ISO 21043: The Forensic Sciences Standard and Digital Evidence

ISO 21043 is a series of international standards for forensic science developed by ISO/TC 272 Forensic sciences. It sets requirements and recommendations for the forensic process applied to items of potential forensic value, covering vocabulary, the handling of items, analysis, interpretation and reporting, from a scene to a courtroom.

What ISO 21043 covers

ISO 21043 covers the forensic process as a whole, not one activity inside it. It applies to any item of potential forensic value and to everyone who handles one, from the responder who recognizes a trace at a scene to the expert who defends a conclusion in court.

ISO 21043 refers to a series of international standards for forensic science developed by ISO Technical Committee 272 Forensic sciences. Unlike laboratory standards that address competence in a general analytical environment, it governs the forensic process itself, from the moment an item of potential forensic value is recognized at a scene to the moment an opinion is presented in a courtroom. According to NIST, the series provides guidance and requirements for the entire forensic science process and does not replace current accreditation standards such as ISO/IEC 17025 and ISO/IEC 17020. It has five parts: vocabulary, the recognition, recording, collecting, transport and storage of items, analysis, interpretation, and reporting. Part 2 was published in 2018, Part 1 was revised in 2025, and Parts 3, 4 and 5 were published in 2025, completing the series. Adoption is voluntary.

If you work with digital material, check how preservation standards compare before you decide where the forensic sciences standard fits.

The structure of the series

The ISO 21043 series is organized in five parts, one for each stage of the forensic process. Part 1 fixes the vocabulary, Part 2 governs how items are handled before examination, and Parts 3, 4 and 5 cover analysis, interpretation and reporting. Only Part 2 still carries a 2018 date.

Part 1: Vocabulary and definitions

ISO 21043-1:2025 defines the terms the other four parts are built around, starting with the item of potential forensic value. It replaced the 2018 first edition, now withdrawn. The vocabulary is what makes the rest auditable: a requirement about transporting an item means nothing until "item" has one definition.

Part 2: Recognition, recording, collecting, transport and storage

ISO 21043-2:2018 governs everything that happens before an item reaches examination. It is the only part still on its first edition, and it draws the line with digital work, because it excludes the recovery of data from digital storage media and readers.

Part 3: Analysis

ISO 21043-3:2025 applies once the item is with a forensic unit. It covers examination and testing: selection and validation of methods, control of contamination, competence of personnel, and the records behind each result.

Part 4: Interpretation

ISO 21043-4:2025 addresses the step where findings become an opinion. It separates investigative work, which generates hypotheses, from evaluative work, which weighs findings against competing propositions, and asks the expert to state the framework used.

Part 5: Reporting

ISO 21043-5:2025 covers how an opinion leaves the laboratory: what a report contains, how limitations are expressed, and how findings are given as testimony. For anyone working on the admissibility of digital evidence, this is where the process meets the court.

Why ISO 21043 is not written ISO/IEC 21043

The designation carries no IEC prefix because the series comes from ISO alone. ISO/TC 272 Forensic sciences is an ISO technical committee, and nothing in the forensic process falls under the joint information technology work that ISO and the IEC run together.

ISO 21043 is the correct designation. The difference is structural, not a matter of house style: ISO/TC 272 Forensic sciences is a technical committee of ISO alone, so its documents carry the ISO prefix only. The ISO/IEC prefix marks standards produced with the International Electrotechnical Commission, either through the joint technical committee on information technology, which is where ISO/IEC 27037 originates, or through joint work on conformity assessment, as with ISO/IEC 17025 and ISO/IEC 17020. Because the forensic sciences standard addresses the forensic process and not information technology, no IEC involvement applies. The incorrect form still circulates in peer-reviewed literature: an IEEE paper published in 2024, document 10701603, uses it in the title, and search engines serve a separate result set for the variant instead of correcting it. The ISO catalogue lists the series without an IEC prefix.

Where ISO 21043 stops and ISO/IEC 27037 begins

ISO 21043 stops where data has to be recovered from a device. Part 2 excludes the recovery of data from digital storage media and readers and directs that work to ISO/IEC 27037, which covers the identification, collection, acquisition and preservation of potential digital evidence.

Unlike ISO/IEC 27037, which governs digital evidence specifically, ISO 21043 governs the forensic process applied to items of any nature. The standard draws that boundary itself, so it is not left to interpretation. As A2LA notes, Part 2 does not apply to the recovery of data from digital storage media and readers, which are directed to ISO/IEC 27037. The consequence is a sequence, not a choice. When an item is a physical object that happens to carry data, such as a phone seized at a scene, ISO 21043-2 governs how it is recognized, recorded, collected, transported and stored, while ISO/IEC 27037 governs how the data is identified, collected, acquired and preserved. When the item is born digital, a web page or a message, the acquisition sits under ISO/IEC 27037 and the surrounding process discipline draws on the forensic sciences standard.

