ADF News

ADF Bret: Hi Brett, thanks for taking time to talk! My first question is, what’s with the extra “t”? I’m just kidding of course.  Growing up, one of my best friends spelled his name with two “t”s so we just refer to one another as Brettt so as not to offend one another.   

Brett:     A rose by any other name…

ADF Bret: You’re a digital forensic examiner providing private consulting and training to government agencies and you’ve also found time to write quite a few books, including Placing the Suspect Behind the Keyboard, Hiding Behind the Keyboard, and X-Ways Forensics Practitioner’s Guide, all of which have received nominations for Best Forensic Book of the Year.  How did you get started writing books for the forensic community and what (besides the money and fame) keeps you writing?

Brett:  Much like any author writing forensic books, I wanted to write the books that I wish were already written by someone else. I would have bought them if they already were written! My first two books were published within the same year, so they competed against each other for Best Forensic Book of the Year and the X-Ways book won. That was neat, and certainly having Eric Zimmerman as my co-author helped. I will keep writing books whenever I need a book that hasn’t already been written, so hopefully we get more authors writing books.

Of all the investigations that a law enforcement agency may undertake, there may be none as difficult to deal with as crimes perpetrated against minors. The proliferation of online child exploitation material continues to be an issue worldwide, from child pornography to the facilitation of human trafficking. Luckily, investigators are not having to combat this problem alone thanks to industry solutions like those provided by ADF Solutions and the organizations below.  

Learn how to conduct a Windows live scan with ADF Solutions Digital Evidence Investigator.  Two USB ports are required to complete a scan, one for the Collection Key and one for the Authentication Key, once the scan has started the Authentication Key can be removed. A USB hub may be used in cases where the target computer only has one USB port. 

When running a live scan from a Collection Key it is possible to create a RAM dump of the computer. RAM dumps can then be analyzed with appropriate software (e.g. Volatility). 

If you haven’t yet met Phillip Moore and you’re in the digital forensics or incident response fields, you’re likely to at least know him from one of his top forensic blogs:

January 2019 is National Slavery and Human Trafficking Prevention Month

Human trafficking has been a federal crime in the United States since The Trafficking Victims Protection Act of 2000 was passed into law as a federal statute.  Each year since 2010 has been designated National Slavery and Human Trafficking Prevention Month with January 11th each year being observed as National Human Trafficking Awareness Day. 

During a criminal investigation, prioritizing the evidence is paramount to your success as an investigator. Filtering what is critical to the case and what isn't is the difference between success and failure of an investigation. 

Forensic triage - sometimes referred to as "digital forensic triage" - is the process by which you collect, assemble, analyze, and prioritize digital evidence from a crime or investigation.

It's difficult to do this in a timely manner when you don't have the proper tools. Depending on the type of investigation, it's a process that can involve sorting through mountains of digital data. 

The term triage naturally brings to mind a medical emergency where you need to get in quickly, assess the damage and deal with the most serious problems first. Digital forensic triage has the same application but it's applied to a crime scene or investigation which involves computers or other digital media. Standard forensic methods normally take place in a forensic lab where a trained forensic examiner would perform a complete examination. Digital triage is a front line step in saving time and reaching satisfactory results faster.

The U.S. Department of Justice launched the Internet Crimes Against Children Task Force Program (ICAC Program) in 1998 as part of a national strategy to combat and prevent child exploitation.  ICAC Task Force training is often held annually within regions across the United States.  While 2019 dates have not yet been published, here's a list of 2018 ICAC conferences:

The Florida Internet Crimes Against Children Task Force, along with the Florida Department of Law Enforcement, Child Abduction Response Team (CART) and Offender Registration and Enforcement once again hosted the Florida ICAC Training Symposium. 

23 Industry Events: Network, Learn, Grow

The knowledge and training you can gain at digital forensic conferences around the world can make the difference in crime solving.  In addition to networking, annual conferences are one of the best ways to learn from peers, stay on top of the latest strategies and tactics, get an advance look at industry trends, and they can be a great place to talk face-to-face with digital forensic vendors. In addition to keynotes and lectures, many annual conferences also offer hands-on lab sessions or pre-conference training classes. Below is a list of some of our favorite annual conferences.  

The best tools for rapid digital forensic investigations just got better with ADF's release of new software versions to support the collection of artifacts from macOS Mojave, in addition to macOS High Sierra and Windows. 

ADF's New Forensic Software Empowers Investigators and Prosecutors

ADF Solutions, the leading provider of automated forensic software for investigators and lab examiners, announced today the release of new software versions 1.4 for Digital Evidence Investigator^Ⓡ, and versions 4.4 for Triage-Investigator^Ⓡ, and Triage-G2^Ⓡ software.  

