Computer-forensics

As digital technology becomes more advanced, the potential for its criminal application is magnified. This can result in overwhelming amounts of digital data for law enforcement to inspect in a limited timeframe. Although opportunities to find digital evidence on a perpetrator's or victim's computer may be numerous, the time it takes to search through such vast quantities of data contributes to the issue of growing forensic backlogs. 

ADF’s newest software versions include new field tablet capabilities and smartphone collection features 

ADF Solutions Introduces Field Investigator™ for Teams

There’s a new way to give digital forensic examiners control of investigations and empower non-technical front-line investigators. Meet Field Investigator™ for Teams, the best way to deploy digital forensic triage capabilities to agents for on-scene digital evidence collection and analysis.

It's a known issue that many agencies and departments are facing worldwide; how to fight and reduce backlog to stay up to date on cases so that they don't get stale. It's a serious issue, but we at ADF can show you a few ways to fight in-house backlog with digital forensic triage.

RAM, short for Random Access Memory, is physical hardware that temporarily stores data for quick read and write access. Think of RAM as a scratch pad you use while working; although all the information you need and may refer to is stored in a binder (in this analogy, your hard drive), the information on the scratch pad is what you are using and need right in the moment. With RAM, it is right there for you to access. While RAM helps with the speed and efficiency of the computer, it can all be lost in an instant as it is volatile.

ADF computer triage has long been admired for some of the best digital forensic triage capabilities on the market. Since 2006, ADF digital forensic experts have been building triage tools to empower investigators to quickly collect evidence and on-scene intelligence from computers and digital devices.

In this how-to video, we will cover backing up and scanning encrypted iOS devices. This skill is important to know because encrypted iOS backups return more data than unencrypted backups.

The numbers surrounding pornographic images of children, and the child abuse that creates it, are so staggering that it’s difficult not to be disheartened. According to the National Center for Missing and Exploited Children (NCMEC), their cyber tipline received over 42.9 million reports by November 2018. NCMEC had also reviewed over 267 million images and videos, and identified over 15,800 victims of online child exploitation and abuse.

As communities search for new ways to employ wounded, injured, or ill special operations veterans, there's a new federal government program that offers hope. 

The program which provides financial support for communities seeking to further increase their effectiveness in the fight against child exploitation is run by the U.S. Department of Justice. Communities will benefit in two key ways: 

1. Employ wounded veterans paid for via federal grant money
2. Help communities fight the ever growing battle to stop child exploitation

Looking to add key words on-scene? ADF has you covered. In this how-to video, investigators and analysts will learn how to add keywords directly from the Collection Key.

Our digital forensic specialist knows that as someone who used to go out and execute search warrants and conduct knock and talks, the ability to overcome and adapt on-scene is vital to a successful outcome. In this how-to video, Rich explains how to create a Collection Key without Search Profiles and how to add keywords prior to starting a scan from the Collection Key. 

ADF Solutions Releases New Digital Forensic Software to Power Field Investigations

Triage digital evidence with a single license for smartphones, tablets, and computers

ADF Solutions, the leading provider of automated forensic software for investigators and lab examiners, today announced new software versions for Digital Evidence Investigator^Ⓡ, Triage-Investigator^Ⓡ,  Triage-G2^Ⓡ, and Mobile Device Investigator^Ⓡ software.

ADF Solutions is proud to announce that we have joined forces with Carahsoft, the leading government IT Solutions provider as an authorized reseller of our products.

This blog post will feature our Settings page, and tips and tricks to understanding it. The first thing users will notice on the settings page is the Backed-Up Licenses. This displays all licenses that have been backed up on this computer. When selecting a license it will display all the information pertaining to that license and also enable users to delete the license from the backed up licenses folder. Additionally, the information here can be used when making a support call or using the support portal.

We could have just written a mission statement. Maybe we’d throw in some core values, and hit you with some motivational quotes from great thought leaders. We could have done that, but that’s not the ADF way. ADF is an innovator, so we took those ideas and went further. Meet our Culture Code: a living, breathing set of standards, principles, values, and goals that we put our hearts and souls into as a team, because we are #AllinForensics. 

Our newest How-To video will cover how to image from either the Desktop tool or the USB device (Collection Key) on a Boot and Live Scan. 

When using ADF tools to collect files, either by File Properties, Hashes, or Keywords, ADF tools provide  three methods for file identification:

With ADF digital forensic software tools, it's possible to scan multiple devices simultaneously and have them as part of one scan. However, there are some items we need to keep in mind when preparing to scan multiple devices.

Triage- the word is normally associated with hospitals, where doctors and nurses prioritize patients’ treatments based on the severity of their condition. The concept has been around since the Napoleonic wars and is responsible for saving innumerable lives ever since.

When your case is complete and it comes time to archive your case,  the best method is to archive with the Stand Alone Viewer, located within reporting.

Digital Evidence Investigator is built for front-line field investigators and lab examiners who need to do digital forensic investigations on Mac, Linux, or Windows. Combined with Mobile Device Investigator, Digital Evidence Investigator PRO gives you all the best computer forensic capabilities along with iOS and Android mobile forensics in a single affordable forensic tool. 

In this short video ADF's Digital Forensic Specialist, Rich Frawley, demonstrates the installation process for DEI and DEI PRO, on an offline computer that does not have Internet access. You can refer to our Technical Specifications for minimum requirements and supported Operating Systems.

Digital Evidence Investigator is built for front-line field investigators and lab examiners who need to do digital forensic investigations on Mac, Linux, or Windows. Combined with Mobile Device Investigator, Digital Evidence Investigator PRO gives you all the best computer forensic capabilities along with iOS and Android mobile forensics in a single affordable forensic tool. 

