Certified ISO27050 Practitioner course

1. Identification: ESI that is potentially relevant to a case is identified, along with its locations, custodians, sizes/volumes etc.  preserved
2. Preservation: the identified, potentially relevant ESI is placed under a legal hold, starting the formalized forensic process designed to ensure, beyond doubt, that they are protected through the remaining steps against threats.
3. Collection: the ESI is collected from the original custodian, typically by physically removing the original digital storage media (hard drives, memory sticks and cards, CDs, DVDs, whatever).
4. Processing: forensic bit-copies are stored in a form that allows them to be searched or analysed for information that is relevant to the case, using suitable forensic tools and platforms. 
5. Review: forensic bit-copies are searched or analysed for information that is relevant to the case.
6. Analysis: the information is further analysed and assessed as to its relevance, suitability, weight, meaning, implications etc. Useful information is gleaned from the selected data.
7. Production: relevant information from the analysis, plus the original storage media etc., is formally presented to the court as evidence.

ISO/IEC 27050-1:2019 — Part 1: Overview and concepts

ISO/IEC 27050-2:2018 — Part 2: Guidance for governance and management of electronic discovery

ISO/IEC 27050-3:2020 —Part 3: Code of practice for electronic discovery

ISO/IEC 27050-4:2021 — Part 4: Technical readiness