The National White Collar Crime Center (NW3C) recently kicked off a weekly Digital Forensics and Incident Response (DFIR) Capture the Flag (CTF) competition. Individuals can join the free challenge to hone their digital forensic skills and test their knowledge. 

Knowledge is power. At ADF, we strive to empower our users and prospective users by giving you easy access to free tutorials and knowledge base articles. We’ve received rave reviews for our short How To videos, so we wanted to share another way investigators can get support - the ADF Knowledge Base. 

It's a known issue that many agencies and departments are facing worldwide; how to fight and reduce backlog to stay up to date on cases so that they don't get stale. It's a serious issue, but we at ADF can show you a few ways to fight in-house backlog with digital forensic triage.

How We Lead

Our mentality at ADF is that in order to grow as a company, and as human beings (who doesn’t want to get better?), everyone has to find ways to both lead and learn. ADF’s co-founders led the way by developing DOMEX and digital forensic triage tools 15 years ago.

Putting Victims First. That’s the message that Richard W. Brown, the CEO of Project VIC International impressed upon me when I had the opportunity to speak to him about how and why he helped found the non-profit organization which helps law enforcement agencies around the world fight child exploitation. 

As the COVID-19 virus spreads around the world, ADF Solutions has been working to respond with urgency and empathy. Our top priority is the health and safety of our team members, customers, partners, prospects and everyone’s families. 

You first met LEO in September 2018 when ADF shared an announcement about the upcoming Crimes Against Children Conference in Dallas, Texas. We came up with the idea of LEO one day when our team was sharing stories about the many successes our Law Enforcement customers were having using our digital forensic software to quickly solve crimes. 

RAM, short for Random Access Memory, is physical hardware that temporarily stores data for quick read and write access. Think of RAM as a scratch pad you use while working; although all the information you need and may refer to is stored in a binder (in this analogy, your hard drive), the information on the scratch pad is what you are using and need right in the moment. With RAM, it is right there for you to access. While RAM helps with the speed and efficiency of the computer, it can all be lost in an instant as it is volatile.

The Child Abuse Image Database (CAID) is the United Kingdom’s national system used by law enforcement to help fight the growing problem of Child Sexual Abuse Material (CSAM). The system helps police detect, flag and analyse illegal digital media images. 

With the spread of COVID-19 the last few weeks have been challenging to say the least. There has been a lot of information to digest, a lot of opinions to muddle through, and now many disruptions to our daily lives. And now, millions more people are working from home. 

The inaugural conference for Virginia police, sheriffs, prosecutors, digital forensics investigators, and cybercrime specialists was held last week at James Madison University in Harrisonburg, VA. The first-ever CIIFER conference (which stands for Cyber-attacks, Internet Investigations, Forensic Analysis, and Electronic Records) featured training from industry professionals, university professors, and Commonwealth attorneys. 

Gina: Charissa, thank you for taking the time to chat with me. As a young female in business, your work ethic and drive have been an inspiration! What advice would you give to young women who want to succeed in the workplace?

ADF is delighted to announce the work we did with the 114th Partnership to create a new Spark 101 STEM Skills video titled "Computational Thinking in Forensic Software Development." The video highlights careers in the digital forensics field and is available as a free resource to teachers seeking to foster students' interest in careers in STEM:

Child pornography- more properly identified as Child Sexual Abuse Material (CSAM). It’s appalling that there is a need for a definition for this kind of material. U.S. Federal Law defines child pornography as any visual depiction of sexually explicit conduct involving a minor- meaning any person less than 18 years old. 

Nearly 1,000 homicide investigators from across California gathered this week at the 51st annual California Homicide Investigator (CHIA) Conference in Las Vegas, Nevada. The 3-day training event, sponsored by ADF, featured case presentations and investigator training from leading prosecutors and investigators. 

ADF computer triage has long been admired for some of the best digital forensic triage capabilities on the market. Since 2006, ADF digital forensic experts have been building triage tools to empower investigators to quickly collect evidence and on-scene intelligence from computers and digital devices.

In this how-to video, we will cover backing up and scanning encrypted iOS devices. This skill is important to know because encrypted iOS backups return more data than unencrypted backups.

