Field guides

Start with the evidence question

A defensible workflow links the authorized question to a collection plan, preserves the relevant sources, tests the interpretation, and reports the remaining uncertainty. The sequence must account for volatile data, service retention, and the consequences of interacting with a live system.

• Verify an acquisition and its working copies

  A practical guide to scope, manifests, transfer checks, and explaining hash comparisons.

• Corroborate a timeline without flattening uncertainty

  Keep raw times, offsets, precision, and independent sources connected.

• Review a forensic claim

  Trace a conclusion back to its source, collection scope, and method validation.

• Evidence Preservation

  Existing field manual preservation guidance.

• Chain of Custody

  Track handling and transfers independently of content hash checks.

A working sequence

1. Scope: write the question, authority, systems, accounts, and time range. Identify data that may expire before routine collection.
2. Preserve: document the initial state and choose a collection approach appropriate to the source. Record unavoidable changes caused by collection.
3. Verify: compare the collected output with acquisition records, expected scope, and applicable integrity checks. Keep originals apart from working derivatives.
4. Interpret: test the explanation against other records and ordinary system behavior. Record contrary observations rather than discarding them.
5. Report: identify the observation, reasoning, unresolved alternatives, and the limits of the collected material.

NIST SP 800-86 provides an IT incident-response perspective on collection, examination, analysis, and reporting. Published in 2006, it supplies a process foundation rather than current artifact behavior for every platform. Pair it with version-specific documentation and the downloadable worksheets.