Initial, time-sensitive assessment used to prioritize evidence sources and investigative actions. Digital triage may identify key devices, accounts, time frames, or artifacts (recent chats, recent logins, volatile data) that require rapid preservation.