Looking to add key words on-scene? ADF has you covered. In this how-to video, investigators and analysts will learn how to add keywords directly from the Collection Key.

Our digital forensic specialist knows that as someone who used to go out and execute search warrants and conduct knock and talks, the ability to overcome and adapt on-scene is vital to a successful outcome. In this how-to video, Rich explains how to create a Collection Key without Search Profiles and how to add keywords prior to starting a scan from the Collection Key. 

ADF Solutions Releases New Digital Forensic Software to Power Field Investigations

Triage digital evidence with a single license for smartphones, tablets, and computers

ADF Solutions, the leading provider of automated forensic software for investigators and lab examiners, today announced new software versions for Digital Evidence Investigator^Ⓡ, Triage-Investigator^Ⓡ,  Triage-G2^Ⓡ, and Mobile Device Investigator^Ⓡ software.

This blog post will feature our Settings page, and tips and tricks to understanding it. The first thing users will notice on the settings page is the Backed-Up Licenses. This displays all licenses that have been backed up on this computer. When selecting a license it will display all the information pertaining to that license and also enable users to delete the license from the backed up licenses folder. Additionally, the information here can be used when making a support call or using the support portal.

The Massachusetts Attorney General's Office (AGO) has announced the dates for the 2020 National Cyber Crime Conference (MASS.gov).

This year's conference will be held from April 27-29, 2020 in Norwood, Massachusetts, thanks to the efforts of Attorney General Maura Healey, the National White Collar Crime Center (NW3C), SEARCH, and the National Attorneys General Training and Research Institute. 

This conference brings together police, prosecutors and forensic examiners from all 50 states, Washington DC, the US Virgin Islands and Puerto Rico, for three days of training designed to help attendees face the challenges posed by digital evidence and technology in criminal investigations.  International law enforcement attendees have come from Canada, Ireland, England as well as Trinidad and Tobago. 

ADF plans on attending. Will you join us there? 

Our newest How-To video will cover how to image from either the Desktop tool or the USB device (Collection Key) on a Boot and Live Scan. 

When using ADF tools to collect files, either by File Properties, Hashes, or Keywords, ADF tools provide  three methods for file identification:

Software updates are something we look forward to, and when we receive that new download from our go-to tool, it makes the day even more special.  When it comes time to upgrade or re-install ADF software, as a user, you do not want your data to be lost after either the software upgrade or when selecting a new Search Profile folder.

When you first start the ADF application you will notice the tool will look to see if any new data needs to be merged or migrated.

Mobile Device Investigator (MDI) is the leading digital forensic triage tool for iOS and Android devices. In this short "How To" video, ADF's digital forensic specialist and trainer, Rich Frawley, will show you how to create a Search Profile with MDI. 

ADF Authorized Partner, CBIT Digital Forensic Services (CDFS) hosted the company's 4th annual Vendor Day at the Realm Hotel in Barton, Canberra on November 6, 2019. The event featured presentations by leading digital forensic vendors including ADF's Co-Founder and Chief Evangelist, J.J. Wallia. 

ADF's digital forensic team will be participating in the First Forensic Forum (F3) annual conference and training workshop. The 19th annual event will take place November 12-14, 2019 in Birmingham, United Kingdom. 

The U.S. Department of Justice launched the ICAC Task Force program in 1998 to help law enforcement learn how to prevent, combat and investigate Internet Crimes Against Children.  ICAC Task Force training is often held annually within regions across the United States. 

The 2020 ICAC conferences are announced each year and include training and events held in:

The 2020 Northwest Regional ICAC Conference, has been announced for October 5-9, 2020. The conference is a multi-state, multi-disciplinary Internet Crimes Against Children event which provides training to prosecutors, digital forensic examiners, sheriffs, police investigators and ICAC Task Force members.  

The 2020 Crimes Against Children Conference in Dallas, Texas, will be the 32nd annual conference organized by the Dallas Children's Advocacy Center and the Dallas Police Department. The event will be held at the Sheraton Dallas Hotel on August 10-13, 2020.   

October 2019 kicks off with the 5th Annual Northwest Regional ICAC Conference, a multi-state, multi-disciplinary event designed to provide lecture and lab training to prosecutors, digital forensic lab examiners, and law enforcement investigators focused on the investigation and prosecution of technology and Internet facilitated crimes against children. 