What Part 2 requires for continuity of items

Part 2 requires that every item can be traced from the moment it is recognized to the moment it is examined. Recognition, recording, collecting, transport and storage each carry documentation duties, and together they amount to the continuity that a digital chain of custody provides for data.

ISO 21043-2 specifies requirements for the stages that precede analysis: recognition, recording, collecting, transport and storage of items of potential forensic value. The objective is continuity. Each item has to be traceable from the point of recognition to the point of examination, with every transfer and every change of condition documented and attributable to a named person. The 2018 edition puts these as requirements, not recommendations. An organization that folds the part into its quality management system has to demonstrate them, not just describe them. The logic transfers to born-digital material with one difference: there is no physical object to bag and seal, so continuity has to be created at the moment of acquisition instead of preserved after it. What exists later is a file, and a file carries no memory of how it came into being.

Where an organization needs the acquisition itself to be documented rather than the file to be verified afterwards, TrueScreen provides a certified capture environment that records the technical context of the acquisition. That is the question underneath forensic-grade data certification.

What the 2025 parts changed

The 2025 publications completed the series and pushed it past the handling of items. Parts 3, 4 and 5 added requirements for analysis, interpretation and reporting, and Part 1 was revised the same year, so four parts now carry a 2025 date.

Part 3 keeps the boundary drawn by Part 2 intact: the published European version, EN ISO 21043-3:2025, excludes digital data recovery from its scope. Part 4 matters more in practice, because it formalizes the difference between investigative and evaluative interpretation, along with the use of propositions to frame an opinion. Berger and colleagues, writing in 2025, describe the completed series as the first genuinely worldwide forensic standard. Part 5 governs how that opinion is written and delivered.

How organizations adopt ISO 21043 without being accredited to it

You cannot be accredited to ISO 21043. Organizations adopt it by writing its requirements into a quality management system already accredited to ISO/IEC 17025 for laboratories or ISO/IEC 17020 for inspection bodies.

According to A2LA, the parts "were developed not to replace ISO/IEC 17025 and ISO/IEC 17020, but to be used in conjunction with them", and forensic service providers "cannot be accredited to them as stand-alone standards but can incorporate them into their quality management system". NIST takes the same position: the series does not replace current accreditation standards and its use is voluntary. What this leaves is a gap analysis, not a certification project. An organization maps its procedures against the requirements in each part, finds the points where the forensic process standard asks for something its accreditation scheme never did, and updates procedures, records and training. An assessment body can then look at those procedures during an ISO/IEC 17025 or ISO/IEC 17020 assessment. The certificate on the wall will still not carry the number 21043.

What this means for organizations that produce digital evidence

Organizations use TrueScreen, the Data Authenticity Platform, to apply a forensic methodology at the moment content is captured, so that continuity does not depend on reconstructing it later.

The gap that Part 2 exposes for born-digital material is one of timing, not of principle. TrueScreen is a Data Authenticity Platform that seals photos, videos, audio, documents, screenshots, emails and web pages with a cryptographic hash and a qualified timestamp at the moment of acquisition. The seal is issued through third-party qualified trust service providers integrated via API. Web content is acquired through a forensic browser that records the technical conditions of the session, while files, emails and documents are handled through the platform.

Think of an inspector documenting a construction site with a smartphone. There is nothing to bag and seal. The photograph is born as data, so the continuity Part 2 demands has to be built into the capture itself: hash, timestamp and a record of the acquisition context.

Sources

• NIST, ISO 21043 Standards
• A2LA, Bridging the Gap: How ISO 21043 Elevates Forensic Lab Quality and Credibility, Rachel Duke, February 2026
• Berger et al., Finally a really forensic worldwide standard: ISO 21043, 2025
• Morrison et al., A guide to ISO 21043 Forensic sciences, Science & Justice, 2025
• iTeh Standards, EN ISO 21043-3:2025
• ISO 21043-1:2025, Forensic sciences, Part 1: Vocabulary, ISO catalogue
• ISO 21043-2:2018, Forensic sciences, Part 2: Recognition, recording, collecting, transport and storage of items, ISO catalogue
• ISO 21043-3:2025, Forensic sciences, Part 3: Analysis, ISO catalogue
• ISO 21043-4:2025, Forensic sciences, Part 4: Interpretation, ISO catalogue
• ISO 21043-5:2025, Forensic sciences, Part 5: Reporting, ISO catalogue