First responder
Also known as: Ersthelfer
The first person at the affected system – administrator, service technician, employee – whose actions in the first minutes decide whether evidence survives.
The European Union Agency for Law Enforcement Cooperation (incl. EC3) (Europol) report locates the largest knowledge gap with first responders: they underestimate which data matters and destroy traces through well-meant immediate action. In a company the first responder is almost never a forensic examiner. What they need is not training but a short instruction and a phone number.