EVIDENCE FIRSTDIGITAL EVIDENCE FIELD GUIDES
Menu

Digital Evidence Field Guides

EVIDENCE
FIRST

Operational decisions.
Defensible actions.

Field guides built around observable state, realistic options, evidence consequences, and documented decisions.

Start from a situationExplore the guides
A reversible action buys options.An irreversible action spends them.

The method

Start from the state you actually have.

Evidence First organizes first-response decisions around what can be observed before intervention, then compares gain, loss, footprint, risk and reversibility before a choice is made and documented.

01SCOPE
02OBSERVE
03OPTIONS
04GAIN
05LOSS
06FOOTPRINT
07RISK
08REVERSIBILITY
09DECIDE
10DOCUMENT

Series

Six domains. One decision grammar.

02

MOBILE DEVICES

Mobile First Response & Forensic Acquisition

Planned
03

NETWORK & REMOTE INFRASTRUCTURE

Network First Response & Evidence Collection

Planned
04

CLOUD & SaaS

Cloud First Response & Evidence Collection

Planned
05

EMBEDDED & IoT DEVICES

Device First Response & Forensic Acquisition

Planned
06

COMPLEX SCENES

Cross-Domain First Response & Evidence Coordination

Planned

Field companion

The book stays stable. The companion stays current.

State Navigator

Route from observable state to the relevant Evidence First decision without requiring case data.

Open shell →

Card Registry

Browse the canonical card inventory and permanent companion identifiers generated from the repository catalog.

Browse cards →

Updates

Edition status, errata and decision-relevant maintenance will live here when the first edition is published.

View update policy →