The Digital Forensics Process 2026: KVKK, Chain of Custody and the Courtroom

TL;DR: Digital forensics is the process of identifying, collecting, preserving, analyzing digital evidence in a legal dispute and writing a report that can be presented in court. It is used in criminal cases, employment law, divorce, trade-secret violations and KVKK investigations. The ISO/IEC 27037 methodology, the chain of custody, hash verification (SHA-256) and a write blocker are treated as mandatory. Evidence collected incorrectly is rejected in court. DSET runs this process end to end in Ankara.

A Device Has Been Seized, What Happens Next?

The first hour of an investigation determines the entire case that follows. Under CMK 134, searching, copying and analyzing a computer, computer programs and records requires a judge's decision. Without breaking the confidentiality of the search, the device is sealed, the seal number is entered into the record, and every movement of the device is tracked at each stage with a signed document.

The next step is imaging. The device is not turned on; a bit-by-bit copy is made directly through a write blocker. The SHA-256 hash of the original disk is calculated and compared with the hash of the image file. If the two hashes do not come out exactly identical, that image is treated as worthless and made again from scratch. If a mistake is made at this stage, the evidence destined for trial dies before it is even born.

What Is Digital Forensics?

Digital forensics is the discipline of collecting, preserving, analyzing and reporting digital data in a way that becomes part of a legal process. What sets it apart from data recovery is this: in data recovery the goal is to return the file to the user, while in digital forensics the goal is to preserve that file's evidentiary value. The question of who accessed it, when, with which tool, and under what conditions must be answerable at every stage.

That is why digital forensics is both a technical and a legal field. On one side there is Volatility, Cellebrite, Magnet AXIOM, EnCase; on the other there is the CMK, HMK, KVKK and the legislation on expert witnessing. A report that cannot carry both at once will not survive in court.

That is why DSET's tagline is clear: Trust in evidence is trust in justice. The moment the technical integrity of evidence is broken, the entire legal argument built upon it collapses.

In Which Cases Is Digital Forensics Needed?

A digital forensics request looks like a very narrow field, but in reality it is very broad.

  • Criminal cases: Bank fraud, unauthorized access to information systems, espionage, child abuse material, money laundering, terrorist-organization communications
  • Employment law: Dismissal for just cause, leaking of customer lists, defection to a competitor, disclosure of trade secrets
  • Divorce and family law: Evidence of breaches of the duty of fidelity (by methods the court accepts)
  • Trade secrets and intellectual property: Source-code theft, patent infringement, NDA substantiation
  • Corporate internal investigations: Insider threat, misconduct, corruption
  • KVKK breach investigations: The scope, source and number of affected individuals in a data leak
  • Post-cyberattack forensic analysis: Ransomware, APT traces, identifying the initial entry vector
  • Contract disputes: The authenticity of email correspondence, the validity of digital signatures

Each has a different legal basis, but the technical methodology is the same: ISO/IEC 27037.

What Does ISO/IEC 27037 Say?

The ISO/IEC 27037 standard divides the life cycle of digital evidence into four stages. This standard is the framework that courts in the world and in Türkiye take as a reference when asking "what is the correct method."

1. Identification: Recording every digital asset at the scene. Not just the computer on the desk; the NAS in the server room, the USB stick on the employee's desk, the IP camera on the ceiling, the router on the network, smartwatches, and beyond that, cloud accounts. Incomplete identification cripples every subsequent stage.

2. Collection: Physically taking custody of the devices. Sealing, labeling, photographing, a record with GPS coordinates. If the device is on, the decision to power it off depends on the case; if the RAM contents are needed, a live image is taken without shutting the device down.

3. Acquisition: The process of making a bit-by-bit copy. A write blocker is mandatory, hash verification is mandatory, and the E01 or AFF format is preferred. After the image is taken, the original device is sealed again and the record is updated.

4. Preservation: Keeping both the original device and the image in a secure environment. Access logs, a temperature- and humidity-controlled cabinet, duplicate copies (primary plus backup), periodic hash verification.

ISO/IEC 27042, in turn, addresses the analysis and interpretation stage. 27037 collects the evidence, 27042 interprets it. The two are used together. NIST SP 800-86 provides a technical implementation guide, in particular a practical guide on where to draw the line between incident response and digital forensics.

Chain of Custody

This is the heart of the entire process. If the chain of custody is broken, the remaining technical excellence is meaningless.

The chain of custody must prove this: from the moment the device was seized to the moment it is presented in court, in whose hands it was every second, who performed which operation, who took it over at the intermediate stages, where it was stored, who opened it and who closed it. If there is even one empty hour, opposing counsel can use that gap to have the evidence rejected.

