First responders must be very aware of their tasks when first arriving to perform forensic triage. The efforts of the first responder is critical to ensure that the evidence is gathered and preserved in a simple, secure, and forensically sound manner. The initial response to an incident is more important than later technical analysis of the computer system as actions taken by the first responder can greatly impact the subsequent laboratory examinations of the computer/system. The success of evidence recovery and prosecution is dependent on the actions of the individual who initially responders to the scene.
