Point-of-action
Designed for the moment before an intervention changes the device, the accessible state, or the evidentiary options still available.
Digital Forensics · DFIR · Vol. 1 · 2027 Edition · Preorder available · Releases December 1, 2026
Computer First Response & Forensic Acquisition
Making expert forensic decision-making explicit, structured, and usable in the field.
A computer forensic acquisition and first-response field guide for evidence-preserving decisions.
Evidence First Vol. 1 is built for the decision before the tool. When a computer is already in front of you, the next action may preserve evidence, preserve access, change state, or spend options that cannot be recovered later. The guide structures that decision from observable state through consequences, reversibility and documentation.
Retail availability: Preorder available. The Kindle edition can be preordered on Amazon. Paperback and hardcover release on December 1, 2026; print purchase links will be added when their Amazon listings are live. The 2027 edition record and companion routes are already stable.
61Core Field Cards
33State Maps
174Pages
A0–A4Field Forms
Why this DFIR field guide exists
The hard problem is the next action.
Vol. 1 owns decisions for general-purpose computers, directly attached storage, and host-local virtual state. It starts from the state that can actually be observed and asks what can be preserved, what may be lost, what footprint an action introduces, what risks follow, and how reversible the choice really is.
It is not an encyclopedic forensic manual, artifact catalog, command cheat sheet, certification syllabus, or tool-specific handbook. Its central question is operational: given the evidence state in front of me, what should be done now, and why?
Field Principle
A reversible action buys options.An irreversible action spends them.The Evidence First method
One decision grammar. Ten questions.
The sequence stays stable across the series. What changes is the evidence state and the consequence of the available actions.
01SCOPE
02OBSERVE
03OPTIONS
04GAIN
05LOSS
06FOOTPRINT
07RISK
08REVERSIBILITY
09DECIDE
10DOCUMENT
What makes it different
A digital forensics field manual built around decisions, not commands.
For DFIR practitioners, forensic examiners and incident responders, the useful question is often not what a tool can do, but which action best preserves evidentiary value in the state that actually exists.
Consequence-first
Alternatives are compared through gain, loss, footprint, risk and reversibility rather than through feature lists or preferred-tool workflows.
Vendor-independent
The decision logic is intended to remain useful as products, interfaces, platforms and acquisition capabilities change.
Inside the guide
State → options → consequences → documented decision.
These page previews use the actual A01 and A02 content from Vol. 1. The State Map starts from observable state; the Decision Card compares realistic alternatives through evidentiary consequences before DECIDE and DOCUMENT.
What is included
A first-response and forensic-acquisition workflow, not a catalog of commands.
State-Entry Index
Enter from observable state rather than from a guessed tool or artifact.
Core Field Cards
D1/D2 decision cards and compact procedures organized around first-response choices.
State Maps
Visual routing that makes decision forks and state-dependent consequences explicit.
Quick Reference
Supporting reference material that does not justify a separate operational decision card.
Field Forms
Scene, acquisition, handoff, decision and continuation records designed to support contemporaneous documentation.
Maintained Companion
Card identity, source status, errata and decision-relevant updates remain available online.
Home domain
Computer owns computer-local state.
General-purpose computers and directly attached storage belong here. Provider-side cloud state routes to Vol. 4; smartphone/tablet state to Vol. 2; network fabric and remotely administered infrastructure to Vol. 3; embedded/proprietary-purpose devices to Vol. 5; cross-domain sequencing to Vol. 6.
Maintained source base
Primary sources stay visible.
The edition is maintained against relevant ISO/IEC forensic standards, SWGDE guidance, NIST publications and primary platform documentation. Draft, archived and historical sources are identified as such rather than presented as current final guidance.
Free Field Preview
See the method before you buy the guide.
Download an eight-page preview with the Evidence First decision grammar, selected A01 and A02 content, the six-volume architecture, and publication links.
Free companion resources
Use the guide in the field without copying its forms by hand.
Printable A4 and US Letter copies of the canonical Field Forms are available without registration. The public Card Registry preserves stable identifiers for the 2027 edition.