The fields that must appear in chain records:

  • The device's identifying information (make, model, serial number, IMEI/MAC)
  • Hash values (at intake, during transport, before analysis, after analysis)
  • The full name and title of the personnel performing the operation
  • Date, time, location (coordinates where possible)
  • Type of operation (intake, sealing, imaging, analysis, reporting)
  • Signature (wet-ink or electronic signature, with a digital signature preferred)
  • Seal status (intact, broken, renewed)

Tamper-evident seals are labels that show clearly once they have been broken. If opened and closed again, the word "VOID" appears, leaving an irreversible trace. The numbers of these seals are entered into the record and photographed.

SWGDE (Scientific Working Group on Digital Evidence) defines the minimum documentation set for the chain of custody in the guidelines it publishes, and DSET's internal procedure is compliant with that set.

Imaging Techniques

Why Is a Write Blocker Mandatory?

If you connect a disk to an ordinary computer, the operating system automatically writes to it. Access timestamps are updated, last-connection records change, data is written to the swap file. In other words, even if you connect the disk merely "to read" it, you have changed something. This change is small, but legally it is enough to taint the evidence.

A write blocker is hardware that sits between the disk and the computer and physically blocks all write commands. Tableau (Guidance Software) and WiebeTech are the industry-standard brands in this field. Software-based write blockers (for example, the USB Write Protection registry key) do not provide sufficient assurance and are questioned in court.

Image Formats

DD (raw): A raw image taken with Linux's dd command. Fast and universal, but it contains no metadata. The hash must be kept separately.

E01 (EnCase Evidence File): Embeds the hash and file information inside it, supports compression, and can be split into segments. It is the most commonly seen format in most courts, including in Türkiye.

AFF (Advanced Forensic Format): An open standard, works with free tools, and is scalable.

Considering the longevity of a court file, DSET produces an E01 + DD pair together. E01 is the compressed form, while DD is archived as a lossless backup.

Live Forensics vs Dead-Box Forensics

Live forensics: Analysis performed while the device is running. A RAM dump is taken (the Volatility framework), open network connections are recorded (netstat), running processes are listed (ps, tasklist), and the registry is read live. It is critical in encrypted-disk or active-BitLocker environments, because once you shut down, the key is gone.

Static forensics: The device has been shut down and unplugged. The disk is imaged through a write blocker and then analyzed in the laboratory. The classic method, the safest route.

Which route is chosen depends on the case. In a ransomware attack live analysis is essential, while in a search for child abuse material it is often sufficient to simply power off and image.

Mobile Devices: Cellebrite UFED and Magnet AXIOM

Mobile device forensics is far harder than desktop forensics. There are three basic extraction levels:

  • Logical extraction: The data the operating system exposes (contacts, messages, images)
  • File System extraction: Full access at the file-system level (including deleted files)
  • Physical extraction: A bit-by-bit copy at the NAND memory level

Cellebrite UFED and Magnet AXIOM are the industry standards. On iOS, the extraction level achievable without a jailbreak depends on the device model and the iOS version. On Android, if USB Debugging is enabled, File System extraction is often possible; if not, the device may require a bootloader unlock, which itself carries the risk of tainting the evidence.

Hamza Aytaç Doğanay's master's thesis in Digital Forensics at Ankara University is on the current challenges encountered in mobile device forensics and the chain of custody. The thesis addresses the practical problems that modern iOS/Android security architecture (Secure Enclave, TrustZone) creates in digital forensics and how the chain of custody must be preserved on mobile. DSET's field knowledge in mobile device cases is a direct extension of this thesis.

How Is a Report the Court Accepts Written?

A digital forensics report must prove not the author's technical knowledge but the correctness of the process. While reading the report, the judge must be able to ask on their own: are these methods an accepted standard, are they verifiable, could another expert reach the same conclusion from the same data?

The indispensable sections of a digital forensics report presented to the court:

  1. Header and file details: Which court, which file number, on behalf of which party
  2. Appointment or request: Court-appointed expert or party expert opinion, based on which decision/petition
  3. Scope of the assignment: The judge's question or the technical opinion the attorney requested, word for word
  4. Methodology: References to ISO/IEC 27037 and NIST SP 800-86, the list of hardware/software used and their versions
  5. Chain-of-custody records: All records from the moment the device was received to the report (as an annex)
  6. Findings: Objective technical determinations, kept separate from interpretation
  7. Interpretation and conclusion: The technical assessment the assignment requires, containing no legal interpretation
  8. Annexes: Hash list, screenshots, log dumps, photographs
  9. Date, signature, oath text (in a court-appointed expert report)

Making a legal interpretation in the report is the most common mistake. A digital forensics expert cannot decide whether the accused is guilty, they only make technical determinations. The legal conclusion is drawn by the judge.

