1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-86: Guide to Integrating Forensic Techniques into Incident Response. Section 3.1, "First Responders," page 13. This section details the role of first responders, identifying them as "IT staff, system administrators, and security staff" and outlining their duties in preserving evidence before forensic specialists arrive.
2. Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). NIST Special Publication 800-86: Guide to Integrating Forensic Techniques into Incident Response. Computer Security Division, Information Technology Laboratory, National Institute of Standards and Technology. Section 3.1.1, "Actions," pages 13-14. This part specifies the tasks for first responders, including scene documentation and evidence identification, which are performed by non-specialists.
3. Carrier, B., & Spafford, E. H. (2003). Getting Physical with the Digital Investigation Process. International Journal of Digital Evidence, 2(2). Section "The Physical Crime Scene Investigation Phase". This academic paper discusses the initial phase of an investigation, emphasizing that securing the scene is a critical first step often performed by on-site personnel who are not forensic experts. Available via the Association for Computing Machinery (ACM) Digital Library.