In this short 5 minute video, you'll learn how to filter digital forensic scan results in ADF software. Filtering is available in any table while analyzing any of your scan results. In this how-to video, we'll look at:

Investigators can leverage ADF digital forensic software on the front-line to investigate and prosecute child exploitation cases

Learn how to quickly scan an iOS smartphone or tablet device in this 2 minute short "How To" video created by Rich Frawley, our Digital Forensic Specialist and Trainer.  Rich will walk you through how to attach and scan an iOS device with Mobile Device Investigator® (MDI) using an iPhone 7.

This week, nearly 1,000 law enforcement professionals from across the United States and around the world are meeting in Jacksonville, Florida for to discuss and discover new technologies designed to promote public safety, police safety and policing techniques. 

As you get started performing a logical forensic acquisition of an Android device with Mobile Device Investigator®, you will want to learn how to attach an Android device to your forensic computer. This short video will show you how you can quickly and easily collect digital forensic evidence from Android phones and tablets. 

The 2019 Techno Security & Digital Forensics Conference in Myrtle Beach, South Carolina will take place June 2-5 at the Marriott Resort & Spa at Grande Dunes.  Attendees will have the ability to receive Continuing Professional Education Credits (CPE) depending on their organization. 

Nearly 1,000 attendees are expected to attend with more than 100 sessions by about as many speakers.  We recommend you select the full conference pass which gives you access to the keynote address, all sessions, the exhibit hall (50+ exhibitors) and networking receptions, breakfast and refreshment breaks on Monday, Tuesday and Wednesday as well as lunch on Monday and Tuesday.  

With a record number of attendees, speakers and exhibitors, the 2019 National Cyber Crime Conference organized by Massachusetts Attorney General Maura Healey's office this past week was a huge success with law enforcement professionals from 38 states, Canada, the UK and Africa. 

The NCCC event was especially important to ADF since it's our first major conference of the year and it's where we officially launched our new Mobile Device Investigator™ for iOS and Android investigations.  Our launch featured a demo by our digital forensic specialist, Rich Frawley who joined ADF after 22 years in law enforcement. 

If you're headed to the 2019 National Cyber Crime Conference in Noorwood, MA next week please make time to stop by the ADF Solutions booth to say hello and to enter our drawing for a US combat veteran, handmade keepsake from a Flag of Valor for your home or forensic lab.

Rich Frawley, our Digital Forensic Specialist, who spent 22 years in law enforcement will be leading 3 digital forensic training sessions:

• Solving Crimes Against Children with Digital Evidence Investigator (In the NW3C Lab)
• Introducing ADF Mobile Device Investigator (iOS & Android)
• On-Scene Digital Investigation Best Practices: from CyberTip to Court-Ready Paperwork

ADF Bret: Hi Brett, thanks for taking time to talk! My first question is, what’s with the extra “t”? I’m just kidding of course.  Growing up, one of my best friends spelled his name with two “t”s so we just refer to one another as Brettt so as not to offend one another.   

Brett:     A rose by any other name…

ADF Bret: You’re a digital forensic examiner providing private consulting and training to government agencies and you’ve also found time to write quite a few books, including Placing the Suspect Behind the Keyboard, Hiding Behind the Keyboard, and X-Ways Forensics Practitioner’s Guide, all of which have received nominations for Best Forensic Book of the Year.  How did you get started writing books for the forensic community and what (besides the money and fame) keeps you writing?

Brett:  Much like any author writing forensic books, I wanted to write the books that I wish were already written by someone else. I would have bought them if they already were written! My first two books were published within the same year, so they competed against each other for Best Forensic Book of the Year and the X-Ways book won. That was neat, and certainly having Eric Zimmerman as my co-author helped. I will keep writing books whenever I need a book that hasn’t already been written, so hopefully we get more authors writing books.

Of all the investigations that a law enforcement agency may undertake, there may be none as difficult to deal with as crimes perpetrated against minors. The proliferation of online child exploitation material continues to be an issue worldwide, from child pornography to the facilitation of human trafficking. Luckily, investigators are not having to combat this problem alone thanks to industry solutions like those provided by ADF Solutions and the organizations below.  