CMK 67-73 Party Expert Opinion

The Code of Criminal Procedure, Articles 67 to 73, governs the institution known as the "party expert opinion" (uzman mütalaası). This is the technical opinion obtained by the attorney of the accused or the complainant.

Suppose that in a criminal case the prosecution submitted a digital forensics report to the court as evidence, but the defense questions the methodology of that report. The attorney can have their own expert write an opinion under CMK 67. This opinion is submitted to the court, enters the file, and is evaluated with weight equivalent to a court-appointed expert report.

The advantage of the party opinion: the attorney chooses the expert they want and does not remain dependent on the court-appointed expert. The disadvantage: the claim to impartiality may not be as strong as that of the court-appointed expert, and the court evaluates it in that light.

DSET both performs court-appointed expert work on the assignment of the prosecution or court and writes party expert opinions at an attorney's request. The same methodology is applied in both; the only difference is who made the request.

Court-Appointed Expert vs Party Expert Opinion

The two institutions are often confused, yet their differences are decisive.

Criterion Court-appointed expert (bilirkişi) Party expert opinion (uzman mütalaası)
Appointed by The court or the prosecution The attorney / party
Legal basis HMK 266-287, CMK 62-66 CMK 67-73
Fee Court treasury (deposited by the party) Paid directly by the attorney / party
Impartiality Accountable to the court Accountable to the requester, objective toward the court
Oath Yes No (an ethical obligation exists)
Time limit The period the court grants Agreed with the attorney
List registration Department of Expert Witnessing list No list requirement, competence is required

Both are evidence, and both are subject to the court's discretion. If the party opinion and the court-appointed expert report conflict, the judge must give reasons for which one they prefer and why.

KVKK Breach Investigation

Law No. 6698 on the Protection of Personal Data imposes an obligation on the data controller to notify the KVKK within 72 hours when a data breach occurs. This 72 hours starts from the moment the breach is discovered.

Digital forensics comes into play at this point. Within the 72-hour window, answers must be produced to these questions:

  • From which system was data leaked?
  • Between which dates did access occur?
  • Which data categories were affected (are they special-category data?)
  • How many records were affected?
  • Is the attacker still in the system?
  • What was the initial entry vector (phishing, an open port, insider threat)?

Correct answers to these questions can be produced only with digital forensics methodology. Logs alone are not enough; the live state of the system, the RAM contents, network traffic and a backup comparison are evaluated together.

The same report has a second life: it is submitted as an annex to the notification made to the KVKK Authority, and is later used as evidence in a possible administrative fine or in a data-subject compensation lawsuit. So it must not be a record hastily written in 72 hours, but a report that can stand up legally.

E-Evidence Sustainability

A digital forensics case is never closed, only its current lawsuit ends. The same evidence can go to appeal or to the Court of Cassation 5 years later, can serve as a reference in a parallel case, and can be used in the data subject's compensation lawsuit.

That is why the long-term preservation of evidence is a science. Practical requirements:

  • 5+ years of retention: At least as long as the HMK and CMK statute-of-limitations periods
  • Periodic hash verification: A SHA-256 check at least once a year, with a log kept
  • Format migration: The risk of an old format becoming unreadable (E01 v1 to v2), with migration done in advance
  • Encryption at rest: The stored image is kept on an encrypted disk, with the key stored separately
  • Duplicate copies: A primary archive plus an offsite backup, with a hash comparison between the two
  • Access log: Who accessed the evidence, when, and for what purpose

For data held in cloud services the situation is more complex. Systems such as AWS CloudTrail, GCP Audit Logs and the Microsoft 365 Unified Audit Log produce logs of their own, and if these logs are pulled in proper form, they carry evidentiary value. The service provider's log-retention periods (generally 90 days, 1 year or more on paid plans) matter; in a case where you are late, the data may already have been deleted.

Can WhatsApp and Social Media Be Evidence?

Yes, but how it is obtained is decisive. A common mistake: the attorney submitting a WhatsApp screenshot to the court. It is unclear who took the screenshot, on which date, and from which device; whether it was manipulated cannot be proven; and if the other side says "this is a photomontage," it cannot be defended.

Real evidence is data obtained directly from the device through extraction. On Android the WhatsApp database is in the msgstore.db.crypt12 (or crypt14) format, is encrypted, and its key is held in the file /data/data/com.whatsapp/files/key. When these two files are extracted together, the messages are decrypted with WhatsApp Viewer or Magnet AXIOM.

On iOS, WhatsApp uses an iCloud backup, and the backup's password is tied to the Apple ID password. The backup can be obtained from Apple through a legal process, after which password cracking may be required.