In this short video ADF's Digital Forensic Specialist, Rich Frawley, demonstrates the installation process for DEI and DEI PRO, on a computer that has Internet access. You can refer to our Technical Specifications for minimum requirements and supported Operating Systems.

Digital Evidence Investigator PRO enables front line field investigators to quickly create a forensic backup of an iOS device on-scene or back in the lab. In this short video, ADF Digital Forensic Specialist, Rich Frawley, will show you how to easily backup an iOS device with DEI PRO.

Digital Evidence Investigator PRO enables front line field investigators to quickly create a forensic backup of an Android device on-scene or back in the lab. In this short video, ADF Digital Forensic Specialist, Rich Frawley, will show you how to easily backup an Android device with DEI PRO.

Most children in the United States now have access to internet services. The internet enables children to have access to vast amounts of valuable and educative information that facilitates their growth. However, the internet further exposes children to numerous dangers. Some of the risks children are exposed to on the internet include pornography, racist, sexist, violent, and demeaning information.

These risks prompted the formation of the Internet Crimes Against Children (ICAC) Task Force program. The organization is a national network of 61 coordinated task forces that represent over 4,500 local, state, and federal law enforcement and prosecutorial agencies. The state and regional ICAC task forces are maintained and expanded by the ICAC program to address technology-facilitated child exploitation crimes.

Digital Evidence Investigator^® (DEI) and Triage-Investigator^® come with out-of-the-box default Search Profiles. In this short video tutorial, we use Digital Evidence Investigator to demonstrate "What is a Search Profile?".

In DEI the Search Profiles are maintained in the Setup Scans Menu option. The Search Profile, when run, will collect the information selected within the Search Profile. Search Profiles will run from the desktop application or from the collection key on a Live or Boot scan.

Learn how to conduct a Windows live scan with ADF Solutions Digital Evidence Investigator.  Two USB ports are required to complete a scan, one for the Collection Key and one for the Authentication Key, once the scan has started the Authentication Key can be removed. A USB hub may be used in cases where the target computer only has one USB port. 

When running a live scan from a Collection Key it is possible to create a RAM dump of the computer. RAM dumps can then be analyzed with appropriate software (e.g. Volatility). 

In the early 18th century, triage was used to refer to the action of sorting items according to quality and was taken from the French word trier which means to sort, separate out or cull. 

>> Continue reading or watch the Benefits of Triage webinar recording. 

Join ADF Solutions for a webinar hosted by the National White Collar Crime Center (NW3C), a nonprofit, membership-affiliated organization comprised of state, local, federal and tribal law enforcement and prosecutorial and regulatory agencies.  

NW3C provided a nationwide support system for law enforcement and regulatory agencies involved in prevention, investigation and prosecution of economic and high-tech crime.  Support is delivered via training in computer forensics, cyber and financial crime investigations and intelligence analysis as well as original research on and analytical technical support for investigating and prosecuting white collar and related crimes. 

ADF Solutions Newest Software Release Makes It Easier to Fight Against Child Exploitation

As the leading provider of automated forensic software for investigators and lab examiners, we are delighted to announce the ability for on-scene and lab investigators to rapidly collect media files using Digital Evidence Investigator^Ⓡ, Triage-Investigator^Ⓡ, and Triage-G2^Ⓡ software and export media files to the Griffeye Analyze platform. 

What's the fastest, easiest way to perform RAM Dump? While there are many tools and techniques available to examiners for recovering data from volatile memory, ADF Digital Evidence Investigator^®, Triage-Investigator^®, and Triage-G2^® are fast and easy. 

A simple 2-step process lets even the most non-technical field investigators or highly trained digital forensic examiners quickly perform a RAM capture when running a live scan on the computer from a collection key: 

1. Click "Create RAM Dump" from the main menu
2. The RAM Dump will be saved to the collection key as a .bin file and then zipped

With eleven (11) out-of-the-box Search Profiles inside Digital Evidence Investigator^® (DEI), the ADF Digital Forensic team has created software that enables investigators and forensic examiners to obtain the digital evidence needed in a wide variety of evidence collection situations. 

The investigation began after images consistent with child pornography were uploaded to a social media platform.  A search warrant was executed at the residence and an on-scene forensic exam of all electronic media was completed by members of the State Police Computer Crime Unit.  Using ADF Digital Evidence Investigator^®, investigators discovered images and videos of sexual abuse of an under age child and were able to identify a resident of the household as the suspect. Specifically, investigators located thumbcache images that resulted in identifying a female child that was being sexually abused and identified the suspect.

ADF is helping stop crimes against children by providing law enforcement with the right tools and training to combat internet crimes against children.  As part of our mission to help fight child exploitation, ADF is a returning sponsor of the Crimes Against Children Conference.  If you are attending, join ADF Digital Forensic Specialists (Rich Frawley), as he leads a lecture and lab training for participating law enforcement officers:

• On-Scene Digital Investigation Best Practices: From CyberTip to Court Ready Paperwork (Lecture)
• Solving Crimes Against Children with ADF Digital Evidence Investigator^® (Hands-on Labs)

Each participant will learn digital forensic best practices for child exploitation cases and receive an extended trial of our DEI software. 

Last week, leaders from the military, special operations and industry gathered together in Tampa, Florida for the 2018 Special Operations Forces Industry Conference (SOFIC) and Exhibition.  The event, sponsored by the National Defense Industrial Association (NDIA) emphasized the USSOCOM Commander's vision to "Win - Transform - People" and was joined by international military members from US partner nations.

This week, ADF is sponsoring training for companies and law enforcement agencies that seek to train individuals and teams on computer forensic training.