How-to-video

Mac Triage just got a whole lot easier.

With each new release by a Mobile OS developer comes changes that affect the way the data is obtained from these devices, with the release of iOS 16 by Apple, there were some major changes.

Advanced Digital Forensic Solutions Inc., a company that has been around since 2006 and a leader in forensic triage and collecting information so that decisions can be made. Solutions! ADF strives to live up to its name by being on the forefront with solutions. Solutions to help make your job easier, your backlog slower, and your overall cost lower. ADF Solutions has done it again by grabbing the reins on AFF4 logical imaging and solving an issue in the community.

When conducting on-scene triage for any type of crime it is essential to be prepared for any devices you may encounter. It is important to pre-plan and try to figure out what type and how many devices you may encounter, but no matter how many times you read the report or conduct pretextual calls your estimate is going to be off. You need to be prepared and have the ability to adapt and overcome.

ADF's Quick-Saved Credentials profile is a powerful profile that extracts the usernames and passwords from Web Browsers and is built so it will not trigger antivirus applications when attempting to collect web credentials. This makes the investigator's job easier on-scene, requires less interaction with the device, and allows for more records to be parsed thereby giving the computer forensic investigator the ability to quickly collect critical information for their investigation.

Learn how to use the ADF Quick Saved Credentials Profile to uncover Web credentials in this short 2-minute video tutorial. Collecting saved credentials quickly gives access to accounts that may have been previously unknown and allows investigators to do preservation orders and search warrants. 

ADF tools have the ability to scan all available Mac computers (M1 and T2 chips) with all types of encryption and virtual drives by running a remote agent that communicates with the desktop application. 

Welcome! You have a requirement or need and decided to evaluate one of the ADF products for your computer forensic, mobile forensic, or triage workflows. You have observed the videos and have most likely been through a demonstration or two and have a better understanding of the functionality you are looking for. We here at ADF Solutions want to make sure you get the most out of your evaluation, and that starts with a smooth transition to the evaluation phase.

With any of the ADF Mobile products, if you are using the default settings, the mobile backups are being saved to the local drive. The mobile backups can be quite large and quickly fill up your drive leaving you no storage space.

Let’s take a look at how to archive your mobile backups with or without the corresponding scan results.

Investigating crimes against children has been at the forefront of law enforcement’s initiatives to dedicate the specialized manpower and equipment in order to battle this issue. It is not an easy issue to tackle as it manifests in many different ways and sometimes requires three or more specialized units working together to bring the offenders to justice and then another specialized unit to manage the offenders after release. On top of all the investigation time, we add digital devices to the mix, used to commit and perpetrate these crimes. When it comes time to conduct a search warrant, knock and talk, interview, or victim/witness statement, investigators need a solution to find the relevant data, minimize the number of devices brought back to the lab, minimize the impact to victims, witnesses, and innocent family members. 

When conducting digital forensic investigations that involve live (up and running) computers, it is imperative to collect volatile memory so that all your bases covered and so that no vital evidence is lost.  A live analysis conducted in the correct manner will yield the results you are looking for in your investigation.  It has become commonplace and an accepted practice to collect data from a live computer, especially in cases of child exploitation. ADF software makes it easy for detectives and investigators to perform a RAM capture in the proper manner with as little intrusion as possible.

Within ADF software and forensic triage products, including Digital Evidence Investigator, Triage-Investigator, or Triage-G2, an investigator can quickly find Dark Web traces. This can be done in Quick Profiles but in this video, Rich Frawley shows how to use an Intermediate Profile to triage a suspect machine to identify Dark Web traces. These can be found in ADF's Anti-Forensic Traces Capture. 

In this 3-minute "How To" video, you'll learn the benefits of having a digital forensic triage process that works from field to lab. Using ADF digital forensic tools, examiners can prepare field investigators to find digital evidence and intelligence on mobile phones, tablets, computers, and storage devices starting on-scene. 

The Encrypt backup feature in iTunes locks and encodes your information. In this short How To video, Director of Training, Rich Frawley shows investigators how to remove the known iTunes backup password, if required.

