BS ISO/IEC 27042:2015提供了数字证据分析和解释指南 以解决连续性、有效性、再现性和可重复性问题的方式。信息技术 封装了分析过程和应用程序的选择、设计和实施的最佳实践 记录足够的信息，以便对此类流程进行独立审查 必要时。它提供了有关证明熟练程度和能力的适当机制的指导 调查小组的能力。数字证据的分析和解释可能是一个复杂的过程。在某些情况下 可以采用多种方法，并且需要调查小组的成员 证明他们对特定流程的选择是合理的，并说明它与所使用的另一个流程是如何等效的 由其他调查人员调查。在其他情况下，调查人员可能需要设计新的方法来进行调查 检查之前没有考虑过的数字证据，并且应该能够证明 产生的方法是“适合目的的”。特定方法的应用可能会影响计算机处理的数字证据的解释 这种方法。可用的数字证据可能会影响进一步分析方法的选择 已经获得的数字证据。本国际标准提供了一个通用的分析和解释框架 信息系统安全事件处理要素，可用于协助 实施新方法，为数字证据提供最低限度的通用标准 从这些活动中产生。交叉引用:ISO/IEC 27000:2013ISO/IEC 27037:2012ISO/IEC 27041ISO/IEC 17024:2003ISO/IEC 17025:2005ISO/IEC 17043:2010ISO/IEC 27004:2009ISO/IEC 27035:2011购买本文件时提供的所有现行修订均包含在购买本文件中。

BS ISO/IEC 27042:2015 provides guidance on the analysis and interpretation of digital evidence in a manner which addresses issues of continuity, validity, reproducibility, and repeatability. It encapsulates best practice for selection, design, and implementation of analytical processes and recording sufficient information to allow such processes to be subjected to independent scrutiny when required. It provides guidance on appropriate mechanisms for demonstrating proficiency and competence of the investigative team.Analysis and interpretation of digital evidence can be a complex process. In some circumstances, there can be several methods which could be applied and members of the investigative team will be required to justify their selection of a particular process and show how it is equivalent to another process used by other investigators. In other circumstances, investigators may have to devise new methods for examining digital evidence which has not previously been considered and should be able to show that the method produced is "fit for purpose".Application of a particular method can influence the interpretation of digital evidence processed by that method. The available digital evidence can influence the selection of methods for further analysis of digital evidence which has already been acquired.This International Standard provides a common framework, for the analytical and interpretational elements of information systems security incident handling, which can be used to assist in the implementation of new methods and provide a minimum common standard for digital evidence produced from such activities.Cross References:ISO/IEC 27000:2013ISO/IEC 27037:2012ISO/IEC 27041ISO/IEC 17024:2003ISO/IEC 17025:2005ISO/IEC 17043:2010ISO/IEC 27004:2009ISO/IEC 27035:2011All current amendments available at time of purchase are included with the purchase of this document.