01
Scope & observed state
Establish the boundaries of the situation, then record the state that exists before intervention.
SCOPEOBSERVE
Method
Evidence First Method
SCOPE → OBSERVE → OPTIONS → GAIN → LOSS → FOOTPRINT → RISK → REVERSIBILITY → DECIDE → DOCUMENT
Field decision logic
Start from the state. Compare consequences before acting.
The method is the core of Evidence First as a field decision system. It is designed for the interval between encountering digital evidence and committing to an action that may change it. It does not begin with a tool or command: it begins by defining scope, observing what is present, identifying realistic options, and comparing their consequences before an action is selected and documented.
Operational view
From observed state to documented decision.
02
Realistic options
Identify the operational alternatives that actually exist in the observed state.
OPTIONS
03
Consequences
Compare what each option can preserve, lose, change, endanger, or make difficult to reconstruct.
GAINLOSSFOOTPRINTRISKREVERSIBILITY
04
Decision
Choose the option that is justified by the state and its evidentiary consequences.
DECIDE
05
Documentation
Preserve the rationale: what was done, what was observed, and why the action was selected.
DOCUMENT
This operational view groups the method for orientation only. The canonical sequence remains the ten-step method shown below.
Canonical sequence
Ten questions before the action is complete.
01
SCOPE
Define the object, limits, authority, and stop/escalation conditions.
02
OBSERVE
Observe and record the state before intervention.
03
OPTIONS
Identify realistic operational alternatives.
04
GAIN
What can be preserved or obtained?
05
LOSS
What can be lost?
06
FOOTPRINT
What modifications will the operator introduce?
07
RISK
What are the evidentiary and operational consequences?
08
REVERSIBILITY
Can the prior evidentiary state realistically be reconstructed?
09
DECIDE
Make a reasoned choice based on the observed state.
10
DOCUMENT
Record what was done and why.
Reversibility
Technical undo is not enough.
REVERSIBILITY asks whether the previous evidentiary state can realistically be reconstructed after an action. A technically reversible operation may still spend evidentiary options if it changes volatile state, timestamps, logs, connectivity, synchronization, or other conditions that cannot later be recreated with confidence.