Investigators can now scan all available Mac computers (including macs with T2 or M1 chips) with all types of encryption and virtual drives by running a remote agent that communicates with the desktop application. Now you can perform digital forensic triage on all Macs including

• macOS T2 chip
• macOS M1 chip
• Mac Fusion Drive

Crimes against children investigations can lead CSAM investigators to have to review thousands or even tens of thousands of images. Investigators need tools to help them find relevant evidence quickly. 

ADF Solutions mobile phone forensic software makes it easier to quickly collect digital evidence from smartphones and tablets with the Digital Forensic screenshot feature in Mobile Device Investigator or ADF PRO tools. 

As an investigator you want to be prepared to quickly collect evidence on-scene. This means, when performing smartphone forensics, you need to have the best tools to capture the evidence you encounter during your triage, including cloud storage such as Dropbox for iOS. 

Regular Expressions - (also known as "regex") are special strings representing a pattern to be matched in a search operation and they can be particularly useful in mobile and computer forensics investigations. 

One of the ways we allow investigators to find and focus on relevant evidence is by allowing investigators to customize and bring in a unique set of keywords using a substring or with regular expressions. ADF forensic tools also implement regular expression keywords in our trace captures and keyword lists. So why are Regular Expressions different from using regular keywords?

ADF digital forensic software is known for rapid file and artifact collection but we're also widely respected for our seamless user interface. No matter whether you are using Mobile Device Investigator, Triage-Investigator, Triage-G2, Digital Evidence Investigator or our PRO tools, ADF tools are designed to make it easy for investigators to quickly determine what to scan and how to scan it. 

Speeding your investigations has always been a primary focus for ADF Solutions and with the launch of ADF Mobile Preview capabilities, you can start looking at phone content immediately without waiting for a backup or imaging to finish. 

When collecting digital evidence, speed is often the name of the game, such as when you are serving a search warrant, dealing with a mass casualty incident, working a consent search, or trying to ascertain where to focus your efforts when dealing with multiple devices. When dealing with these types of use cases, one-dimensional or one size fits all evidence collection, will not pass muster and you need the ability to cut through the noise and get to the relevant information fast. 

Getting ready to work off site, out of the lab, out of your office, and in someone else's domain is never an easy task. Whether it's a search warrant, in a client's office, suspect's residence, or some other off-site location, being prepared is the key to your success as a digital forensic investigator.

Intelligence gathering is a discipline that's on a different playing field than your typical law enforcement search warrant or forensic triage examination. ADF's Triage-G2 and Triage-G2 PRO enable military field operatives to rapidly collect and exploit captured equipment, media and documents in theaters of operation around the world and reduce time on target for:

ADF prioritizes digital evidence collection and provides investigators and examiners post-scan options to speed investigations. Post scan options let digital forensic investigators get fast and relevant evidence to make decisions on-scene and in the forensic lab.

Are you ready for a big one? Anticipating what your evidence collection needs will be while you are on-scene includes trying to ascertain how many electronic devices you will encounter. ADF makes it easy for you to be prepared. 

Anyone who is charged with a "knock and talk" or executing a search warrant knows that the ability to overcome and adapt on-scene is vital to a successful outcome. This is what drove ADF to empower investigators to be able to create a digital evidence Collect

ion Key (CKY). 

Learn how to easily remove CSAM images and other properties from view

One of the most important factors in a child exploitation investigation, is having the ability to show a report to a colleague, co-worker, prosecutor, or present to present your findings in court without re-victimizing the subject of the photo, or shocking the sense of the viewer of the report. Having a professional report that still reflects the properties that need to be presented is essential to your case.

Digital Forensic Investigators and Examiners need to be able to find evidence quickly and one of the ways that ADF provides this capability is using PhotDNA. 

In this short digital forensic How To video, Digital Forensic Specialist, Rich Frawley, walks you through the best settings for Mobile Device Investigator^®.  Learn how to choose the best Search Profile Capture selection and how to decipher which captures will get you the information you need for your investigation with our mobile phone forensic software. 

