ISO/IEC 27037:2012
Clause 6: Key components of evidence handling – ISO/IEC 27037:2012

ISO/IEC 27037:2012 6.9.3.1: 6.9.3.1 Baseline activities: packaging of potential digital evidence

The minimum packaging actions, done unless there is good reason not to: handle tapes by their cases and media only by areas known to hold no data (the edges of optical discs, for instance), wearing lint-free gloves, knowing current media types; label all evidence, devices and associated hardware with tamper-evident labels in the format the jurisdiction requires, not on mechanical parts and not hiding identifying details, and acquire and store what devices contain so integrity is kept; seal openings and moving parts with suitable tamper-evident labels signed by the DEFR where possible; check battery-powered devices holding volatile data regularly so they keep power; put each device in a container suited to it and to the threats it faces; pack computers and devices against shock, vibration, high altitude, heat and radio exposure in transit; store magnetic media in magnetically inert, anti-static, particle-free packaging; and, because devices may carry latent, trace or biological evidence, image them only after that evidence is collected, weighing the priority carefully.

Maintained by Gerard Blokdyk

What else in your programme already covers this

This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 27043:2015 · 1 control

  • 11.6 11.6 Preserving digital evidence process

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Clause 6: Key components of evidence handling – ISO/IEC 27037:2012

Query this from an agent

The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.