Computer-forensics

When conducting an investigation involving multimedia, the quantities of files can be quite overwhelming especially when they include Child Exploitation Material (CEM) and Child Sexual Assault Material (CSAM). It is not just the CEM or CSAM that is included in the collection or search, typically there are tens of thousands, if not hundreds of thousands of files including images and videos, that have to be sorted through. Not only can the number of files be daunting, but the reasons for conducting the intense file filtering also have multiple purposes.

This post will list all supported web browsers that ADF tools can investigate including Chromium-based browsers. As a digital investigator, you want to be prepared and ready for anything on-scene and that includes being able to collect digital evidence from mobile and computer devices.

Advanced Digital Forensic Solutions Inc., a company that has been around since 2006 and a leader in forensic triage and collecting information so that decisions can be made. Solutions! ADF strives to live up to its name by being on the forefront with solutions. Solutions to help make your job easier, your backlog slower, and your overall cost lower. ADF Solutions has done it again by grabbing the reins on AFF4 logical imaging and solving an issue in the community.

Digital forensic investigations can be expensive. The price can range from $2000 to well over $100,000 for forensic tools and training [1].

The most common reasons why digital forensics tends to get expensive are: 

• inexperienced/untrained users
• outdated systems
• challenges with acquiring systems
• systems that don't talk to one another
• timing in the collection or reviewing of evidence
• reporting

ADF digital forensic software and triage software are deployed worldwide by investigators and lab examiners to speed the investigation of mobile phones, tablets, computers, and storage devices. ADF technology software helps digital first responders quickly collect, identify and report on digital evidence - thereby reducing or eliminating forensic backlogs that many agencies and organizations face today.   

Many are not aware of the common threats/investigations that officers, analysts, and investigators face on-scene or in the lab and how computer forensics software can help solve these investigations.

When investigating computer crimes and being called on to conduct computer forensics or forensic phone analysis in the field, it is good to be ready for whatever comes your way. One phrase you commonly hear when talking to anyone in the cybercrime arena is “there has to be more than one tool in the toolbox”, and this is a very true statement, no one tool does it all, and all tools do it slightly differently. You do not use a large Phillips screwdriver to remove a small screw from a picture frame and you do not use an eyeglass screwdriver to remove a wood screw, this is because you know your tools and your toolbox.

VR is an exciting and revolutionary modern technology that is steadily being released to the public, with companies such as Steam, PlayStation, Oculus, HTC, and most recently Meta rapidly releasing content to be consumed by people all over the world. But as with all technological advancements, there are certain risks, dangers, and adversities. As a disclaimer, sensitive topics such as child exploitation and sexual abuse will be mentioned in this article.

When conducting on-scene triage for any type of crime it is essential to be prepared for any devices you may encounter. It is important to pre-plan and try to figure out what type and how many devices you may encounter, but no matter how many times you read the report or conduct pretextual calls your estimate is going to be off. You need to be prepared and have the ability to adapt and overcome.

ADF Solutions has long been the standard in on-scene forensic examination of digital devices for all types of investigations. Our law enforcement customers are routinely called on to handle all types of investigations, including many that are disturbing in nature, such as child exploitation cases. Along with the stressful workload, law enforcement professionals are often portrayed in a negative light. Members of the Law Enforcement community are selflessly helping every day both in and out of the work environment. We would like to showcase the good work being done by the law enforcement community, beginning with ADF's current Digital Forensic Intern and member of the New York State Police (NYSP), Eric Lunser.

ADF Solutions has been committed to the forensic market for well over 15 years and has continually improved its product offerings as we continue to move forward. As a company, we are focused on solutions … it’s even in our name. You’re trying to solve investigations. We’re focused on developing technology solutions that will help you do your job faster with a primary focus of helping you protect victims. A pretty good reason to wake up and go to work each day.

ADF tools have the ability to scan all available Mac computers (M1 and T2 chips) with all types of encryption and virtual drives by running a remote agent that communicates with the desktop application. 

When selecting a new application for use in your lab or out in the field it's always a good idea to shop around and see what’s available to you whether it is new or updated, it is good to take a look around. ADF Solutions has been in the Digital Forensics field for almost 2 decades and has built upon itself to become a leader in the early case assessment and triage market as well as a formidable candidate for the lab when the work needs to be done now. Digital Evidence Investigator (DEI) is our flagship product and a solid forensic application with a lot of functionality and features.

