What it is
A decision-oriented digital forensics and DFIR field-guide system built for the point of evidence handling: observable state, realistic alternatives, gain, loss, footprint, risk, reversibility, decision and documentation.
About
Evidence First
A field decision system for operational choices in digital-evidence first response and forensic acquisition.
What it is not
Not another digital forensics textbook, encyclopedic manual, artifact catalog, command cheat sheet, certification syllabus, or tool-specific handbook.
Why Evidence First
Built for the moment before the evidence changes.
Digital evidence is often encountered in a state that can change as soon as the operator acts. Evidence First is organized around the practical questions that matter at that exact point: what can still be preserved, what may be lost, what footprint an action introduces, what risks follow, how reversible the choice really is, and how the decision should be documented.
Product position
DFIR decision support between theory and tools.
General forensic texts explain domains, concepts and techniques. Tool documentation explains what a product can do. Evidence First occupies the operational gap between them: it structures the decision about what should be done next when the evidentiary state, available options and consequences matter more than any single product feature.
Editorial principles
State-driven
Start from what is observable before intervention rather than from a preferred tool or command.
Decision-focused
Compare realistic alternatives through their evidentiary and operational consequences.
Tool-independent
Keep the decision logic stable even as particular products, platforms and acquisition capabilities change.
Series principle
A reversible action buys options.An irreversible action spends them.
Home Volume Rule
Each decision has one owning volume, determined by the evidence regime directly changed by the action. Other volumes route to that owner instead of copying the same decision logic.
Website role
A maintained companion, not a duplicate of the book.
The web companion preserves card identity, maintained references, update policy and, when editorially ready, state-based navigation. It does not reproduce the printed cards and is designed to remain useful as standards, platforms and decision-relevant information evolve.