Digital Forensics Decision Cards

Stable identity, not a copy of the book. Public IDs and companion routes preserve card identity across maintenance while the printed card remains the owning field unit. Read the Evidence First decision method →

Find a card

Search the Vol. 1 inventory.

61 of 61 cards

SearchFamilyType

Vol. 1 · Computer · A · Initial State & Scene

EF-COMP-A01P½Computer Found On/Off EF-COMP-A02D1Multiple Live Devices EF-COMP-A03D1Locked vs Unlocked Session / Active vs Unattended EF-COMP-A06P½Initial Scene Documentation EF-COMP-A09D1Mounted External Storage Detected EF-COMP-A10D1Encryption State Unknown EF-COMP-A11P1Physically Damaged Device

Vol. 1 · Computer · B · Live Computers

EF-COMP-B01D2BitLocker Active, Unlocked EF-COMP-B03D1Session Locked EF-COMP-B04D2Active Ransomware Encryption EF-COMP-B06P1Minimum Windows Live-State Capture EF-COMP-PRODSERVERD2Live Production Server — Suspected Compromise EF-COMP-B10D1Sleep/Hibernate Transition EF-COMP-B15P1Minimum Linux Live-State Capture EF-COMP-B18D2FileVault Active, Accessible EF-COMP-B21P1Minimum macOS Live-State Capture EF-COMP-B23D2Live System Becoming Unstable EF-COMP-B24D1Unfamiliar Desktop OS

Vol. 1 · Computer · C · Volatile Evidence & Encryption

EF-COMP-C01D2Acquire RAM Now/Later/Not EF-COMP-C04P1Memory Acquisition Failure EF-COMP-C06D2Suspected Memory-Resident Malware EF-COMP-C07P½Preserve Pagefile/Swap/Hibernation EF-COMP-C10P1Encrypted Volume Already Locked EF-COMP-C11D2Mounted Encrypted Volume — Currently Accessible

Vol. 1 · Computer · D · Storage & Forensic Acquisition

EF-COMP-D01P½Powered-Off HDD Acquisition EF-COMP-D03P1Powered-Off SSD (SATA/NVMe)EF-COMP-D05P½SD/microSD EF-COMP-D06P½Identify and Record Source Media EF-COMP-D21D1Acquire On-Scene or Collect for Later Acquisition EF-COMP-D09D1Physical vs Logical Acquisition EF-COMP-D10D1Full vs Targeted Acquisition EF-COMP-D13D2Self-Encrypting Drive / Locked EF-COMP-D14D2Failing / Unstable Drive EF-COMP-D15D2RAID / Multi-Disk Set EF-COMP-D16P1Soldered / Non-Removable Storage EF-COMP-D17P½Prepare Destination Media EF-COMP-D18P½Verify Acquisition and Hashes EF-COMP-D19P1Imaging Failure / Read Errors EF-COMP-D20P½Create / Preserve Working Copy

Vol. 1 · Computer · E · Network, Remote State & Virtualization

EF-COMP-E01D2Disconnect or Preserve Session EF-COMP-E03D1Active Exfiltration — Controlled Observation or Contain EF-COMP-E06D1RDP/SSH Session Active EF-COMP-E07D1Mounted Network Share EF-COMP-E08D1Cloud-Synchronized Local Data EF-COMP-E09P½Capture Traffic Before Isolation EF-COMP-E11D2VM Snapshot vs Guest-Level Acquisition EF-COMP-E14D2Ephemeral Container / Workload EF-COMP-E16D2Hypervisor / Host Compromise

Vol. 1 · Computer · F · Rapid Triage

EF-COMP-F01D1Triage First or Acquire Everything EF-COMP-F02P1Windows Quick Triage — System & Execution EF-COMP-F03P1Windows Quick Triage — User & Data Activity EF-COMP-F06P1Linux Process/Auth/Network Triage EF-COMP-F08P1macOS Execution/Persistence Triage EF-COMP-F09D2Suspicious Process — Observe or Terminate EF-COMP-F10P1IOC-Driven Targeted Collection EF-COMP-F11P½Capture Timeline Seed Data EF-COMP-F13D1Triage Inconclusive — Stop or Escalate

Vol. 1 · Computer · G · Integrity, Documentation & Handoff

EF-COMP-G01P½Original Evidence vs Working Copy EF-COMP-G02P½Hash Source and Output EF-COMP-G03P½Document the Acquisition EF-COMP-G07P1Package / Store / Transport

Search the Vol. 1 inventory.

Analytics preferences