Point-of-action
Designed for the moment before an intervention changes the device, the accessible state, or the evidentiary options still available.
Digital Forensics · DFIR · Vol. 1 · 2027 Edition · Preorder available · Releases December 1, 2026
Computer First Response & Forensic Acquisition
A computer forensic acquisition and first-response field guide for evidence-preserving decisions.
Evidence First Vol. 1 is built for the decision before the tool. When a computer is already in front of you, the next action may preserve evidence, preserve access, change state, or spend options that cannot be recovered later. The guide structures that decision from observable state through consequences, reversibility and documentation.
Retail availability: Preorder available. The Kindle edition can be preordered on Amazon. Paperback and hardcover release on December 1, 2026; print purchase links will be added when their Amazon listings are live. The 2027 edition record and companion routes are already stable.
61Core Field Cards
33State Maps
174Pages
A0–A4Field Forms
Why this DFIR field guide exists
The hard problem is the next action.
Vol. 1 owns decisions for general-purpose computers, directly attached storage, and host-local virtual state. It starts from the state that can actually be observed and asks what can be preserved, what may be lost, what footprint an action introduces, what risks follow, and how reversible the choice really is.
It is not an encyclopedic forensic manual, artifact catalog, command cheat sheet, certification syllabus, or tool-specific handbook. Its central question is operational: given the evidence state in front of me, what should be done now, and why?
Field Principle
A reversible action buys options.An irreversible action spends them.What makes it different
A digital forensics field manual built around decisions, not commands.
For DFIR practitioners, forensic examiners and incident responders, the useful question is often not what a tool can do, but which action best preserves evidentiary value in the state that actually exists.
Consequence-first
Alternatives are compared through gain, loss, footprint, risk and reversibility rather than through feature lists or preferred-tool workflows.
Vendor-independent
The decision logic is intended to remain useful as products, interfaces, platforms and acquisition capabilities change.
Inside the guide
State → options → consequences → documented decision.
Cards are compact decision or procedure units. A Decision Card exists only where the observed state produces a material choice with materially different gain, loss, footprint, risk or reversibility. Procedures are used where the principal decision is already determined.
The preview shows the real Situation and decision question from A02, Multiple Live Devices, while keeping the full printed card in the book.
A02 · D1
FIRST RESPONSEMultiple Live Devices
SITUATION
Two or more in-scope general-purpose computers are live at the same scene, but time, personnel, or acquisition capacity prevents treating all of them simultaneously.
Which computer must be handled first to avoid spending the most fragile or least reproducible evidence state?
OBSERVEDestructive activity?Unique unlocked state?Instability or imminent state loss?
OPTIONS & CONSEQUENCESPrioritize fragile stateParallelize with trained operatorsAvoid convenience-first ordering
DECIDEDOCUMENTGAIN · LOSS · FOOTPRINT · RISK · REVERSIBILITY
What is included
A first-response and forensic-acquisition workflow, not a catalog of commands.
State-Entry Index
Enter from observable state rather than from a guessed tool or artifact.
Core Field Cards
D1/D2 decision cards and compact procedures organized around first-response choices.
State Maps
Visual routing that makes decision forks and state-dependent consequences explicit.
Quick Reference
Supporting reference material that does not justify a separate operational decision card.
Field Forms
Scene, acquisition, handoff, decision and continuation records designed to support contemporaneous documentation.
Maintained Companion
Card identity, source status, errata and decision-relevant updates remain available online.
Home domain
Computer owns computer-local state.
General-purpose computers and directly attached storage belong here. Provider-side cloud state routes to Vol. 4; smartphone/tablet state to Vol. 2; network fabric and remotely administered infrastructure to Vol. 3; embedded/proprietary-purpose devices to Vol. 5; cross-domain sequencing to Vol. 6.
Maintained source base
Primary sources stay visible.
The edition is maintained against relevant ISO/IEC forensic standards, SWGDE guidance, NIST publications and primary platform documentation. Draft, archived and historical sources are identified as such rather than presented as current final guidance.
Free companion resources
Use the guide in the field without copying its forms by hand.
Printable A4 and US Letter copies of the canonical Field Forms are available without registration. The public Card Registry preserves stable identifiers for the 2027 edition.