As the world’s financial systems advance in digital technology and cryptocurrency, the need for digital forensics grows greater. The use of blockchain technology has allowed crimes to go undetected through the eyes of a regular investigator. These crimes no longer take months of in-depth planning and deception before executing but can now be committed within minutes because of the processing power of computers and the speed of the internet. Crimes such as:

The 2021 Northwest Regional Internet Crimes Against Children (ICAC) Conference has returned this year. The conference is a multi-state, multi-disciplinary Internet Crimes Against Children event which provides training to prosecutors, digital forensic examiners, sheriffs, police investigators and ICAC Task Force members.  

Dates: October 6-8, 2021

Location: Redmond, WA

In this 3-minute "How To" video, you'll learn the benefits of having a digital forensic triage process that works from field to lab. Using ADF digital forensic tools, examiners can prepare field investigators to find digital evidence and intelligence on mobile phones, tablets, computers, and storage devices starting on-scene. 

Investigators can now scan all available Mac computers (including macs with T2 or M1 chips) with all types of encryption and virtual drives by running a remote agent that communicates with the desktop application. Now you can perform digital forensic triage on all Macs including

• macOS T2 chip
• macOS M1 chip
• Mac Fusion Drive

On-scene, it can be impractical for investigators to seize all the digital devices they locate so investigators that are able to triage on-scene only seize devices with relevant data.

Without digital forensic triage, investigators have to collect every device. 

At the scene of any crime or incident it is important to protect and collect evidence. There are different types of evidence, including physical and digital. ADF Solutions focuses on retrieving digital evidence from devices starting on-scene. 

Digital Forensic Triage is the process of finding digital evidence important for investigations.

As an investigator you want to be prepared to quickly collect evidence on-scene. This means, when performing smartphone forensics, you need to have the best tools to capture the evidence you encounter during your triage, including cloud storage such as Dropbox for iOS. 

ADF launches New Law Enforcement Capabilities to Speed Modern Slavery Investigations  

Bethesda, Maryland: ADF Solutions’ new Anti-Human Trafficking Search Profiles were built in conjunction with the Anti-Human Trafficking Intelligence Initiative (ATII) to help law enforcement quickly identify and investigate human trafficking at the scene of the crime. 

As digital technology becomes more advanced, the potential for its criminal application is magnified. This can result in overwhelming amounts of digital data for law enforcement to inspect in a limited timeframe. Although opportunities to find digital evidence on a perpetrator's or victim's computer may be numerous, the time it takes to search through such vast quantities of data contributes to the issue of growing forensic backlogs. 

ADF’s newest software versions include new field tablet capabilities and smartphone collection features 

ADF Solutions Introduces Field Investigator™ for Teams

There’s a new way to give digital forensic examiners control of investigations and empower non-technical front-line investigators. Meet Field Investigator™ for Teams, the best way to deploy digital forensic triage capabilities to agents for on-scene digital evidence collection and analysis.

It's a known issue that many agencies and departments are facing worldwide; how to fight and reduce backlog to stay up to date on cases so that they don't get stale. It's a serious issue, but we at ADF can show you a few ways to fight in-house forensic backlog with digital forensic triage.

RAM, short for Random Access Memory, is physical hardware that temporarily stores data for quick read and write access. Think of RAM as a scratch pad you use while working; although all the information you need and may refer to is stored in a binder (in this analogy, your hard drive), the information on the scratch pad is what you are using and need right in the moment. With RAM, it is right there for you to access. While RAM helps with the speed and efficiency of the computer, it can all be lost in an instant as it is volatile.

ADF computer triage has long been admired for some of the best digital forensic triage capabilities on the market. Since 2006, ADF digital forensic experts have been building triage tools to empower investigators to quickly collect evidence and on-scene intelligence from computers and digital devices.

In this how-to video, we will cover backing up and scanning encrypted iOS devices. This skill is important to know because encrypted iOS backups return more data than unencrypted backups.

The numbers surrounding pornographic images of children, and the child abuse that creates it, are so staggering that it’s difficult not to be disheartened. According to the National Center for Missing and Exploited Children (NCMEC), their cyber tipline received over 42.9 million reports by November 2018. NCMEC had also reviewed over 267 million images and videos, and identified over 15,800 victims of online child exploitation and abuse.

As communities search for new ways to employ wounded, injured, or ill special operations veterans, there's a new federal government program that offers hope. 

The program which provides financial support for communities seeking to further increase their effectiveness in the fight against child exploitation is run by the U.S. Department of Justice. Communities will benefit in two key ways: 

1. Employ wounded veterans paid for via federal grant money
2. Help communities fight the ever growing battle to stop child exploitation

Looking to add key words on-scene? ADF has you covered. In this how-to video, investigators and analysts will learn how to add keywords directly from the Collection Key. As a digital evidence investigator, ADF provides the ability to create a collection key with or without Search Profiles and add keywords just before the start of a scan.

