01Principles
Lawful authority first
Collection and examination rest on a specific authority: a court decision, a prosecutor's instruction, or the informed consent of the data holder. The authority defines the scope; work stays within it.
Integrity and the unbroken chain
Evidence is hashed at acquisition and every transfer is recorded, so that the item examined is provably the item seized and nothing changed in between.
Reproducibility
Methods, tools and versions are recorded so that a second examiner with the same evidence would reach the same result. A finding that cannot be reproduced is not stated as a finding.
Proportionality and data protection
Examination is limited to what the authority covers. Personal data encountered outside the scope is not exploited; relevance and necessity bound what is read and reported.
Impartiality of the expert
The examiner serves the court, not a party. Findings and their limits are reported the same way whoever requested the work.
02Turkish law
6754Expert Witness Authority Law (Bilirkişilik Kanunu)
Governs who may serve as a court-appointed expert, the register, duties, impartiality and the standards expected of expert reports.
CMKCode of Criminal Procedure (Ceza Muhakemesi Kanunu, 5271)
Frames evidence in criminal proceedings, including the appointment and duties of experts and the examination of seized items. The specific articles that apply are set by the court or prosecutor in each case.
HMKCode of Civil Procedure (Hukuk Muhakemeleri Kanunu, 6100)
Frames evidence and expert examination in civil proceedings, including how expert reports are commissioned, objected to and weighed.
6698Personal Data Protection Law (KVKK)
Sets the rules for processing personal data. Relevant whenever an examination touches personal data; bounds what may be read, retained and reported, and for how long.
5651Regulation of Internet Publications Law (5651)
Governs internet publications and the retention of certain traffic and access records by providers; relevant when an examination relies on provider-held logs.
03International standards
ISO/IECISO/IEC 27037 — Identification, collection, acquisition and preservation of digital evidence
The baseline for first response and acquisition: how to identify, collect, acquire and preserve digital evidence without changing it.
ISO/IECISO/IEC 27041 — Assurance for digital evidence investigation methods
How to show that the methods used are suitable and were validated for the purpose.
ISO/IECISO/IEC 27042 — Analysis and interpretation of digital evidence
How to analyse and interpret evidence, and how to express the strength and limits of an interpretation.
ISO/IECISO/IEC 27043 — Incident investigation principles and processes
The overall process model for an investigation, from readiness to presentation of results.
ISO/IECISO/IEC 17025 — General requirements for the competence of testing and calibration laboratories
The quality-management baseline a forensic laboratory works to: competence, validated methods, equipment control and records.
NISTNIST SP 800-86 — Guide to integrating forensic techniques into incident response
Practical guidance on data collection, examination and analysis across files, operating systems, network traffic and applications.
NISTNIST SP 800-101 Rev. 1 — Guidelines on mobile device forensics
Guidance on the preservation, acquisition, examination and reporting of data on mobile devices.
Council of EuropeBudapest Convention on Cybercrime and its Electronic Evidence Guide
The international treaty framework for cybercrime cooperation and widely used guidance on handling electronic evidence.
SWGDESWGDE — Scientific Working Group on Digital Evidence best-practice documents
Community best-practice papers on acquisition, examination and reporting across many evidence types.
ENFSIENFSI — European Network of Forensic Science Institutes guidelines
European guidelines on forensic IT and the evaluation and reporting of forensic findings.
04Questions a report must answer
- Under what authority was the evidence collected, and does the examination stay within that authority's scope?
- Is the chain of custody complete and unbroken, with hashes recorded at acquisition and verified before examination?
- Were the methods and tools suitable and validated for the purpose, and are their versions recorded?
- Could a second examiner reproduce each finding from the same evidence?
- Was personal data outside the scope protected, and is reporting limited to what is relevant and necessary?
- Does the report separate observation from interpretation, and does it state the limits of each conclusion?
This page is general reference material, not legal advice and not a substitute for the court order, statute or instruction that governs a specific case. Laws change; the primary-source links are authoritative, and the applicable articles are set by the court or prosecutor in each matter.