The ADF digital forensic screenshots feature enables frontline investigators to capture screenshots from any connected iOS or Android mobile device. This feature is useful for investigators who need to capture data that may not be included in a backup or to capture how a particular mobile app or screen appears to the user.

Learn how to use the ADF Quick Saved Credentials Profile to uncover Web credentials in this short video tutorial. Collecting saved credentials quickly gives investigators access to accounts that may have previously been unknown and allows investigators to request preservation orders and search warrants.  

ADF's Quick - Saved Credentials profile is a powerful digital forensic triage profile that extracts the usernames and passwords from Web Browsers. It is the only Search Profile that may trigger the anti-virus on the machine.

It's a known issue that many agencies and departments are facing worldwide; how to fight and reduce backlog to stay up to date on cases so that they don't get stale. It's a serious issue, but we at ADF can show you a few ways to fight in-house forensic backlog with digital forensic triage.

ADF computer triage has long been admired for some of the best digital forensic triage capabilities on the market. Since 2006, ADF digital forensic experts have been building triage tools to empower investigators to quickly collect evidence and on-scene intelligence from computers and digital devices.

In this how-to video, we will cover backing up and scanning encrypted iOS devices. This skill is important to know because encrypted iOS backups return more data than unencrypted backups.

Looking to add key words on-scene? ADF has you covered. In this how-to video, investigators and analysts will learn how to add keywords directly from the Collection Key. As a digital evidence investigator, ADF provides the ability to create a collection key with or without Search Profiles and add keywords just before the start of a scan.

Our digital forensic specialist knows that as someone who used to go out and execute search warrants and conduct knock and talks, the ability to overcome and adapt on-scene is vital to a successful outcome. In this how-to video, Rich explains how to create a Collection Key without Search Profiles and how to add keywords prior to starting a scan from the Collection Key. 

This blog post will feature our Settings page, and tips and tricks to understanding it. The first thing users will notice on the settings page is the Backed-Up Licenses. This displays all licenses that have been backed up on this computer. When selecting a license it will display all the information pertaining to that license and also enable users to delete the license from the backed up licenses folder. Additionally, the information here can be used when making a support call or using the support portal.

Our newest How-To video will cover how to image from either the Desktop tool or the USB device (Collection Key) on a Boot and Live Scan. 

When using ADF tools to collect files, either by File Properties, Hashes, or Keywords, ADF tools provide  three methods for file identification:

With ADF digital forensic software tools, it's possible to scan multiple devices simultaneously and have them as part of one scan. However, there are some items we need to keep in mind when preparing to scan multiple devices.

Once you have completed your investigation and need to archive your case, the most efficient method is to use the Stand Alone Viewer, which can be found within the reporting module. This viewer provides an all-in-one solution that includes a self-contained folder with a standalone application that gives you the ability to view the results. It is independent of the ADF suite of tools and does not require a license to use. By using the Stand Alone Viewer, you can be sure that all tags, comments, filters, and sorting will be included in the output. Please note that it is not possible to run the Stand Alone Viewer from read-only storage devices such as CDs or DVDs.

Software updates are something we look forward to, and when we receive that new download from our go-to tool, it makes the day even more special.  When it comes time to upgrade or re-install ADF software, as a user, you do not want your data to be lost after either the software upgrade or when selecting a new Search Profile folder.

When you first start the ADF application you will notice the tool will look to see if any new data needs to be merged or migrated.

Mobile Device Investigator (MDI) is the leading digital forensic triage tool for iOS and Android devices. In this short "How To" video, ADF's digital forensic specialist and trainer, Rich Frawley, will show you how to create a Search Profile with MDI. 

ADF digital forensic software comes with approximately a dozen out-of-the-box default search profiles designed to make it quick and easy for non-technical field investigators to quickly search for digital evidence. 

