Speeding your investigations has always been a primary focus for ADF Solutions and with the launch of ADF Mobile Preview capabilities, you can start looking at phone content immediately without waiting for a backup or imaging to finish.
Preview is available in Mobile Device Investigator, the MDI Field Tablet, the DEI PRO Field Tablet, and each of the ADF PRO tools. Mobile Preview is designed to collect artifacts as well as pictures, videos, and documents.
ADF tools give you several ways to get what you need out of a mobile device starting with preview. The ability to truly triage a mobile device on scene or in the office, and after preview or when you know what is on the phone that may not get backed up in an Advanced Logical backup you can move to our Screenshot feature, and after that to our back up and scan with a pre-configured or custom search profile.
In this 4 minute How To video, our Director of Training, Rich Frawley will demonstrate how investigators can quickly preview a smartphone or mobile device.
iOS Forensic Triage
To begin ADF Mobile Preview on an iOS, start at the Home Screen:
- Choose Investigate Mobile Devices and Select Preview.
- Select Add Phone and the device type you want to preview - in this example we preview an iPhone 8.
- Select iOS - Double check Airplane mode and then select Next. Once the phone is connected you can Select a new path for the acquisition and give the preview a new name (Default is Preview and date and time) and your preview begins.
You'll see instant results with some artifacts being collected followed by image collection and you'll see the preview completes in seconds.
Android Forensic Triage
To begin ADF Mobile Preview on an Android, start at the Home Screen:
- Choose Investigate Mobile Devices and Select Preview.
- Select Add Phone and the device type you want to preview - in this example we preview an Android.
- Select Android - Start the same way with the connection wizard. Double check Airplane mode and then select Next. Once the phone is connected you can Select a new path for the acquisition and give the preview a new name (Default is Preview and date and time) and your preview begins.
The caching of files commences and again - immediate access and collection. You can see that images are being collected in the progress bar and artifacts in the Captures pane. If you go to Pictures you can see what has been collected already and If you switch to the video screen, you can see files collected here as well.
The Fastest Mobile Phone Triage
With ADF Mobile Preview, investigators can control their investigation, as the file collection sequence adapts based on the user interactions. For example, if the pictures are being collected, but the user navigates to the Videos view, then the video files get a higher collection priority.
During the scan you can review what has been collected including filtering and once the scan is complete everything that has been collected is in your results so you can sort, filter, tag, comment and report. You do not lose access to the previewed evidence.
Now that you are able to make a decision on this device you can move to screenshot and collect or back up and scan.
