BS EN ISO/IEC 27043:2016

Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Symbols and abbreviated terms
5 Digital investigations
6 Digital investigation processes
7 Readiness processes
8 Initialization processes
9 Acquisitive processes
10 Investigative processes
11 Concurrent processes
12 Digital investigation process model schema
Annex A (informative) - Digital investigation
       processes - motivation for harmonization
Bibliography

Describes guidelines based on idealized models for common incident investigation processes across various incident investigation scenarios involving digital evidence.

This International Standard provides guidelines based on idealized models for common incident investigation processes across various incident investigation scenarios involving digital evidence. This includes processes from pre-incident preparation through investigation closure, as well as any general advice and caveats on such processes. The guidelines describe processes and principles applicable to various kinds of investigations, including, but not limited to, unauthorized access, data corruption, system crashes, or corporate breaches of information security, as well as any other digital investigation.

In summary, this International Standard provides a general overview of all incident investigation principles and processes without prescribing particular details within each of the investigation principles and processes covered in this International Standard. Many other relevant International Standards, where referenced in this International Standard, provide more detailed content of specific investigation principles and processes.