With any of the ADF Mobile products, if you are using the default settings, the mobile backups are being saved to the local drive. The mobile backups can be quite large and quickly fill up your drive leaving you no storage space.
Let’s take a look at how to archive your mobile backups with or without the corresponding scan results.
When conducting digital forensic investigations that involve live (up and running) computers, it is imperative to collect volatile memory so that all your bases covered and so that no vital evidence is lost. A live analysis conducted in the correct manner will yield the results you are looking for in your investigation. It has become commonplace and an accepted practice to collect data from a live computer, especially in cases of child exploitation. ADF software makes it easy for detectives and investigators to perform a RAM capture in the proper manner with as little intrusion as possible.
The number of backlogged digital evidence requests has continued to rise over the years. The total number of backlogged evidence requests was over 570,000 in 2014 and every one of those requests is associated with a case that affects real people. This is why we love forensic triage, and why you should too.
In this 3-minute "How To" video, you'll learn the benefits of having a digital forensic triage process that works from field to lab. Using ADF digital forensic tools, examiners can prepare field investigators to find digital evidence and intelligence on mobile phones, tablets, computers, and storage devices starting on-scene.
Crimes against children investigations can lead CSAM investigators to have to review thousands or even tens of thousands of images. Investigators need tools to help them find relevant evidence quickly.
Today’s investigators and prosecutors are very familiar with the extreme difficulty in child exploitation cases: getting through your forensic backlog to get to the data in time. Law enforcement officers routinely report that a lack of technology which, combined with stringent time limits, can severely restrict their ability to check devices in a timely manner. ADF understands that digital forensic examinations can be both costly and time-consuming, which hampers investigations into suspects that have downloaded or participated in Child Sexual Abuse Material (CSAM).
It's a known issue that many agencies and departments are facing worldwide; how to fight and reduce backlog to stay up to date on cases so that they don't get stale. It's a serious issue, but we at ADF can show you a few ways to fight in-house forensic backlog with digital forensic triage.
RAM, short for Random Access Memory, is physical hardware that temporarily stores data for quick read and write access. Think of RAM as a scratch pad you use while working; although all the information you need and may refer to is stored in a binder (in this analogy, your hard drive), the information on the scratch pad is what you are using and need right in the moment. With RAM, it is right there for you to access. While RAM helps with the speed and efficiency of the computer, it can all be lost in an instant as it is volatile.
ADF computer triage has long been admired for some of the best digital forensic triage capabilities on the market. Since 2006, ADF digital forensic experts have been building triage tools to empower investigators to quickly collect evidence and on-scene intelligence from computers and digital devices.
In this how-to video, we will cover backing up and scanning encrypted iOS devices. This skill is important to know because encrypted iOS backups return more data than unencrypted backups.
The numbers surrounding pornographic images of children, and the child abuse that creates it, are so staggering that it’s difficult not to be disheartened. According to the National Center for Missing and Exploited Children (NCMEC), their cyber tipline received over 42.9 million reports by November 2018. NCMEC had also reviewed over 267 million images and videos, and identified over 15,800 victims of online child exploitation and abuse.
As communities search for new ways to employ wounded, injured, or ill special operations veterans, there's a new federal government program that offers hope.
The program which provides financial support for communities seeking to further increase their effectiveness in the fight against child exploitation is run by the U.S. Department of Justice. Communities will benefit in two key ways:
Looking to add key words on-scene? ADF has you covered. In this how-to video, investigators and analysts will learn how to add keywords directly from the Collection Key. As a digital evidence investigator, ADF provides the ability to create a collection key with or without Search Profiles and add keywords just before the start of a scan.
Our digital forensic specialist knows that as someone who used to go out and execute search warrants and conduct knock and talks, the ability to overcome and adapt on-scene is vital to a successful outcome. In this how-to video, Rich explains how to create a Collection Key without Search Profiles and how to add keywords prior to starting a scan from the Collection Key.