Learn how to conduct a Windows live scan with ADF Solutions Digital Evidence Investigator.  Two USB ports are required to complete a scan, one for the Collection Key and one for the Authentication Key, once the scan has started the Authentication Key can be removed. A USB hub may be used in cases where the target computer only has one USB port. 

When running a live scan from a Collection Key it is possible to create a RAM dump of the computer. RAM dumps can then be analyzed with appropriate software (e.g. Volatility). 

If you haven’t yet met Phillip Moore and you’re in the digital forensics or incident response fields, you’re likely to at least know him from one of his top forensic blogs:

January 2019 is National Slavery and Human Trafficking Prevention Month

Human trafficking has been a federal crime in the United States since The Trafficking Victims Protection Act of 2000 was passed into law as a federal statute.  Each year since 2010 has been designated National Slavery and Human Trafficking Prevention Month with January 11th each year being observed as National Human Trafficking Awareness Day. 

During a criminal investigation, prioritizing the evidence is paramount to your success as an investigator. Filtering what is critical to the case and what isn't is the difference between success and failure of an investigation. 

Forensic triage - sometimes referred to as "digital forensic triage" - is the process by which you collect, assemble, analyze, and prioritize digital evidence from a crime or investigation.

It's difficult to do this in a timely manner when you don't have the proper tools. Depending on the type of investigation, it's a process that can involve sorting through mountains of digital data. 

The term triage naturally brings to mind a medical emergency where you need to get in quickly, assess the damage and deal with the most serious problems first. Digital forensic triage has the same application but it's applied to a crime scene or investigation which involves computers or other digital media. Standard forensic methods normally take place in a forensic lab where a trained forensic examiner would perform a complete examination. Digital triage is a front line step in saving time and reaching satisfactory results faster.

The U.S. Department of Justice launched the Internet Crimes Against Children Task Force Program (ICAC Program) in 1998 as part of a national strategy to combat and prevent child exploitation.  ICAC Task Force training is often held annually within regions across the United States.  While 2019 dates have not yet been published, here's a list of 2018 ICAC conferences:

The Florida Internet Crimes Against Children Task Force, along with the Florida Department of Law Enforcement, Child Abduction Response Team (CART) and Offender Registration and Enforcement once again hosted the Florida ICAC Training Symposium. 

23 Industry Events: Network, Learn, Grow

The knowledge and training you can gain at digital forensic conferences around the world can make the difference in crime solving.  In addition to networking, annual conferences are one of the best ways to learn from peers, stay on top of the latest strategies and tactics, get an advance look at industry trends, and they can be a great place to talk face-to-face with digital forensic vendors. In addition to keynotes and lectures, many annual conferences also offer hands-on lab sessions or pre-conference training classes. Below is a list of some of our favorite annual conferences.  

The best tools for rapid digital forensic investigations just got better with ADF's release of new software versions to support the collection of artifacts from macOS Mojave, in addition to macOS High Sierra and Windows. 

ADF's New Forensic Software Empowers Investigators and Prosecutors

ADF Solutions, the leading provider of automated forensic software for investigators and lab examiners, announced today the release of new software versions 1.4 for Digital Evidence Investigator^Ⓡ, and versions 4.4 for Triage-Investigator^Ⓡ, and Triage-G2^Ⓡ software.  

"We are very excited to be the first digital forensic software to parse macOS Mojave log files natively under Windows strengthening our macOS support", stated Raphael Bousquet, CTO, and co-founder of ADF Solutions. "In our world of fast and efficient forensic analysis, we strive to reduce data noise for the investigator. The addition of picture and video classification is a great step in the right direction!"

A precise timeline view links user activities with pictures, videos, and files of interest so investigators can quickly build a digital forensic report to share with prosecutors or other investigators.  The new version leverages enhanced automation and enables investigators to run in-depth digital forensics scans quickly.  The highlights of this new release for the investigative and forensic community include:

While there are many tools and techniques available to examiners for recovering data from volatile memory, ADF Digital Evidence Investigator^®, Triage-Investigator^®, and Triage-G2^® are fast and easy. 