In this short How To video, you'll learn how to import and export an ADF digital forensic Search Profile. This allows investigators to create a Custom Search Profile on one computer and export it so that it is available to be imported into another installation on another computer so forensic examiners or senior investigators can create and share profiles with:

In this short How To video, digital forensic specialist Rich Frawley, will show you how to collect and share digital evidence files with prosecutors and third parties using ADF Software. This video is ideal for learning how to share evidence with prosecutors for review. 

In this short 4-minute Mac forensics "How To" video, ADF forensic specialist, Rich Frawley, shows you how to conduct a boot scan of a MacBook Air with APFS & FileVault2 enabled.

Digital Evidence Investigator is built for front-line field investigators and lab examiners who need to do digital forensic investigations on Mac, Linux, or Windows. Combined with Mobile Device Investigator, Digital Evidence Investigator PRO gives you all the best computer forensic capabilities along with iOS and Android mobile forensics in a single affordable forensic tool. 

In this short video ADF's Digital Forensic Specialist, Rich Frawley, demonstrates the installation process for DEI and DEI PRO, on an offline computer that does not have Internet access. You can refer to our Technical Specifications for minimum requirements and supported Operating Systems.

Digital Evidence Investigator is built for front-line field investigators and lab examiners who need to do digital forensic investigations on Mac, Linux, or Windows. Combined with Mobile Device Investigator, Digital Evidence Investigator PRO gives you all the best computer forensic capabilities along with iOS and Android mobile forensics in a single affordable forensic tool. 

In this short video ADF's Digital Forensic Specialist, Rich Frawley, demonstrates the installation process for DEI and DEI PRO, on a computer that has Internet access. You can refer to our Technical Specifications for minimum requirements and supported Operating Systems.

Fast investigations require rapid access to evidence. ADF software enables investigators to quickly view the links of artifacts captured from a target device so you can easily understand a user's activities. 

In this short 5 minute video, you'll learn how to filter digital forensic scan results in ADF software. Filtering is available in any table while analyzing any of your scan results. In this how-to video, we'll look at:

In this short How To video we are going to explore the Text Analytics capabilities built into ADF’s digital forensic software with the integration of Rosoka. ADF is bringing the power of Rosoka for automated entity extraction and language identification with gisting, through a tightly integrated user experience in the Rosoka Add-on. 

Digital Evidence Investigator PRO enables front-line field investigators to quickly create an iOS forensic backup of an iOS mobile device on-scene or back in the lab. In this short video, ADF Digital Forensic Training Manager, Rich Frawley, will show you how to easily backup an iOS device with DEI PRO.

Digital Evidence Investigator PRO enables front line field investigators to quickly create a forensic backup of an Android device on-scene or back in the lab. In this short video, ADF Digital Forensic Specialist, Rich Frawley, will show you how to easily backup an Android device with DEI PRO.

Learn how to create a forensic backup of an Android smartphone or tablet with Mobile Device Investigator™ in this short How To video from ADF's Digital Forensic Specialist, Rich Frawley.

Learn how to create a forensic backup of an iOS smartphone or tablet with Mobile Device Investigator™ in this short How To video from ADF's Digital Forensic Specialist, Rich Frawley.

Front line investigators and digital forensic examiners are encountering an ever increasing number of images in almost every investigation they perform. This exponential growth in the volume of images can challenge investigators searching for illicit online activity, Child Sexual Abuse Material (CSAM), extremist propaganda, or other types of image content. 

In this short video, ADF digital forensic specialist, Rich Frawley, demonstrates ADF's digital forensic image recognition and classification capabilities. 

ADF digital forensic tools come with out-of-the-box Search Profiles. In this short video, you'll learn how to use Digital Evidence Investigator PRO to demonstrate how to create a search profile.

When making decisions on scene it is critically important for an investigator to scan and analyze the Operating System Drive or Partition, or what is commonly referred to as the C:\ drive. ADF digital forensic software tools give investigators out-of-the-box Search Profiles designed to quickly scan and analyze OS partitions with targeted paths that would not be present on a non OS partition.