For social media (Instagram, Facebook, Twitter) there are two routes: extracting data from the application cache on the device, or sending a legal request to the platform. The second goes through MLAT (Mutual Legal Assistance Treaty) processes and can take months. The first yields results within days.

FAQ

How long does a digital forensics report take?

It depends on the size of the case. For a single phone or laptop, 1 to 2 weeks is a typical timeframe. In a corporate investigation (5 to 10 devices, a server, and log analysis together), 4 to 8 weeks is normal. Cases requiring password cracking or coordination with a cloud service provider can take longer.

Can a court reject a digital forensics report?

Yes. The most common grounds for rejection: a broken chain of custody, failure to use a write blocker, a lack of hash verification, methodology contrary to known standards (ISO 27037, NIST 800-86), the report exceeding the limits of objectivity to make a legal interpretation, and the expert's competence being questioned. If any one of these is present, the report that entered the file ceases to be evidence.

How does digital forensics help my corporate investigation?

It produces concrete documentation for the dismissal of an employment contract for just cause. When a trade secret is leaked, it can be documented which file was accessed, when, and from which device. In a social-engineering attack, it identifies where the initial entry came from. In insider-threat cases, the operations in which the employee exceeded their authorization are documented. All of this is used in both the legal process and in KVKK / insurance processes.

Is it the same thing as a court-appointed expert?

No. A court-appointed expert (bilirkişi) is appointed by the court and selected from among people registered on the Department of Expert Witnessing list. A party expert opinion (uzman mütalaası), on the other hand, is obtained by the attorney or party under CMK 67-73. Both are evidence, and both are submitted for the court's evaluation. Often the same expert can take on both roles in different files.

Can data be extracted from an encrypted device?

Yes in the majority of cases, no in a small portion. For BitLocker, the recovery key can be pulled from Active Directory or from the user's Microsoft account. For FileVault, the iCloud keychain or a corporate MDM key works. For an Android pattern lock, brute force (depending on the device model) is often possible. On an iPhone, if the Apple ID password is unknown and the Secure Enclave is active, it can be very hard depending on the model. Although the mobile ecosystem becomes more closed every year, forensics tool makers keep developing new extraction methods.

What role does it play in a KVKK investigation?

It determines the scope of the breach: which system, which date range, which data categories, how many data subjects. It produces an inventory of the leaked data. It performs a source analysis (insider or external attack, which vector). It prepares the technical content needed for the 72-hour notification. It is then used as evidence in the KVKK Authority's investigation and in possible administrative-fine processes.

Can data held in the cloud be evidence?

Yes. There are two routes. The first route is pulling data from the cloud-account session on the user's device (the Google Drive client, the OneDrive synchronized folder). The second route is requesting data directly from the service provider by court order. Google, Microsoft, Apple and Meta have legal-request portals (Lumen, transparency reports). To pull data from foreign providers, work is done within the framework of the MLAT or the CLOUD Act, and the process can take months. Service logs such as AWS CloudTrail / GCP Audit Logs are accessible more quickly, because they are often within the customer's (the corporate account holder's) own tenant.

What is the difference between digital forensics and cyber incident response (IR)?

Cyber incident response is carried out to stop the attack and bring the system back up. It is fast and practical, sometimes continuing the operation at the cost of tainting the evidence. Digital forensics analyzes the same incident while preserving its evidence, producing a report usable for the legal process. In the ideal case the two run in parallel: while the IR team cleans up the system, the digital forensics team takes uncorrupted images and performs a separate analysis. NIST SP 800-86 clearly explains where these two disciplines diverge.

Working with DSET

DSET runs digital forensics as a laboratory discipline. At the head of the team is Hamza Aytaç Doğanay, who served as a digital forensics expert for 6 years in the Cybercrime Department of the General Directorate of Security. He is a graduate of the thesis-based master's program in Digital Forensics at Ankara University, with a master's thesis on the current challenges encountered in mobile device forensics and the chain of custody.

In the cases undertaken, an ISO/IEC 27037-compliant methodology is applied, a write blocker is mandatory, SHA-256 hash verification is recorded at every stage, tamper-evident seals are used, and reports are written so as to stand up both technically and legally. Both court-appointed expert work and CMK 67-73 party expert opinions at an attorney's request are provided.

The work is carried out from the office at Hacettepe Teknokent, Beytepe, Çankaya, Ankara. The first consultation is free, an NDA is signed, and a case-specific quote is then prepared.

Trust in evidence is trust in justice.

  • Phone: +90 536 662 38 09
  • Email: [email protected]
  • Address: Hacettepe Teknokent, Beytepe, Çankaya, Ankara

DSET, since 2003, Ankara Hacettepe Teknokent Beytepe; +90 536 662 38 09

Sources: