Custom-search-profiles

ADF's Quick-Saved Credentials profile is a powerful profile that extracts the usernames and passwords from Web Browsers and is built so it will not trigger antivirus applications when attempting to collect web credentials. This makes the investigator's job easier on-scene, requires less interaction with the device, and allows for more records to be parsed thereby giving the computer forensic investigator the ability to quickly collect critical information for their investigation.

Learn how to use the ADF Quick Saved Credentials Profile to uncover Web credentials in this short 2-minute video tutorial. Collecting saved credentials quickly gives access to accounts that may have been previously unknown and allows investigators to do preservation orders and search warrants. 

The ADF Solutions suite of products are designed to get you to the relevant information in your digital forensic investigation, in a short amount of time so that decisions can be made. We at ADF understand that every department, agency, task force, or company is not going to be the same and therefore a cookie cutter approach to collecting the data is not appropriate for the task at hand. Our products, such as Digital Evidence Investigator for computer forensics and Mobile Device Investigator for mobile forensics give you the ability to obtain data from devices with different methods so that you can zero in on your targeted information with speed and accuracy. PRO versions combine both computer and mobile in one product.

There are many ways to learn digital forensics. From Certified Training to short How-To videos designed to teach you skills in just a few minutes. One of our favorite forms of learning, however, is our one-hour digital forensic best practices webinars led by our Director of Training, Richard T. Frawley. Rich spent 22 years in law enforcement. Most of that time was as a digital forensic analyst. Here are some of our favorite learning webinars from this year:

In this 3-minute "How To" video, you'll learn the benefits of having a digital forensic triage process that works from field to lab. Using ADF digital forensic tools, examiners can prepare field investigators to find digital evidence and intelligence on mobile phones, tablets, computers, and storage devices starting on-scene. 

When collecting digital evidence, speed is often the name of the game, such as when you are serving a search warrant, dealing with a mass casualty incident, working a consent search, or trying to ascertain where to focus your efforts when dealing with multiple devices. When dealing with these types of use cases, one-dimensional or one size fits all evidence collection, will not pass muster and you need the ability to cut through the noise and get to the relevant information fast. 

ADF digital forensic software comes with approximately a dozen out-of-the-box default search profiles designed to make it quick and easy for non-technical field investigators to quickly search for digital evidence. 

In this short How To video, you'll learn how to import and export an ADF digital forensic Search Profile. This allows investigators to create a Custom Search Profile on one computer and export it so that it is available to be imported into another installation on another computer so forensic examiners or senior investigators can create and share profiles with:

When making decisions on scene it is critically important for an investigator to scan and analyze the Operating System Drive or Partition, or what is commonly referred to as the C:\ drive. ADF digital forensic software tools give investigators out-of-the-box Search Profiles designed to quickly scan and analyze OS partitions with targeted paths that would not be present on a non OS partition.

If you come across a non OS drive or partition, a storage partition, or external storage drive, instead of using the built-in Comprehensive Search Profiles, you can create a Custom Search Profile for non operating system drives using Digital Evidence Investigator^®. 

Digital Evidence Investigator^® gives investigators the ability to customize Search Profiles and determine exactly what and where you want to look for digital evidence. This is especially convenient when looking to tailor a search for a forensic triage type scan or a targeted collection. This is accomplished by using the Targeted Folders Option when creating a custom file capture.

When conducting an investigation, it is important to be flexible and follow the direction of your investigation with as few obstacles as possible. If your examination brings you a new file type, such as a video generated by a hand held camera, or a proprietary file created by a unique software, you want to be able to search for, or collect these files types right away either on-scene or back in the lab.

Whether you are preparing to go on-scene or you are in your digital forensic lab getting ready to perform triage or one or more digital forensic scans, this video tutorial will show you how you can easily create a keyword capture and add keywords to a Search Profile.  We begin from when you have started to create a Custom Search Profile and want to add your own unique keywords.

ADF software lets investigators and examiners search for files by keyword(s) using substrings or regular expressions.  ADF software allows you to search for keywords in all file and folder names, file content and metadata, and artifact records from other captures.

ADF digital forensic software including Digital Evidence Investigator^® (DEI) and Triage-Investigator^® come with out-of-the-box default Search Profiles. In this short video tutorial, we use Digital Evidence Investigator to demonstrate "What is a Search Profile?".

In DEI the Search Profiles are maintained in the Setup Scans Menu option. The Search Profile, when run, will collect the information selected within the Search Profile. Search Profiles will run from the desktop application or from the collection key on a Live or Boot scan.

Learn how to conduct a Windows live scan with ADF Solutions Digital Evidence Investigator.  Two USB ports are required to complete a scan, one for the Collection Key and one for the Authentication Key, once the scan has started the Authentication Key can be removed. A USB hub may be used in cases where the target computer only has one USB port. 

When running a live scan from a Collection Key it is possible to create a RAM dump of the computer. RAM dumps can then be analyzed with appropriate software (e.g. Volatility). 

Photo Forensics as a term will typically refer either to the profession dedicated to authenticating digital images to determine authenticity, or, it may refer to the capability of digital forensics software to find and identify photos. 

With more than a dozen out-of-the-box Search Profiles inside Digital Evidence Investigator^® (DEI) and all the ADF digital forensic and triage tools, the ADF Digital Forensic team has created software that enables investigators and forensic examiners to capture files, artifacts, and the digital evidence needed in a wide variety of evidence collection situations.