Card Registry — Evidence First

During book production, DONE / DRAFT / PLANNED are editorial drafting states. They are deliberately not presented as the post-publication CURRENT / NOTE / REVISED / SUPERSEDED maintenance states.

A · Initial State & Scene

EF-COMP-A01P½Computer Found On/OffDONE EF-COMP-A02D1Multiple Live DevicesDONE EF-COMP-A03D1Locked vs Unlocked Session / Active vs UnattendedDONE EF-COMP-A06P½Initial Scene DocumentationDONE EF-COMP-A09D1Mounted External Storage DetectedDONE EF-COMP-A10D1Encryption State UnknownDONE EF-COMP-A11P1Physically Damaged DeviceDONE

B · Live Computers

EF-COMP-B01D2BitLocker Active, UnlockedDONE EF-COMP-B03D1Session LockedDONE EF-COMP-B04D2Active Ransomware EncryptionDONE EF-COMP-B06P1Minimum Windows Live-State CaptureDONE EF-COMP-PRODSERVERD2Live Production Server — Suspected CompromiseDONE EF-COMP-B10D1Sleep/Hibernate TransitionDONE EF-COMP-B15P1Minimum Linux Live-State CaptureDONE EF-COMP-B18D2FileVault Active, AccessibleDONE EF-COMP-B21P1Minimum macOS Live-State CaptureDONE EF-COMP-B23D2Live System Becoming UnstableDONE EF-COMP-B24D1Unfamiliar Desktop OSDONE

C · Volatile Evidence & Encryption

EF-COMP-C01D2Acquire RAM Now/Later/NotDONE EF-COMP-C04P1Memory Acquisition FailureDONE EF-COMP-C06D2Suspected Memory-Resident MalwareDONE EF-COMP-C07P½Preserve Pagefile/Swap/HibernationDONE EF-COMP-C10P1Encrypted Volume Already LockedDONE EF-COMP-C11D2Mounted Encrypted Volume — Currently AccessibleDONE

D · Storage & Forensic Acquisition

EF-COMP-D01P½Powered-Off HDD AcquisitionDONE EF-COMP-D03P1Powered-Off SSD (SATA/NVMe)DONE EF-COMP-D05P½SD/microSDDONE EF-COMP-D06P½Identify and Record Source MediaDONE EF-COMP-D09D1Physical vs Logical AcquisitionDONE EF-COMP-D10D1Full vs Targeted AcquisitionDONE EF-COMP-D13D2Self-Encrypting Drive / LockedDONE EF-COMP-D14D2Failing / Unstable DriveDONE EF-COMP-D15D2RAID / Multi-Disk SetDONE EF-COMP-D16P1Soldered / Non-Removable StorageDONE EF-COMP-D17P½Prepare Destination MediaDONE EF-COMP-D18P½Verify Acquisition and HashesDONE EF-COMP-D19P1Imaging Failure / Read ErrorsDONE EF-COMP-D20P½Create / Preserve Working CopyDONE

E · Network, Remote State & Virtualization

EF-COMP-E01D2Disconnect or Preserve SessionDONE EF-COMP-E03D1Active Exfiltration — Controlled Observation or ContainDONE EF-COMP-E06D1RDP/SSH Session ActiveDONE EF-COMP-E07D1Mounted Network ShareDONE EF-COMP-E08D1Cloud-Synchronized Local DataDONE EF-COMP-E09P½Capture Traffic Before IsolationDONE EF-COMP-E11D2VM Snapshot vs Guest-Level AcquisitionDONE EF-COMP-E14D2Ephemeral Container / WorkloadDONE EF-COMP-E16D2Hypervisor / Host CompromiseDONE

F · Rapid Triage

EF-COMP-F01D1Triage First or Acquire EverythingDONE EF-COMP-F02P1Windows Quick Triage — System & ExecutionDONE EF-COMP-F03P1Windows Quick Triage — User & Data ActivityDONE EF-COMP-F06P1Linux Process/Auth/Network TriageDONE EF-COMP-F08P1macOS Execution/Persistence TriageDONE EF-COMP-F09D2Suspicious Process — Observe or TerminateDONE EF-COMP-F10P1IOC-Driven Targeted CollectionDONE EF-COMP-F11P½Capture Timeline Seed DataDONE EF-COMP-F13D1Triage Inconclusive — Stop or EscalateDONE

G · Integrity, Documentation & Handoff

EF-COMP-G01P½Original Evidence vs Working CopyDONE EF-COMP-G02P½Hash Source and OutputDONE EF-COMP-G03P½Document the AcquisitionDONE EF-COMP-G07P1Package / Store / TransportDONE