is beyond dispute, get in touch with us: +90 536 662 38 09.