A simple 2-step process lets non-technical investigators and examiners quickly perform a RAM capture when running a live scan on the computer from a collection key: 

1. Click "Create RAM Dump" from the main menu
2. The RAM Dump will be saved to the collection key as a .bin file and then zipped

This October kicks off with the fourth annual Northwest Regional ICAC Conference, a multi-state, multi-disciplinary event designed to provide lecture and lab training to prosecutors, digital forensic examiners, and law enforcement investigators focused on the investigation and prosecution of technology facilitated crimes against children. 

A criminal forensic lab located in one of the largest U.S. Federal agencies was working on an extensive child exploitation case and had seized 37 total hard drives that contained over 38 terabytes of data. The case was high profile and the forensic team had a short window of time to examine the contents of the confiscated drives. Technical resources were limited and imaging drives and conducting traditional forensic examinations would be very time consuming. With the amount of data that needed to be searched, the investigators realized that it could potentially be weeks before the examinations were complete and the case could move forward. In addition the case would require significant disk storage space to hold all of the images.

Join ADF Digital Forensic Specialist, Rich Frawley as he presents "On-Scene Digital Investigation Best Practices: From Search Warrant to Court Ready Paperwork" at the Techno Security & Digital Forensics conference in San Antonio, Texas.  The Techno event is a follow up to the top rated Techno Security & Digital Forensics Myrtle Beach event earlier this year where ADF was a Gold Sponsor.  

Rich Frawley, ADF Digital Forensic Specialist will be presenting "On-Scene Digital Investigation Best Practices: From Search Warrant to Court Ready Paperwork" at the Federal Law Enforcement Training Center in Glynco, Georgia this week.  

Coming off the 30th annual Crimes Against Children Conference in Dallas, Texas, conference organizers announced that the 31st annual conference is scheduled for August 12-15, 2019 at the Sheraton Dallas Hotel.  

This week, hundreds of leading law enforcement officials from the US, Canada and Europe descended on the Omni Shoreham Hotel in Washington, DC to participate in the High Technology Crime Investigation Association's annual conference.   The event featured 72 speakers over the three days of sessions and training and was kicked off with an opening keynote from Chief Superintendent Jeff Adam, C/Supt. DG Technical Investigation Services for the Royal Canadian Mounted Police.

Attend HTCIA Pre-conference Training in Washington, DC on August 19th where we will be hosting two hands-on lab sessions for digital investigators.  Conference attendees arriving early can register to attend one of two sessions:

• Directly Scanning a Suspect's Computer or Devices
• Child Exploitation Investigations Done in Record Time

The High Technology Crime Investigation Association's International Conference (HTCIA) & Training Expo is one of the oldest and most respected technology investigation conferences in the world.  This year, the event will be held in Washington, DC at the historic Omni Shoreham Hotel and will feature an opening keynote from Chief Superintendent Jeff Adam, C/Supt. DG Technical Investigation Services for the Royal Canadian Mounted Police (RMCP). 

Conference sessions include a variety of topics including:

Earlier this year, ADF partnered with Flags of Valor, a company dedicated to serving U.S. military and law enforcement with high quality, handmade wooden wall art. Flags of Valor was founded to provide job opportunities to combat veterans and today the majority of Flags of Valor craftsmen are service-disabled with combat related injuries.

This week, hundreds of cyber security and digital forensic experts gathered in Myrtle Beach, South Carolina to participate in the Techno Security and Digital Forensics Conference. The event hosted at the Marriott Resort & Spa at Grande Dunes offered attendees the ability to receive Continuing Professional Education Credits (CPE) depending on their organization. 

ADF was delighted to sponsor certified forensic examiner training focused on Basic Computer Forensic Examiner (BCFE) training held by the International Association of Computer Investigative Specialists (IACIS) in Orlando, Florida.  The event attracted hundreds of corporate security, university and law enforcement officers from around the United States, as well as various officials from the Department of Defense and federal agencies.

A long, long time ago in a galaxy far far away
(2006 to be exact and the galaxy was Maryland USA)
It was a period of innovation.
Computers, USBs, all kinds of devices ... 
Some people were committing digital crimes
from their seemingly hidden bases in the digital world. 

