ISO/IEC 27037:2012
Clause 7: Instances by device type – ISO/IEC 27037:2012

ISO/IEC 27037:2012 7.2.2.3: 7.2.2.3 Guidelines for networked device acquisition

A device may sit on more than one physical or virtual network (one visible link may hide a VPN and a virtual machine with extra addresses), so before disconnecting it the DEFR acquires the data about its logical network connections, including at least IP configuration and routing tables. A device that must stay powered is kept from talking to wireless networks, GPS included, by methods local law allows, with enough power supplied because isolation can make it search harder for a signal. Methods include: jamming (which may be unlawful in some places and may affect equipment such as medical devices); a shielded work area, fixed or a portable Faraday tent, noting that cables fed in can act as aerials and the space can be cramped; a shielded room or container (Faraday cage) to block network connections; a substitute (U)SIM that imitates the original identity and blocks network access, validated for the device and network first; and having the carrier disable services, which needs identifiers and may cause delay. Every blocking method is validated for the relevant frequencies, including cables passing through shielding. The DEFR may acquire a mobile live before taking out its battery (to reach the SIM, for instance) to avoid losing RAM contents or to save time where a PIN or PUK would take long to obtain, always within local law.

Maintained by Gerard Blokdyk

What else in your programme already covers this

This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 27043:2015 · 1 control

  • 9.4 9.4 Potential digital evidence acquisition process

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Clause 7: Instances by device type – ISO/IEC 27037:2012

Query this from an agent

The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.