Learn the Differences Between ADF Forensic Tools

FINAL New Datasheet (June 2022) (1)All ADF software shares the same intelligent search engine and rapid scan capabilities. The key differences in our digital forensic products are in the form factor and the features focused on deployment and usage scenarios. Users can select to deploy Mobile Forensics, Computer Forensics, or All-in-One Forensics tools which combine all capabilities into a portable lab. 

  • Forensic Examiners - Police, Government or Corporate Lab Investigations and Priority Triage
  • Field Investigators - Police, Sheriff, Law Enforcement, School Resource Officers, IT Security and Digital First Responders
  • Intel or Military Field Operatives - Force Protection and Field Intelligence Gathering

Request a Free Trial

 

Searching Digital Devices & Images

  Digital Evidence Investigator® Triage-Investigator® Triage-G2® Mobile Device Investigator® MDI Field Tablet DEI PRO Field Tablet

Instant previewing of mobile devices (no waiting for backups)

PRO

PRO

PRO

Y

Y

Y

Take screenshots of mobile devices with OCR capability

PRO

PRO

PRO

Y

Y

Y

 Screen Record Android/iOs devices- (up to Android 14 and iOS 16) with Preserved Audio

PRO

PRO

PRO

Y

Y

Y

Scan connected and unlocked Android/iOS devices (up to Android 14 and iOS 16)

PRO

PRO

PRO

Y

Y

Y

Scan connected MTP devices (digital camera, legacy phones, etc)

PRO

PRO

PRO

Y

Y

Y

Scan Android/iOS ADF backups (up to Android 14 and iOS 16)

PRO

PRO

PRO

Y

Y

Y

Scan iTunes backup found on target computer

PRO

PRO

PRO

N

N

Y
Scan full mobile device acquisitions and detect keychain/keystore files (GrayKey, UFED)

PRO

PRO

PRO

Y

Y

Y

Take screenshots of connected Android/iOS devices (up to Android 14 and iOS 16)

PRO

PRO

PRO

Y

Y

Y

 Autoscroll when taking screenshots of long pages on Android

PRO

PRO

PRO

Y

Y

Y

Preview connected and unlocked Android/iOS devices (up to Android 14 and iOS 16)

PRO

PRO

PRO

Y

Y

Y

RAM capture

Y

Y

Y

N

N

Y

Scan turned-on Windows computers (live scan Windows machines)

Y

Y

Y

N

N

Y

Scan turned-on Mac computers (live or recovery scan via the remote agent scan)

Y

Y

Y

N

N

Y

Scan turned-off Windows, Mac, Linux computers (boot scan)

Y

Y

Y

N

N

Y

Scan multiple computers on-site with a single license dongle

Y

Y

N

N

N

Y

Scan drive images (E01, DD, AFF4, L01)

Y

Y

Y

N

N

Y

Scan NTFS, FAT, ExFAT, HFS+, APFS, EXT2/3/4, YAFFS2 file systems

Y

Y

Y

N

N

Y

Scan devices connected to suspect computer

Y

Y

Y

N

N

Y

Scan external devices (USB, CD, DVD, SD cards, etc.) from forensic workstation / friendly computer

Y

Y

Y

N

N

Y

Enter keywords just before a live/boot scan

Y

Y

Y

N

N

Y

Recover hundreds of file types

Y

Y

Y

Y

Y

Y

Recover communication artifacts (emails, chats, contacts, etc)

Y

Y

Y

Y

Y

Y

Recover system artifacts (user accounts, WiFi connections, USB history, installed apps, etc)

Y

Y

Y

Y

Y

Y

Recover application artifacts (peer-to-peer, anti-forensics, cryptocurrency, etc)

Y

Y

Y

Y

Y

Y

Recover web browser artifacts (browsing history, bookmarks, search terms, etc)

Y

Y

Y

Y

Y

Y

Recover deleted pictures from unallocated space

Y

Y

Y

N

N

Y

Recover deleted pictures from system files

Y

Y

Y

N

N

Y

Recover deleted records from apps using the SQLite database

Y

Y

Y

Y

Y

Y
 Recover and process deleted     partitions

Y

Y

Y

Y

Y

Y

Prompt for password for encrypted partitions (FileVault2 HFS/APFS, Bitlocker)