Here are a few of the highlights of the best parts of the 2018 National Cyber Crime Conference hosted by the Massachusetts Attorney General's Office (AGO) this past week. 

Digital forensic experts understand the importance of remembering to perform a RAM Capture on-scene so as to not leave valuable evidence behind.  Capturing volatile data in a computer's memory dump enables investigators and examiners to do a full memory analysis and access data including:

There are many cases where time is critical in a police investigation. This is increasingly true in a world where digital evidence can be an essential element in capturing a suspect or solving a crime. Digital data can implicate or clear suspects and utilizing digital evidence to your investigative advantage can allow you to act quickly while on-scene.

Starting digital investigations while at the scene has become increasingly important in fluid crime situations such as terrorism threats, active shooter situations, gang activity or sex trafficking. Field digital forensic investigations (a.k.a. field triage) can also be useful in CyberTip investigations or any crime where a digital device may have photos, video, audio, or other data that could be useful in identifying suspects, victims or protecting evidence.

Today, ADF is announcing the release of new digital forensic software versions for our products: 

• Digital Evidence InvestigatorⓇ (DEI) version 1.3.0 
• Triage-InvestigatorⓇ version 4.3.0
• Triage-G2Ⓡ version 4.3.0

This April, ADF will sponsor The National Cyber Crime Conference in Massachusetts, hosted by the Massachusetts Attorney General's Office.  The conference brings together police, prosecutors and forensic examiners from all 50 states, Washington DC, the US Virgin Islands and Puerto Rico, for three days of training designed to help attendees face the challenges posed by digital evidence and technology in criminal investigations.  International law enforcement attendees have come from Canada, Ireland, England as well as Trinidad and Tobago. 

"In summary, I would say DEI is one of the more intuitive tools I've used, because it guides you through your investigation step by step and could easily be used without much training" ...Read the full 2018 Forensic Focus Review of ADF's Digital Evidence Investigator tool.

Join ADF for the First Forensic Forum (F3) Annual Training Workshop being held in the United Kingdom.  F3 provides an open forum for any organizations focused on digital forensics.  

The emphasis of F3 training days and seminars is focused on the technical aspects of digital forensics. Computer technology in all its forms is a fast-moving area, and in order to function effectively, forensic computing analysts are constantly faced with the necessity of updating and expanding their knowledge. The First Forensic Forum aims to provide them with the opportunity to do so by drawing upon the expertise of member organisations. The majority of F3 members are involved in the analysis of computer-based evidence of various types, and some are also authors and manufacturers of forensic computing tools and solutions.

Join ADF at the High Technology Crime Investigation Association Conference for Forensic Investigators and Law Enforcement.  The HTCIA  event will be held in California and features 84 labs and 90 lectures for Investigators, Law Enforcement and Legal professionals. 

Investigators, Police and Legal professionals who stop by the ADF booth will receive a FREE evaluation kit of ADF Digital Evidence Investigator® forensic software. Our latest release of Digital Evidence Investigator software will also be featured in the Vendor Showcase. 

ADF Solutions, a leading provider of digital forensic and media exploitation software, has released Triage-G2, the latest evolution of ADF's award-winning media exploitation tool. Triage-G2 is deployed by special forces, military and intelligence agencies worldwide and has a proven track record of supporting site exploitation missions, including Tactical Media Exploitation, DOMEX, MEDEX, and biometric identity operations.

Designed for nontechnical operators, Triage-G2 employs a simple two-step process to rapidly scan, extract, and analyze critical intelligence from computers and digital devices. The tool can be deployed on existing computing devices and on a small portable USB key. The collected data can then be easily distributed via portable reports or ingested into data repositories, which include Processing, Exploitation and Dissemination Systems (PED).

ADF Solutions, a leading provider of digital forensic and media exploitation tools, has released Triage-Investigator, the latest evolution of ADF's award-winning digital forensic triage tool designed for field deployment. Triage-Investigator has a proven track record of providing investigators with easy, quick access to court-defendable evidence to process criminal cases.

This 3 day course uses HTCI’s proven hands-on training methods to train the investigator on the forefront of cyber investigations. It provides the investigator a simple USB/DVD deployment method to scan computers.