# Standards & References

## Primary Standards

### NIST SP 800-86 - Guide to Integrating Forensic Techniques
- **Publisher**: NIST
- **Scope**: Forensic process for digital evidence collection, examination, and analysis

### ISO/IEC 27037 - Guidelines for Digital Evidence
- **Publisher**: ISO
- **Scope**: Identification, collection, acquisition, and preservation of digital evidence

### RFC 3227 - Guidelines for Evidence Collection and Archiving
- **Publisher**: IETF
- **Scope**: Best practices for evidence collection including order of volatility

## Compliance Mappings

| Framework | Requirement | Forensics Coverage |
|-----------|------------|-------------------|
| NIST 800-53 | IR-4 Incident Handling | Forensic investigation procedures |
| NIST 800-53 | AU-10 Non-repudiation | Evidence integrity via hashing |
| PCI DSS 4.0 | 12.10.5 - Incident response with forensics | Post-incident forensic analysis |
| HIPAA | 164.308(a)(6)(ii) - Response and Reporting | Forensic investigation of breaches |

## Tool References

- **Volatility 3**: https://github.com/volatilityfoundation/volatility3
- **KAPE**: https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape
- **Eric Zimmerman Tools**: https://ericzimmerman.github.io/
- **Autopsy**: https://www.autopsy.com/
- **SANS Windows Forensic Analysis Poster**: https://www.sans.org/posters/
