Triage

Cryptocurrency has expanded in use since it was created in 2009. The idea of creating a decentralized currency to avoid the regulation of banks and governments created a new avenue not only for criminals but also for terrorist organizations. Terrorists such as jihadists around the world have been trading crypto coins to purchase weapons and drugs to continue their attacks on innocent civilians.

The number of backlogged digital evidence requests has continued to rise over the years. The total number of backlogged evidence requests was over 570,000 in 2014 and every one of those requests is associated with a case that affects real people. This is why we love forensic triage, and why you should too.

During a criminal investigation, prioritizing the evidence is paramount to your success as an investigator. Filtering what is critical to the case and what isn't is the difference between the success and failure of an investigation. 

Forensic triage - sometimes referred to as "digital forensic triage" - is the process by which you collect, assemble, analyze, and prioritize digital evidence from a crime or investigation.

There are many ways to learn digital forensics. From Certified Training to short How-To videos designed to teach you skills in just a few minutes. One of our favorite forms of learning, however, is our one-hour digital forensic best practices webinars led by our Director of Training, Richard T. Frawley. Rich spent 22 years in law enforcement. Most of that time was as a digital forensic analyst. Here are some of our favorite learning webinars from this year:

Within ADF software and forensic triage products, including Digital Evidence Investigator, Triage-Investigator, or Triage-G2, an investigator can quickly find Dark Web traces. This can be done in Quick Profiles but in this video, Rich Frawley shows how to use an Intermediate Profile to triage a suspect machine to identify Dark Web traces. These can be found in ADF's Anti-Forensic Traces Capture. 

In this 3-minute "How To" video, you'll learn the benefits of having a digital forensic triage process that works from field to lab. Using ADF digital forensic tools, examiners can prepare field investigators to find digital evidence and intelligence on mobile phones, tablets, computers, and storage devices starting on-scene. 

Investigators can now scan all available Mac computers (including macs with T2 or M1 chips) with all types of encryption and virtual drives by running a remote agent that communicates with the desktop application. Now you can perform digital forensic triage on all Macs including

• macOS T2 chip
• macOS M1 chip
• Mac Fusion Drive

Digital Forensic Triage is the process of finding digital evidence important for investigations.

Smartphone Triage is becoming more and more important with the exponential increase in the number of devices and explosion of digital data. Mobile device forensic examiners can use smartphone triage as a first step in early case assessment of incoming devices. 

Crimes against children investigations can lead CSAM investigators to have to review thousands or even tens of thousands of images. Investigators need tools to help them find relevant evidence quickly. 

Regular Expressions - (also known as "regex") are special strings representing a pattern to be matched in a search operation and they can be particularly useful in mobile and computer forensics investigations. 

One of the ways we allow investigators to find and focus on relevant evidence is by allowing investigators to customize and bring in a unique set of keywords using a substring or with regular expressions. ADF forensic tools also implement regular expression keywords in our trace captures and keyword lists. So why are Regular Expressions different from using regular keywords?

Speeding your investigations has always been a primary focus for ADF Solutions and with the launch of ADF Mobile Preview capabilities, you can start looking at phone content immediately without waiting for a backup or imaging to finish. 

Intelligence gathering is a discipline that's on a different playing field than your typical law enforcement search warrant or forensic triage examination. ADF's Triage-G2 and Triage-G2 PRO enable military field operatives to rapidly collect and exploit captured equipment, media and documents in theaters of operation around the world and reduce time on target for:

ADF Authorized Partner, First Digital & Techno-Law Forensics and the Computer Forensics Institute of Nigeria are hosting the International Digital, Mobile and Computer Forensics Conference & Training Expo as a virtual edition.

The conference, also known as DIGIFOR2020 will be held September 23-25, 2020 and will feature sessions including:

Are you ready for a big one? Anticipating what your evidence collection needs will be while you are on-scene includes trying to ascertain how many electronic devices you will encounter. ADF makes it easy for you to be prepared. 

Anyone who is charged with a "knock and talk" or executing a search warrant knows that the ability to overcome and adapt on-scene is vital to a successful outcome. This is what drove ADF to empower investigators to be able to create a digital evidence Collect

ion Key (CKY). 