Our digital forensic specialist knows that as someone who used to go out and execute search warrants and conduct knock and talks, the ability to overcome and adapt on-scene is vital to a successful outcome. In this how-to video, Rich explains how to create a Collection Key without Search Profiles and how to add keywords prior to starting a scan from the Collection Key. 

ADF Solutions Releases New Digital Forensic Software to Power Field Investigations

Triage digital evidence with a single license for smartphones, tablets, and computers

ADF Solutions, the leading provider of automated forensic software for investigators and lab examiners, today announced new software versions for Digital Evidence Investigator^Ⓡ, Triage-Investigator^Ⓡ,  Triage-G2^Ⓡ, and Mobile Device Investigator^Ⓡ software.

ADF Solutions is proud to announce that we have joined forces with Carahsoft, the leading government IT Solutions provider as an authorized reseller of our products.

This blog post will feature our Settings page, and tips and tricks to understanding it. The first thing users will notice on the settings page is the Backed-Up Licenses. This displays all licenses that have been backed up on this computer. When selecting a license it will display all the information pertaining to that license and also enable users to delete the license from the backed up licenses folder. Additionally, the information here can be used when making a support call or using the support portal.

We could have just written a mission statement. Maybe we’d throw in some core values, and hit you with some motivational quotes from great thought leaders. We could have done that, but that’s not the ADF way. ADF is an innovator, so we took those ideas and went further. Meet our Culture Code: a living, breathing set of standards, principles, values, and goals that we put our hearts and souls into as a team, because we are #AllinForensics. 

Our newest How-To video will cover how to image from either the Desktop tool or the USB device (Collection Key) on a Boot and Live Scan. 

When using ADF tools to collect files, either by File Properties, Hashes, or Keywords, ADF tools provide  three methods for file identification:

With ADF digital forensic software tools, it's possible to scan multiple devices simultaneously and have them as part of one scan. However, there are some items we need to keep in mind when preparing to scan multiple devices.

Triage- the word is normally associated with hospitals, where doctors and nurses prioritize patients’ treatments based on the severity of their condition. The concept has been around since the Napoleonic wars and is responsible for saving innumerable lives ever since.

When your case is complete and it comes time to archive your case,  the best method is to archive with the Stand Alone Viewer, located within reporting.

Digital Evidence Investigator is built for front-line field investigators and lab examiners who need to do digital forensic investigations on Mac, Linux, or Windows. Combined with Mobile Device Investigator, Digital Evidence Investigator PRO gives you all the best computer forensic capabilities along with iOS and Android mobile forensics in a single affordable forensic tool. 

In this short video ADF's Digital Forensic Specialist, Rich Frawley, demonstrates the installation process for DEI and DEI PRO, on an offline computer that does not have Internet access. You can refer to our Technical Specifications for minimum requirements and supported Operating Systems.

Digital Evidence Investigator is built for front-line field investigators and lab examiners who need to do digital forensic investigations on Mac, Linux, or Windows. Combined with Mobile Device Investigator, Digital Evidence Investigator PRO gives you all the best computer forensic capabilities along with iOS and Android mobile forensics in a single affordable forensic tool. 

In this short video ADF's Digital Forensic Specialist, Rich Frawley, demonstrates the installation process for DEI and DEI PRO, on a computer that has Internet access. You can refer to our Technical Specifications for minimum requirements and supported Operating Systems.

Digital Evidence Investigator PRO enables front-line field investigators to quickly create an iOS forensic backup of an iOS mobile device on-scene or back in the lab. In this short video, ADF Digital Forensic Training Manager, Rich Frawley, will show you how to easily backup an iOS device with DEI PRO.

Digital Evidence Investigator PRO enables front line field investigators to quickly create a forensic backup of an Android device on-scene or back in the lab. In this short video, ADF Digital Forensic Specialist, Rich Frawley, will show you how to easily backup an Android device with DEI PRO.

Most children in the United States now have access to internet services. The internet enables children to have access to vast amounts of valuable and educative information that facilitates their growth. However, the internet further exposes children to numerous dangers. Some of the risks children are exposed to on the internet include pornography, racist, sexist, violent, and demeaning information.

These risks prompted the formation of the Internet Crimes Against Children (ICAC) Task Force program. The organization is a national network of 61 coordinated task forces that represent over 4,500 local, state, and federal law enforcement and prosecutorial agencies. The state and regional ICAC task forces are maintained and expanded by the ICAC program to address technology-facilitated child exploitation crimes.