This blog post will feature our Settings page, and tips and tricks to understanding it. The first thing users will notice on the settings page is the Backed-Up Licenses. This displays all licenses that have been backed up on this computer. When selecting a license it will display all the information pertaining to that license and also enable users to delete the license from the backed up licenses folder. Additionally, the information here can be used when making a support call or using the support portal.
Our newest How-To video will cover how to image from either the Desktop tool or the USB device (Collection Key) on a Boot and Live Scan.
When using ADF tools to collect files, either by File Properties, Hashes, or Keywords, ADF tools provide three methods for file identification:
With ADF digital forensic software tools, it's possible to scan multiple devices simultaneously and have them as part of one scan. However, there are some items we need to keep in mind when preparing to scan multiple devices.
Triage- the word is normally associated with hospitals, where doctors and nurses prioritize patients’ treatments based on the severity of their condition. The concept has been around since the Napoleonic wars and is responsible for saving innumerable lives ever since.
When your case is complete and it comes time to archive your case, the best method is to archive with the Stand Alone Viewer, located within reporting.
Software updates are something we look forward to, and when we receive that new download from our go-to tool, it makes the day even more special. When it comes time to upgrade or re-install ADF software, as a user, you do not want your data to be lost after either the software upgrade or when selecting a new Search Profile folder.
When you first start the ADF application you will notice the tool will look to see if any new data needs to be merged or migrated.
With the ever-increasing amount of digital photo evidence, it's nearly impossible for investigators to quickly review photo evidence in a timely manner. Enter ADF Photo Probability for on-scene triage and digital investigations; one of the ways that ADF helps reduce the "noise" in a case and helps you get to the evidence faster.
When making decisions on scene it is critically important for an investigator to scan and analyze the Operating System Drive or Partition, or what is commonly referred to as the C:\ drive. ADF digital forensic software tools give investigators out-of-the-box Search Profiles designed to quickly scan and analyze OS partitions with targeted paths that would not be present on a non OS partition.
If you come across a non OS drive or partition, a storage partition, or external storage drive, instead of using the built-in Comprehensive Search Profiles, you can create a Custom Search Profile for non operating system drives using Digital Evidence Investigator®.
Learn how to quickly scan iOS devices, smartphones or tablets, in this 2 minute short "How To" video created by Rich Frawley, our Director of Digital Forensic Training. Rich will walk you through how to attach and scan an iOS device with Mobile Device Investigator® (MDI) using an iPhone.
Learn how to conduct a Windows live scan with ADF Solutions Digital Evidence Investigator. Two USB ports are required to complete a scan, one for the Collection Key and one for the Authentication Key, once the scan has started the Authentication Key can be removed. A USB hub may be used in cases where the target computer only has one USB port.
When running a live scan from a Collection Key it is possible to create a RAM dump of the computer. RAM dumps can then be analyzed with appropriate software (e.g. Volatility).
If you haven’t yet met Phillip Moore and you’re in the digital forensics or incident response fields, you’re likely to at least know him from one of his top forensic blogs:
In 2009, the number of backlogged digital evidence requests in publicly funded forensic crime labs was 1,600. By the end of 2014, that number had risen to 7,800. While that's tiny in comparison to the total number of backlogged evidence requests (over 570,000 in 2014!), every one of those requests is associated with a case that affects real people. This is why we love forensic triage, and why you should too.
With more than a dozen out-of-the-box Search Profiles inside Digital Evidence Investigator® (DEI) and all the ADF digital forensic and triage tools, the ADF Digital Forensic team has created software that enables investigators and forensic examiners to capture files, artifacts, and the digital evidence needed in a wide variety of evidence collection situations.
The investigation began after images consistent with child pornography were uploaded to a social media platform. A search warrant was executed at the residence and an on-scene forensic exam of all electronic media was completed by members of the State Police Computer Crime Unit. Using ADF Digital Evidence Investigator®, investigators discovered images and videos of sexual abuse of an under age child and were able to identify a resident of the household as the suspect. Specifically, investigators located thumbcache images that resulted in identifying a female child that was being sexually abused and identified the suspect.
