Digital Forensics: Empowering Experts On-Scene and in the Lab

ADF forensic tools are the best lightweight, portable digital forensic software devices used worldwide to solve lab and front-line field investigations:

Mobile Device Investigator^® - Mobile Device Investigator^® is a mobile forensics triage tool that is user-friendly, requires minimal training, and is designed for front-line law-enforcement, analysts, and forensic examiners.
Digital Evidence Investigator^® - Digital Evidence Investigator^® is a computer forensics triage tool designed for front-line law enforcement, analysts, and forensic examiners.
ADF PRO - ADF PRO software is a full ADF product suite of mobile and computer triage software that is user-friendly and is designed for front-line law-enforcement, analysts, and forensic examiners.

Capabilities and Features

Can the ADF tools be used by non-technical users?

Yes. ADF has been providing easy-to-use yet powerful triage tools for non-technical users since 2005, and we have numerous client success stories.

Are the ADF tools forensically sound?

Yes, this is a key feature of ADF tools. See table below.

Description	Powered-OFF Computers	Powered-ON Computers
Forensically sound	Yes	Partically
Change to file time stamps	No	No
USB key registry entry in standard mode	No	Yes
USB key registry entry in stealth mode (Triage-G2 only)	No	No

What are the ADF capabilities for scanning live (on) computers, dead (off) computers, removed hard drives, and drive images?

Computer/Media	Triage-G2	DEI	Triage-Investigator
Live (on) computers
Dead (off) computers
Removed hard drives
External media (CDs, DVDs, SD cards, USB drives, etc.)
Drive images (dd, e01)

What computer operating systems will ADF tools work on?

ADF tools are designed to scan the following systems:

Powered-off target computer (boot scan)

Firmware: BIOS, UEFI, SECURE UEFI, MAC EFI 2.0 (released after 2010)
CPU: Intel 64-bit or compatible
RAM: 2GB or more
File sytems: FAT, NTFS, HFS+, EXT2/3/4
RAID: 0,1,5
Windows Dynamic Disks: not supported

Powered-on target computers (live scan)

Windows Vista/7/8/10 64-bit, Server 2008/2012 64-bit
Windows Dynamic Disks: simple volumes only (no spanned, striped, mirrored, RAID-5, volumes)

Drive image scan from the Desktop application

Format: dd and e01
File systems: FAT, NTFS, HFS+, EXT2/3/4
OS: Windows, Mac, Linux, iOS, Android
RAID: rebuilding RAID is not supported, so image must represent a logical disk

Folder scan from the Desktop application

OS: Windows, Mac, Linux, iOS, Android

Can ADF tools scan tablets and smartphones?

Yes, ADF digital forensic capabilities for logical acquisition and analysis include iOS, Android, and ChromeOS platforms.

Evaluation

Can I try the ADF tools prior to purchase?

ADF offers a free 30-day evaluation license for all ADF products.
Click here to sign up

Does ADF provide support for an evaluation license of ADF tools?

Yes. ADF provides full support for all evaluations of its tools.

What are the user requirements to evaluate the ADF tools?

If you are not a technical user, we ask that you please coordinate with a someone with experience using forensic tools within your organization to supervise or perform an evaluation of ADF tools. This is recommended because users with no (or minimal) forensic training will require proper training to set-up, use, and evaluate the tools. Once this training is complete, these users can easily use the tools.

How easy is to get started using the ADF tools?

You can get started right away. ADF provides clients with pre-configured Search Profiles to help them get started immediately.

Performance

How long does the triage process normally take?

Performance varies on a number of factors (see point 3 below). Here are some Search Profile considerations that can affect the duration of the scan:

Do you need to find evidence as quickly as possible (time restricted)? If YES, then the ADF tools can be configured to search the highest probability areas of a computer first so that you can achieve your goals.
Do you need to scan the entire hard drive? If YES, this will take some time and should probably run overnight. Keep in mind that this will still be much faster than processing a case with a traditional forensic examination – the difference is hours for a triage scan versus days for processing a drive image.
With regard to variables, the triage process primarily depends on the following factors:
- The memory (RAM) of the suspect computer
- The read/write speeds of the suspect hard drive
- The read/write speeds of the Triage Key (USB key)
- The size of your Captures. You can contact us for more details.

Can I scan multiple computers simultaneously with the ADF tools?

This capability is available in Digital Evidence Investigator^® and uses both a USB-based ADF license dongle and a separate generic (non-ADF) USB collection device. As a result, users can set up unlimited generic USB collection devices and leverage a single ADF license dongle to start simultaneous boot scans on multiple suspect computers. However, you will need to set up a separate collection device for each computer you wish to boot scan simultaneously.

Purchase, Renewals and License Terms

How can I purchase ADF tools?

You can purchase ADF tools directly on-line, by email (sales@adfsolutions.com) or by calling us at 301-312-6578, option 2.

Which ADF tool is right for me?

View the ADF software product comparison chart.

What license terms does ADF offer?

ADF Solutions offers 1-year or 3-year subscription (or term) licenses for its software. During the license term, all support, maintenance, and software upgrades are included. Annual renewals can be purchased to extend the license terms.

Does a subscription (or term) license stop working after the term expires?

A subscription (or term) license stops working when the term expires. If your renewal has been delayed and the license has either expired or is about to expire, ADF Solutions can provide you with a temporary extension so that there is no interruption in the software service. Please Contact Us for details.

How do I find the ADF license file?

Click here for Instructions to Find Your ADF License File

What are ADF’s U.S. export controls and restrictions?

ADF is authorized to export its products internationally with the exception of Countries classified as Group E destinations by the DDTC. These countries are Cuba, Iran, North Korea, Sudan, and Syria. Please feel free to contact us for more details on DDTC Registrant Code and CCATS classifications.

Support, Maintenance, and Upgrades

What do I do if my ADF license has expired?

If your license renewal has been delayed and the license has either expired or is about to expire, ADF Solutions will provide you with a temporary extension to your license so that there is no interruption in the software service. Please contact us to request an extension.

What support does ADF provide for its tools?

ADF provides comprehensive support and maintenance for our users. All support, maintenance, and software upgrades are included in the license fee and continue throughout the full duration of the license term. Please visit our Support Page for details on how to contact us for assistance.

How does ADF handle software upgrades?

All ADF tools include an automatic software upgrade feature if the installed computer has access to the Internet and the license term has not expired. In addition, all registered users are notified by email when a new upgrade is available for download.

Frequently Asked Questions