Tactical site exploitation requirements cover a wide range of objectives, goals, and users. This includes digital forensics, rapid assessment (or triage) of digital data and devices, collection of data on devices to bagging and tagging of devices. Users range from non-technical operators to technically trained forensic examiners. The most common devices that operators encounter today are mobile computing devices, mainly iOS and Android phones and tablets. 

Document and Media Exploitation (DOMEX) requirements cover a wide range of objectives, goals, and users. This includes digital forensics, rapid assessment (or forensic triage) of digital data and devices, collection of data on devices to bagging and tagging of devices.  

As digital technology becomes more advanced, the potential for its criminal application is magnified. This can result in overwhelming amounts of digital data for law enforcement to inspect in a limited timeframe. Although opportunities to find digital evidence on a perpetrator's or victim's computer may be numerous, the time it takes to search through such vast quantities of data contributes to the issue of growing forensic backlogs. 

What is CEM

In Australian states and territories, CEM refers to “Child Exploitation Material”, otherwise known as child abuse material, child sexual abuse material (CSAM), and child pornography. For digital forensic examiners, telecommunications-based child exploitation includes viewing, copying, downloading, sending, exchanging, soliciting, and making CEM. 

One year ago today, we launched Mobile Device Investigator^Ⓡ (MDI), ADF’s powerful mobile phone forensic software that allows anyone, from seasoned investigators to non-technical team members, to quickly conduct iOS and Android investigations in the field. Using MDI, investigators can acquire evidence fast and return devices to cooperating witnesses on-scene, and triage devices that need to be seized and brought back to the forensic lab. 

Today’s investigators and prosecutors are very familiar with the extreme difficulty in child exploitation cases: getting through your forensic backlog to get to the data in time. Law enforcement officers routinely report that a lack of technology which, combined with stringent time limits, can severely restrict their ability to check devices in a timely manner. ADF understands that digital forensic examinations can be both costly and time-consuming, which hampers investigations into suspects that have downloaded or participated in Child Sexual Abuse Material (CSAM). 

ADF Solutions Introduces Field Investigator™ for Teams

There’s a new way to give digital forensic examiners control of investigations and empower non-technical front-line investigators. Meet Field Investigator™ for Teams, the best way to deploy digital forensic triage capabilities to agents for on-scene digital evidence collection and analysis.

It's a known issue that many agencies and departments are facing worldwide; how to fight and reduce backlog to stay up to date on cases so that they don't get stale. It's a serious issue, but we at ADF can show you a few ways to fight in-house forensic backlog with digital forensic triage.

ADF is delighted to announce the work we did with the 114th Partnership to create a new Spark 101 STEM Skills video titled "Computational Thinking in Forensic Software Development." The video highlights careers in the digital forensics field and is available as a free resource to teachers seeking to foster students' interest in careers in STEM:

ADF computer triage has long been admired for some of the best digital forensic triage capabilities on the market. Since 2006, ADF digital forensic experts have been building triage tools to empower investigators to quickly collect evidence and on-scene intelligence from computers and digital devices.

Mobile Device Investigator (MDI) is the leading digital forensic triage tool for iOS and Android devices. In this short "How To" video, ADF's digital forensic specialist and trainer, Rich Frawley, will show you how to create a Search Profile with MDI. 

Fast investigations require rapid access to evidence. ADF software enables investigators to quickly view the links of artifacts captured from a target device so you can easily understand a user's activities. 

Digital Evidence Investigator PRO enables front-line field investigators to quickly create an iOS forensic backup of an iOS mobile device on-scene or back in the lab. In this short video, ADF Digital Forensic Training Manager, Rich Frawley, will show you how to easily backup an iOS device with DEI PRO.

Digital Evidence Investigator PRO enables front line field investigators to quickly create a forensic backup of an Android device on-scene or back in the lab. In this short video, ADF Digital Forensic Specialist, Rich Frawley, will show you how to easily backup an Android device with DEI PRO.

Technology has become more powerful and portable, allowing a more significant amount of information to be created, stored, and accessed. This shift in the information technology landscape (mobile, cloud, IoT, etc.) has made the collection and analysis of digital evidence a critical factor in investigating and solving virtually all types of crimes. 