"We are very excited to be the first digital forensic software to parse macOS Mojave log files natively under Windows strengthening our macOS support", stated Raphael Bousquet, CTO, and co-founder of ADF Solutions. "In our world of fast and efficient forensic analysis, we strive to reduce data noise for the investigator. The addition of picture and video classification is a great step in the right direction!"

A precise timeline view links user activities with pictures, videos, and files of interest so investigators can quickly build a digital forensic report to share with prosecutors or other investigators.  The new version leverages enhanced automation and enables investigators to run in-depth digital forensics scans quickly.  The highlights of this new release for the investigative and forensic community include:

While there are many tools and techniques available to examiners for recovering data from volatile memory, ADF Digital Evidence Investigator^®, Triage-Investigator^®, and Triage-G2^® are fast and easy. 

A simple 2-step process lets non-technical investigators and examiners quickly perform a RAM capture when running a live scan on the computer from a collection key: 

1. Click "Create RAM Dump" from the main menu
2. The RAM Dump will be saved to the collection key as a .bin file and then zipped

This October kicks off with the fourth annual Northwest Regional ICAC Conference, a multi-state, multi-disciplinary event designed to provide lecture and lab training to prosecutors, digital forensic examiners, and law enforcement investigators focused on the investigation and prosecution of technology facilitated crimes against children. 

A criminal forensic lab located in one of the largest U.S. Federal agencies was working on an extensive child exploitation case and had seized 37 total hard drives that contained over 38 terabytes of data. The case was high profile and the forensic team had a short window of time to examine the contents of the confiscated drives. Technical resources were limited and imaging drives and conducting traditional forensic examinations would be very time consuming. With the amount of data that needed to be searched, the investigators realized that it could potentially be weeks before the examinations were complete and the case could move forward. In addition the case would require significant disk storage space to hold all of the images.

Join ADF Digital Forensic Specialist, Rich Frawley as he presents "On-Scene Digital Investigation Best Practices: From Search Warrant to Court Ready Paperwork" at the Techno Security & Digital Forensics conference in San Antonio, Texas.  The Techno event is a follow up to the top rated Techno Security & Digital Forensics Myrtle Beach event earlier this year where ADF was a Gold Sponsor.  

Rich Frawley, ADF Digital Forensic Specialist will be presenting "On-Scene Digital Investigation Best Practices: From Search Warrant to Court Ready Paperwork" at the Federal Law Enforcement Training Center in Glynco, Georgia this week.  

Coming off the 30th annual Crimes Against Children Conference in Dallas, Texas, conference organizers announced that the 31st annual conference is scheduled for August 12-15, 2019 at the Sheraton Dallas Hotel.  

This week, hundreds of leading law enforcement officials from the US, Canada and Europe descended on the Omni Shoreham Hotel in Washington, DC to participate in the High Technology Crime Investigation Association's annual conference.   The event featured 72 speakers over the three days of sessions and training and was kicked off with an opening keynote from Chief Superintendent Jeff Adam, C/Supt. DG Technical Investigation Services for the Royal Canadian Mounted Police.

Attend HTCIA Pre-conference Training in Washington, DC on August 19th where we will be hosting two hands-on lab sessions for digital investigators.  Conference attendees arriving early can register to attend one of two sessions:

• Directly Scanning a Suspect's Computer or Devices
• Child Exploitation Investigations Done in Record Time

The High Technology Crime Investigation Association's International Conference (HTCIA) & Training Expo is one of the oldest and most respected technology investigation conferences in the world.  This year, the event will be held in Washington, DC at the historic Omni Shoreham Hotel and will feature an opening keynote from Chief Superintendent Jeff Adam, C/Supt. DG Technical Investigation Services for the Royal Canadian Mounted Police (RMCP). 

Conference sessions include a variety of topics including:

Earlier this year, ADF partnered with Flags of Valor, a company dedicated to serving U.S. military and law enforcement with high quality, handmade wooden wall art. Flags of Valor was founded to provide job opportunities to combat veterans and today the majority of Flags of Valor craftsmen are service-disabled with combat related injuries.

This week, hundreds of cyber security and digital forensic experts gathered in Myrtle Beach, South Carolina to participate in the Techno Security and Digital Forensics Conference. The event hosted at the Marriott Resort & Spa at Grande Dunes offered attendees the ability to receive Continuing Professional Education Credits (CPE) depending on their organization. 