ADF digital forensic software including Digital Evidence Investigator^® (DEI) and Triage-Investigator^® come with out-of-the-box default Search Profiles. In this short video tutorial, we use Digital Evidence Investigator to demonstrate "What is a Search Profile?".

In DEI the Search Profiles are maintained in the Setup Scans Menu option. The Search Profile, when run, will collect the information selected within the Search Profile. Search Profiles will run from the desktop application or from the collection key on a Live or Boot scan.

Learn how to conduct a Windows live scan with ADF Solutions Digital Evidence Investigator.  Two USB ports are required to complete a scan, one for the Collection Key and one for the Authentication Key, once the scan has started the Authentication Key can be removed. A USB hub may be used in cases where the target computer only has one USB port. 

When running a live scan from a Collection Key it is possible to create a RAM dump of the computer. RAM dumps can then be analyzed with appropriate software (e.g. Volatility). 

In the early 18th century, triage was used to refer to the action of sorting items according to quality and was taken from the French word trier which means to sort, separate out or cull. 

>> Continue reading or watch the Benefits of Triage webinar recording. 

Join ADF Solutions for a webinar hosted by the National White Collar Crime Center (NW3C), a nonprofit, membership-affiliated organization comprised of state, local, federal and tribal law enforcement and prosecutorial and regulatory agencies.  

NW3C provided a nationwide support system for law enforcement and regulatory agencies involved in prevention, investigation and prosecution of economic and high-tech crime.  Support is delivered via training in computer forensics, cyber and financial crime investigations and intelligence analysis as well as original research on and analytical technical support for investigating and prosecuting white collar and related crimes. 

ADF Solutions Newest Software Release Makes It Easier to Fight Against Child Exploitation

As the leading provider of automated forensic software for investigators and lab examiners, we are delighted to announce the ability for on-scene and lab investigators to rapidly collect media files using Digital Evidence Investigator^Ⓡ, Triage-Investigator^Ⓡ, and Triage-G2^Ⓡ software and export media files to the Griffeye Analyze platform. 

What's the fastest, easiest way to perform RAM Dump? While there are many tools and techniques available to examiners for recovering data from volatile memory, ADF Digital Evidence Investigator^®, Triage-Investigator^®, and Triage-G2^® are fast and easy. 

A simple 2-step process lets even the most non-technical field investigators or highly trained digital forensic examiners quickly perform a RAM capture when running a live scan on the computer from a collection key: 

1. Click "Create RAM Dump" from the main menu
2. The RAM Dump will be saved to the collection key as a .bin file and then zipped

With more than a dozen out-of-the-box Search Profiles inside Digital Evidence Investigator^® (DEI) and all the ADF digital forensic and triage tools, the ADF Digital Forensic team has created software that enables investigators and forensic examiners to capture files, artifacts, and the digital evidence needed in a wide variety of evidence collection situations. 

The investigation began after images consistent with child pornography were uploaded to a social media platform.  A search warrant was executed at the residence and an on-scene forensic exam of all electronic media was completed by members of the State Police Computer Crime Unit.  Using ADF Digital Evidence Investigator^®, investigators discovered images and videos of sexual abuse of an under age child and were able to identify a resident of the household as the suspect. Specifically, investigators located thumbcache images that resulted in identifying a female child that was being sexually abused and identified the suspect.

ADF is helping stop crimes against children by providing law enforcement with the right tools and training to combat internet crimes against children.  As part of our mission to help fight child exploitation, ADF is a returning sponsor of the Crimes Against Children Conference.  If you are attending, join ADF Digital Forensic Specialists (Rich Frawley), as he leads a lecture and lab training for participating law enforcement officers:

• On-Scene Digital Investigation Best Practices: From CyberTip to Court Ready Paperwork (Lecture)
• Solving Crimes Against Children with ADF Digital Evidence Investigator^® (Hands-on Labs)

Each participant will learn digital forensic best practices for child exploitation cases and receive an extended trial of our DEI software. 

Last week, leaders from the military, special operations and industry gathered together in Tampa, Florida for the 2018 Special Operations Forces Industry Conference (SOFIC) and Exhibition.  The event, sponsored by the National Defense Industrial Association (NDIA) emphasized the USSOCOM Commander's vision to "Win - Transform - People" and was joined by international military members from US partner nations.

This week, ADF is sponsoring training for companies and law enforcement agencies that seek to train individuals and teams on computer forensic training.