Evidence First — Digital Evidence Field Guides
Menu

2027 Edition & maintenance

Updates

Edition status, publication availability, errata and decision-relevant maintenance are separated from ordinary editorial corrections.

Edition record. Evidence First — Vol. 1: Computer — 2027 Edition · version 1.0. Publication availability: Preorder available. Technical source verification: 14 August 2026.

CURRENT

No decision-relevant change. Use the maintained edition record and companion material.

NOTE

Additional technical information is available, but the owning decision does not change.

REVISED

Decision-relevant guidance has changed. The affected card or workflow is identified explicitly.

SUPERSEDED

Do not rely on the superseded guidance; use the identified current replacement.

Pre-publication maintenance · 14 August 2026

ISO/SWGDE source audit

The complete Vol. 1 card deck was re-reviewed against the ISO/IEC 27037, 27041, 27042 and 27043 forensic core, SWGDE tool-testing guidance and the maintained computer collection/acquisition source base. The audit found one material first-response ownership gap: whether an in-scope computer or directly attached source should be acquired at the scene or collected for later acquisition in a controlled environment.

D21 added

Acquire On-Scene or Collect for Later Acquisition was added as a D1 freeze exception. D09 still owns acquisition method, D10 owns acquisition scope, and G07 owns transport/handoff mechanics.

Narrow maintenance

D10 now states targeted-collection omission/context and selection-bias risk more explicitly. Method and B24 clarify that assurance is tied to a fit-for-purpose process and tested tool behavior for the intended use.

The ISO/IEC forensic core and SWGDE 18-Q-001-2.1 were added to the maintained References. No other existing card required a substantive change to its principal decision logic.

Edition policy. This is pre-publication maintenance within 2027 Edition · version 1.0, not a new edition.

Maintenance policy

Minor errata and maintenance revisions do not automatically create a new edition. A new edition is warranted when decision logic, workflow, standards, platforms or acquisition possibilities change materially. Source-status and bibliographic maintenance is recorded on the References page.