If you come across a non OS drive or partition, a storage partition, or external storage drive, instead of using the built-in Comprehensive Search Profiles, you can create a Custom Search Profile for non operating system drives using Digital Evidence Investigator^®. 

Learn how to quickly scan iOS devices, smartphones or tablets, in this 2 minute short "How To" video created by Rich Frawley, our Director of Digital Forensic Training. Rich will walk you through how to attach and scan an iOS device with Mobile Device Investigator® (MDI) using an iPhone.

As you get started performing an advanced logical forensic acquisition of an Android device with Mobile Device Investigator^®, you will want to learn how to attach an Android device to your forensic computer. This short video will show you how you can quickly and easily collect digital evidence from Android mobile phones and tablets. 

Digital Evidence Investigator^® gives investigators the ability to customize Search Profiles and determine exactly what and where you want to look for digital evidence. This is especially convenient when looking to tailor a search for a forensic triage type scan or a targeted collection. This is accomplished by using the Targeted Folders Option when creating a custom file capture.

Mobile Device Investigator® is a powerful and innovative digital forensic software tool designed specifically for advanced logical iOS and Android mobile device investigations. With MDI, investigators can easily scan and create backups of mobile devices, allowing for quick and thorough analysis of data relevant to their cases.

When conducting an investigation, it is important to be flexible and follow the direction of your investigation with as few obstacles as possible. If your examination brings you a new file type, such as a video generated by a hand held camera, or a proprietary file created by a unique software, you want to be able to search for, or collect these files types right away either on-scene or back in the lab.

ADF offers the best digital forensic solution for getting relevant data from an Apple Mac laptop or desktop running APFS since it is easy to use and offers investigators a quick and easy way to collect and analyze evidence.  In this short 3-minute video, ADF's digital forensic specialist, Rich Frawley shows how to boot a MacBook Air (APFS, non-encrypted) with Digital Evidence Investigator.

When investigating crimes against children cases, Project Vic data sets and Digital Evidence Investigator^® (DEI) go hand in hand.

DEI and ADF's other forensic triage and investigation tools give investigators and examiners the ability to categorize image and video media fast -- which is paramount in the fight against child exploitation.

Whether you are an ICAC, CAC, or affiliate task force, DEI is the best tool to help you investigate CSAM / CEM and solve internet crimes against children. In the short 6-minute video below, ADF's digital forensic trainer is going to show you how easy it is to add Project Vic datasets or hashes to a Search Profile.

As a forensic investigator, there will come a time when you will come across the occasional computer that is difficult to get to the HDD and it may be encrypted by default, such as the Microsoft Surface Pro. In this short video, you'll learn how to easily conduct a boot scan of a Microsoft Surface Pro with Bitlocker activated.

Whether you are preparing to go on-scene or you are in your digital forensic lab getting ready to perform triage or one or more digital forensic scans, this video tutorial will show you how you can easily create a keyword capture and add keywords to a Search Profile.  We begin from when you have started to create a Custom Search Profile and want to add your own unique keywords.

ADF software lets investigators and examiners search for files by keyword(s) using substrings or regular expressions.  ADF software allows you to search for keywords in all file and folder names, file content and metadata, and artifact records from other captures.

ADF digital forensic software including Digital Evidence Investigator^® (DEI) and Triage-Investigator^® come with out-of-the-box default Search Profiles. In this short video tutorial, we use Digital Evidence Investigator to demonstrate "What is a Search Profile?".

In DEI the Search Profiles are maintained in the Setup Scans Menu option. The Search Profile, when run, will collect the information selected within the Search Profile. Search Profiles will run from the desktop application or from the collection key on a Live or Boot scan.

Learn how to conduct a Windows live scan with ADF Solutions Digital Evidence Investigator.  Two USB ports are required to complete a scan, one for the Collection Key and one for the Authentication Key, once the scan has started the Authentication Key can be removed. A USB hub may be used in cases where the target computer only has one USB port. 

When running a live scan from a Collection Key it is possible to create a RAM dump of the computer. RAM dumps can then be analyzed with appropriate software (e.g. Volatility).