Frequently Asked Questions

Capabilities and Features

Both Digital Evidence Investigator® (DEI) and Triage-Investigator scan suspect computers using ADF Search Profiles. However, Triage-Investigator can only use the default Search Profiles shipped with the software OR custom profiles created in DEI, whereas with DEI you can create custom Search Profiles.
Each copy of Triage-Investigator DOES NOT NEED a corresponding copy of DEI to setup custom Search Profiles. However, agencies should have at least one copy of DEI to provide custom Search Profiles to all Triage-Investigator installations at the same agency. Without this, Triage-Investigator users will be limited to only the default Search Profiles shipped with the software. For details on the default Search Profiles, please contact support@adfsolutions.com.
View a complete ADF Product feature comparison
Yes. ADF has been providing easy-to-use yet powerful triage tools for non-technical users since 2005, and we have numerous client success stories.
Yes, this is a key feature of ADF tools. See table below.
Description Powered-OFF Computers Powered-ON Computers
Forensically sound Yes Partically
Change to file time stamps No No
USB key registry entry in standard mode No Yes
USB key registry entry in stealth mode (Triage-G2 only) No No
See our ADF forensic tool comparison page here.ADF Product feature comparison
Computer/Media Triage-G2 DEI Triage-Investigator
Live (on) computers
Dead (off) computers
Removed hard drives
External media (CDs, DVDs, SD cards, USB drives, etc.)
Drive images (dd, e01)

ADF tools are designed to scan the following systems:

Powered-off target computer (boot scan)

  • Firmware: BIOS, UEFI, SECURE UEFI, MAC EFI 2.0 (released after 2010)
  • CPU: Intel 64-bit or compatible
  • RAM: 2GB or more
  • File sytems: FAT, NTFS, HFS+, EXT2/3/4
  • RAID: 0,1,5
  • Windows Dynamic Disks: not supported

Powered-on target computers (live scan)

  • Windows Vista/7/8/10 32/64-bit, Server 2008/2012 32/64-bit
  • Windows Dynamic Disks: simple volumes only (no spanned, striped, mirrored, RAID-5, volumes)

Drive image scan from the Desktop application

  • Format: dd and e01
  • File systems: FAT, NTFS, HFS+, EXT2/3/4
  • OS: Windows, Mac, Linux, iOS, Android
  • RAID: rebuilding RAID is not supported, so image must represent a logical disk

Folder scan from the Desktop application

  • OS: Windows, Mac, Linux, iOS, Android
ADF will be adding capabilities for smartphones (iPhone, Android, and Windows) by mid-2017.

Evaluation

ADF offers a free 30-day evaluation license for all ADF products.
Click here to sign up
Yes. ADF provides full support for all evaluations of its tools.
If you are not a technical user, we ask that you please coordinate with a someone with experience using forensic tools within your organization to supervise or perform an evaluation of ADF tools. This is recommended because users with no (or minimal) forensic training will require proper training to set-up, use, and evaluate the tools. Once this training is complete, these users can easily use the tools.
You can get started right away. ADF provides clients with pre-configured Search Profiles to help them get started immediately.

Performance

Performance varies on a number of factors (see point 3 below). Here are some Search Profile considerations that can affect the duration of the scan:
  1. Do you need to find evidence as quickly as possible (time restricted)? If YES, then the ADF tools can be configured to search the highest probability areas of a computer first so that you can achieve your goals.
  2. Do you need to scan the entire hard drive? If YES, this will take some time and should probably run overnight. Keep in mind that this will still be much faster than processing a case with a traditional forensic examination – the difference is hours for a triage scan versus days for processing a drive image.
  3. With regard to variables, the triage process primarily depends on the following factors:
    • The memory (RAM) of the suspect computer
    • The memory (RAM) of the suspect computer
    • The read/write speeds of the suspect hard drive
    • The read/write speeds of the Triage Key (USB key)
    • The size of your SearchPaks. You can contact us for more details.
This capability is available in Digital Evidence Investigator® and Triage-Investigator and uses both a USB-based ADF license dongle and a separate generic (non-ADF) USB collection device. As a result, users can set up unlimited generic USB collection devices and leverage a single ADF license dongle to start simultaneous scans on multiple computers. However, you will need to set up a separate collection device for each computer you wish to scan simultaneously.

Purchase, Renewals and License Terms

You can purchase ADF tools directly on-line, by email (sales@adfsolutions.com) or by calling us at 301-312-6578, option 2.
ADF Solutions offers 1-year or 3-year subscription (or term) licenses for its software. During the license term, all support, maintenance, and software upgrades are included. Annual renewals can be purchased to extend the license terms.
For DEI and Triage-Investigator, a subscription (or term) license stops working when the term expires. Triage-G2 comes with extended license duration beyond the initial 3-year license term. If your renewal has been delayed and the license has either expired or is about to expire, ADF Solutions can provide you with a temporary extension so that there is no interruption in the software service. Please Contact Us for details.
ADF is authorized to export its products internationally with the exception of Countries classified as Group E destinations by the DDTC. These countries are Cuba, Iran, North Korea, Sudan, and Syria. Please feel free to contact us for more details on DDTC Registrant Code and CCATS classifications.

Support, Maintenance, and Upgrades

If your license renewal has been delayed and the license has either expired or is about to expire, ADF Solutions will provide you with a temporary extension to your license so that there is no interruption in the software service. Please contact us to request an extension.
ADF provides comprehensive support and maintenance for our users. All support, maintenance, and software upgrades are included in the license fee and continue throughout the full duration of the license term. Please visit our Support Page for details on how to contact us for assistance.
All ADF tools include an automatic software upgrade feature if the installed computer has access to the Internet and the license term has not expired. In addition, all registered users are notified by email when a new upgrade is available for download.
Yes, please visit our Training Partners to see where ADF offers training. ADF strives to provide training for all users, if you do not see a partner near your location, please contact us to schedule training.
  • READY TO ACCELERATE YOUR DIGITAL INVESTIGATIONS?