Vol. 1: Computer
Computer First Response & Forensic Acquisition · 2027 Edition.
61 Decision and Procedure Cards covering computer first response, live systems, volatile evidence, encryption, storage acquisition, triage, integrity and handoff.
Publication series · Digital Forensics · DFIRFlagship Method Principle
Evidence First
Evidence First — Digital Evidence Field Guides is a decision-oriented publication series for the point where an action can preserve evidence, alter system state, introduce footprint or consume options that may not be recoverable later.
State before action
SCOPE → OBSERVE → OPTIONS → GAIN → LOSS → FOOTPRINT → RISK → REVERSIBILITY → DECIDE → DOCUMENT.
Preserve options
A reversible action buys options. An irreversible action spends them.
What problem it addresses
Traditional guidance often explains principles, artifacts or tool capabilities. The field problem is different: a responder faces a concrete evidence state and must decide what to do next before the state changes.
Observable state
Start from what is actually known about power, session state, encryption, connectivity, storage and volatility.
Real alternatives
Compare realistic actions rather than assuming one acquisition path is always preferable.
Consequences
Make gain, loss, footprint, risk and realistic reversibility visible before acting.
Documentation
Record not only what was done, but why the chosen action was reasonable for the state observed.
Series architecture
The canonical series separates local decision regimes while keeping one common grammar.
Core
Vol. 1 Computer · Vol. 2 Mobile Devices · Vol. 3 Network & Remote Infrastructure · Vol. 4 Cloud & SaaS.
Specialist
Vol. 5 Embedded & IoT Devices.
Cross-domain
Vol. 6 Complex Scenes coordinates sequencing and dependencies across domains.
Source distinction: this author-side page establishes project context and authorship. Current-edition status, maintained companion material and official publication information are controlled on evidencefirst.guide.