ADF was delighted to sponsor certified forensic examiner training focused on Basic Computer Forensic Examiner (BCFE) training held by the International Association of Computer Investigative Specialists (IACIS) in Orlando, Florida.  The event attracted hundreds of corporate security, university and law enforcement officers from around the United States, as well as various officials from the Department of Defense and federal agencies.

A long, long time ago in a galaxy far far away
(2006 to be exact and the galaxy was Maryland USA)
It was a period of innovation.
Computers, USBs, all kinds of devices ... 
Some people were committing digital crimes
from their seemingly hidden bases in the digital world. 

Here are a few of the highlights of the best parts of the 2018 National Cyber Crime Conference hosted by the Massachusetts Attorney General's Office (AGO) this past week. 

Digital forensic experts understand the importance of remembering to perform a RAM Capture on-scene so as to not leave valuable evidence behind.  Capturing volatile data in a computer's memory dump enables investigators and examiners to do a full memory analysis and access data including:

There are many cases where time is critical in a police investigation. This is increasingly true in a world where digital evidence can be an essential element in capturing a suspect or solving a crime. Digital data can implicate or clear suspects and utilizing digital evidence to your investigative advantage can allow you to act quickly while on-scene.

Starting digital investigations while at the scene has become increasingly important in fluid crime situations such as terrorism threats, active shooter situations, gang activity or sex trafficking. Field digital forensic investigations (a.k.a. field triage) can also be useful in CyberTip investigations or any crime where a digital device may have photos, video, audio, or other data that could be useful in identifying suspects, victims or protecting evidence.

Today, ADF is announcing the release of new digital forensic software versions for our products: 

• Digital Evidence InvestigatorⓇ (DEI) version 1.3.0 
• Triage-InvestigatorⓇ version 4.3.0
• Triage-G2Ⓡ version 4.3.0

This April, ADF will sponsor The National Cyber Crime Conference in Massachusetts, hosted by the Massachusetts Attorney General's Office.  The conference brings together police, prosecutors and forensic examiners from all 50 states, Washington DC, the US Virgin Islands and Puerto Rico, for three days of training designed to help attendees face the challenges posed by digital evidence and technology in criminal investigations.  International law enforcement attendees have come from Canada, Ireland, England as well as Trinidad and Tobago. 

"In summary, I would say DEI is one of the more intuitive tools I've used, because it guides you through your investigation step by step and could easily be used without much training" ...Read the full 2018 Forensic Focus Review of ADF's Digital Evidence Investigator tool.

Join ADF for the First Forensic Forum (F3) Annual Training Workshop being held in the United Kingdom.  F3 provides an open forum for any organizations focused on digital forensics.  

The emphasis of F3 training days and seminars is focused on the technical aspects of digital forensics. Computer technology in all its forms is a fast-moving area, and in order to function effectively, forensic computing analysts are constantly faced with the necessity of updating and expanding their knowledge. The First Forensic Forum aims to provide them with the opportunity to do so by drawing upon the expertise of member organisations. The majority of F3 members are involved in the analysis of computer-based evidence of various types, and some are also authors and manufacturers of forensic computing tools and solutions.

Join ADF at the High Technology Crime Investigation Association Conference for Forensic Investigators and Law Enforcement.  The HTCIA  event will be held in California and features 84 labs and 90 lectures for Investigators, Law Enforcement and Legal professionals. 

Investigators, Police and Legal professionals who stop by the ADF booth will receive a FREE evaluation kit of ADF Digital Evidence Investigator® forensic software. Our latest release of Digital Evidence Investigator software will also be featured in the Vendor Showcase. 

ADF Solutions, a leading provider of digital forensic and media exploitation software, has released Triage-G2, the latest evolution of ADF's award-winning media exploitation tool. Triage-G2 is deployed by special forces, military and intelligence agencies worldwide and has a proven track record of supporting site exploitation missions, including Tactical Media Exploitation, DOMEX, MEDEX, and biometric identity operations.

Designed for nontechnical operators, Triage-G2 employs a simple two-step process to rapidly scan, extract, and analyze critical intelligence from computers and digital devices. The tool can be deployed on existing computing devices and on a small portable USB key that does not require dedicated computer hardware. The collected data can then be easily distributed via portable reports or ingested into data repositories, which include Processing, Exploitation and Dissemination Systems (PED).

ADF Solutions, a leading provider of digital forensic and media exploitation tools, has released Triage-Investigator, the latest evolution of ADF's award-winning digital forensic triage tool designed for field deployment. Triage-Investigator has a proven track record of providing investigators with easy, quick access to court-defendable evidence to process criminal cases.

This 3 day course uses HTCI’s proven hands-on training methods to train the investigator on the forefront of cyber investigations. It provides the investigator a simple USB/DVD deployment method to scan computers.