There are serious Internet related crimes, that need to be investigated quickly, child exploitation related offenses for instance. For example, in the United Kingdom, the National Crime Agency recently estimated that about 140,000 out of nearly 3 million registered dark web accounts registered on child abuse sites are UK-based.

In the early 18th century, triage was used to refer to the action of sorting items according to quality and was taken from the French word trier which means to sort, separate out or cull. 

>> Continue reading or watch the Benefits of Triage webinar recording. 

Sensitive Site Exploitation refers to techniques used by military and intelligence officers to collect and exploit captured equipment, media and documents in theaters of operation around the world.  The process of exploiting sensitive or tactical sites to gather intelligence from targets for counter terrorism, force protection, or other national security needs is performed by forward operators using exploitation kits that can: 

In 2009, the number of backlogged digital evidence requests in publicly funded forensic crime labs was 1,600. By the end of 2014, that number had risen to 7,800. While that's tiny in comparison to the total number of backlogged evidence requests (over 570,000 in 2014!), every one of those requests is associated with a case that affects real people. This is why we love forensic triage, and why you should too.

Join ADF Solutions for a webinar hosted by the National White Collar Crime Center (NW3C), a nonprofit, membership-affiliated organization comprised of state, local, federal and tribal law enforcement and prosecutorial and regulatory agencies.  

NW3C provided a nationwide support system for law enforcement and regulatory agencies involved in prevention, investigation and prosecution of economic and high-tech crime.  Support is delivered via training in computer forensics, cyber and financial crime investigations and intelligence analysis as well as original research on and analytical technical support for investigating and prosecuting white collar and related crimes. 

Military and intelligence officers process an ever-increasing amount of data from which they need to gather actionable intelligence. This data comes from a variety of devices seized in combat operations or during an investigation.  

Document and Media Exploitation (DOMEX) is the "collection and exploitation of captured equipment, documents, and media to generate actionable intelligence." DOMEX analysis helps officers, special forces, and field operatives on the front lines complete a holistic picture of the intelligence available to them at the time. 

One of the reasons that investigators choose ADF software as their primary triage tool is because it can be used standalone or in conjunction with traditional forensic software.  Forensic Triage is ideal for front-line investigators because it's fast, easy-to-use, and can net results in situations where time matters. Deployed in a forensic lab, triage software can reduce forensic backlogs and allow forensic examiners to prioritize deep dive forensic investigations.

The term triage naturally brings to mind a medical emergency where you need to get in quickly, assess the damage and deal with the most serious problems first. Digital forensic triage has the same application but it's applied to a crime scene or investigation which involves computers or other digital media. Standard forensic methods normally take place in a forensic lab where a trained forensic examiner would perform a complete examination. Digital triage is a front line step in saving time and reaching satisfactory results faster.

ADF triage performance is fast -- built to be under two minutes for certain scans. Digital forensic triage speed and performance can vary based on a number of factors including the triage software you are using, the search criteria you choose, the suspect hardware configuration, and how much you know about what you are looking to understand in your investigation.

The Florida Internet Crimes Against Children Task Force, along with the Florida Department of Law Enforcement, Child Abduction Response Team (CART) and Offender Registration and Enforcement once again hosted the Florida ICAC Training Symposium. 

The best tools for rapid Mac forensics investigations just got better with ADF's release of new software versions to support the collection of artifacts with Mac OS Mojave Forensics and MacOS High Sierra as well as from Windows. 

The investigation began when law enforcement officials received a report that images that were consistent with child pornography had been uploaded to a social media platform. The images were immediately flagged, and investigators swiftly obtained a search warrant to gain access to the suspect's residence. Once inside the residence, members of the State Police Computer Crime Unit conducted an on-scene forensic examination of all electronic media, including computers, phones, and other electronic devices. This examination was conducted with the utmost care and attention to detail to ensure that all potential evidence was discovered and preserved. The examination proved to be invaluable, as it revealed a trove of images and videos of sexual abuse of an under age child, leading investigators to identify a resident of the household as the suspect. Through their tireless efforts, these investigators were able to bring a dangerous criminal to justice and protect innocent children from further harm.  

Using ADF Digital Evidence Investigator^®, investigators discovered images and videos of sexual abuse of an under age child and were able to identify a resident of the household as the suspect. Specifically, investigators located thumbcache images that resulted in identifying a female child that was being sexually abused and identified the suspect.