ISO/IEC 27043:2015 — Role and application

Abstract

In order for digital evidence from a digital forensic investigation to be admissible, one needs to follow a formalised and ideally standardised process. The authors' previous research and initiative within ISO resulted in a new international standard ISO/IEC 27043:2015, titled “Information technology — Security techniques — Incident investigation principles and processes” as published in March 2015. The standard governs the digital forensic investigation process and covers it from a wide angle, while harmonising existing process models in this field. In this paper, the authors give an analysis of both the standard itself and of related standards so as to enable the reader to understand the ecosystem of standards relating to the digital forensic investigation process and role of ISO/IEC 27043:2015.