BSI-Leitfaden IT-Forensik
BSI Guideline on IT Forensics
BSI-Leitfaden IT-Forensik
The Federal Office for Information Security (Germany) (BSI) Guideline on IT Forensics is the authoritative German-language reference for a methodical, court-proof approach to the forensic investigation of IT incidents. It describes a structured process from strategic preparation through data acquisition to analysis and documentation. It thereby provides a reliable framework that secures traceability and evidentiary value.
History & facts. The German Federal Office for Information Security (BSI) published the guideline to put forensic work on a uniform, methodical footing. It distinguishes, among other things, between volatile and non-volatile data, stresses the order of acquisition by volatility and anchors basic principles such as the gapless documentation of the chain of custody. The guideline arranges the forensic process into traceable phases and names methods and data types.
Outlook & recommendation. Under Network and Information Security Directive 2 (NIS2) in particular, with its tight reporting deadlines, the quality of the first hours decides the later usability: acquiring data without structure destroys evidence. The guideline is therefore not an academic document but an operational checklist for the real case. NEOSEC works in digital forensics and incident response (DFIR) along these methodical principles — clean acquisition is the precondition for everything that follows.