Y

Y

Y

N

Y

Y

Ignore files from a whitelist (import from NSRL and VICS/CAID)

Y

Y

Y

Y

Y

Y

Conduct live scans in Stealth mode

N

N

Y

N

N

N

Automatically start a boot or live scan

N

N

Y

N

N

Y

Forensically Sound

Y

Y

Y

Y

Y

Y

Imaging Digital Devices

  Digital Evidence Investigator® Triage-Investigator® Triage-G2® Mobile Device Investigator® MDI Field Tablet DEI PRO Field Tablet

Image suspect drives and storage devices (EWF and DD)

Y

Y

Y

N

N

Y

Image Mac computers from the remote agent (ZIP)

Y

Y

Y

N

N

Y

Advanced logical acquisition of Android/iOS devices

PRO

PRO

PRO

Y

Y

Y

Analysis & Reporting

  Digital Evidence Investigator® Triage-Investigator® Triage-G2® Mobile Device Investigator® MDI Field Tablet DEI PRO Field Tablet

Review evidence directly on suspect computer

Y

Y

Y

N

N

Y

Comprehensive filtering and sorting of results

Y

Y

Y

Y

Y

Y

Hide duplicated files to reduce noise

Y

Y

Y

Y

Y

Y

Analyze all files, artifacts, and users' activities in a single timeline

Y

Y

Y

Y

Y

Y

View links between files of interest and user’s activities

Y

Y

Y

Y

Y

Y

View conversations in familiar color-coded "chat" bubbles

Y

Y

Y

Y

Y

Y

Tag and comment on relevant records to build report

Y

Y

Y

Y

Y

Y

Automatic visual classification of pictures and videos

Y

Y

Y

Y

Y

Y

Extract and translate entities from documents and communications

Rosoka Add-on

Rosoka Add-on

Y

Rosoka Add-on

Rosoka Add-on

Rosoka Add-on

Create comprehensive reports

Y

Y

Y

Y

Y

Y

Export reports to HTML, PDF, VICS, and CSV formats

Y

Y

Y

Y

Y

Y

Export reports to a standalone viewer executable

Y

Y

Y

Y

Y

Y

Setup & Configuration

  Digital Evidence Investigator® Triage-Investigator® Triage-G2® Mobile Device Investigator® MDI Field Tablet DEI PRO Field Tablet

Define and package custom search criteria (Search Profiles)

Y

N

Y

Y

Y

Y

Create custom data Captures (keywords, SHA-1/MD-5 hash, grep search, file collection)

Y

N

Y

Y

Y

Y

Import VICS and CAID datasets for auto-categorization

Y

N

Y

Y

Y

Y

Customize file headers

Y

N

Y

Y

Y

Y

Configure folders and paths to scan

Y

N

Y

Y

Y

Y

Configure files to search properties (size, timestamps, etc.)

Y

N

Y

Y

Y

Y

Import Captures and Search Profiles

Y

Y

Y

Y

Y

Y

Export Captures and Search Profiles

Y

N

Y

Y

Y

Y

Out-of-the-box Search Profiles for "Media Exploitation"

N

N

Y

Y

Y

N

Out-of-the-box Search Profiles for "Law Enforcement" (including Indecent Images of Children Profiles for CSAM investigations)

Y

Y

N

Y

Y

Y

Use any USB drive as a Collection Key

Y

Y

N

N

N

Y

Use BitLocker to protect the Collection Key

Y

Y

Y

N

N

Y

Prepare a Collection Key without Search Profiles to select Captures just before a Scan

Y

N

Y

N

N

Y

Simple multi-workstation deployment with a single configuration file

Y

Y

Y

Y

Y

Y

Ready to use with no installation and no setup required

N

N

N

N

Y

Y
"ADF’s proven track record of reducing forensic backlogs. Now you can conduct digital investigations in the lab, or on-scene easier, faster and smarter. DEI makes it easy to quickly identify incriminating files and artifacts."

Leah Lawrence

Corporate Security Manager | USACorp