The first step in any investigation is to identify and gather evidence. Digital forensic investigations are no different. The evidence used in this type of investigation is data, and this data can live in many different locations in a variety of formats. This poster will help you to identify the data that you might need to analyze, determine where that data resides, and formulate a plan and procedures for the best way to collect and preserve that data. This poster will also show you the path to where the investigation really begins!
For more resources on how to start in DFIR check out "The Ultimate Guide to Getting Started in Digital Forensics & Incident Response" here.