$1,448/ 1 year
  • 1-Year Subscription with Triage Kit $1,448
  • 3-Year Subscription with Triage Kit $3,448
  • Renewal: 1-Year $1,299
  • Renewal: 3-Year $2,999

$1,748/ 1 year
  • 1-Year Subscription with Triage Kit $1,748
  • 3-Year Subscription with Triage Kit $4,148
  • Renewal: 1-Year $1,499
  • Renewal: 3-Year $3,699

$$4,948/ 3 years
  • 3-Year Subscription with Triage Kit $4,948
  • Renewal: 3-Year $4,699
Digital Evidence Investigator
Desktop or USB Dongle
USB Dongle or Desktop
USB Dongle
Create custom Captures
(keywords, SHA-1/MD-5 hash, grep search, file collection)
Create custom Search Profiles
Advanced mode (for lab use)
Basic mode (for field use)
Note 1
Forensically Sound
Scan drive images (e01, dd)
Scan live (on) computers
Scan dead (off) computers
Scan external devices from forensic/friendly computer
(USB, CD, DVD, SD cards, etc.)
Create comprehensive reports
Review intel/evidence on suspect computer
Note 1
Keyword, hash, grep search capabilities (during scans)
Comprehensive file and artifact collection
Scan NTFS, FAT, HFS+ , EXT systems
Timeline analysis of files and artifacts
Comprehensive filtering of results
Scan devices connected to suspect computer
Tag evidence on suspect computer
Run scans with custom Search Profiles
Note 2
Export standalone report viewer
Export HTML and CSV report formats
Image suspect drives
Note 3
Stealth Mode
Extended license duration (limitations)

Note 1: Triage-G2 is switchable between Advanced and Basic Modes.

Note 2: Triage-Investigator cannot be used to create custom Search Profiles but it can run any Search Profiles created using Digital Evidence Investigator (DEI).

Note 3: Triage-Investigator can only image drives during live or boot scans.


Capabilities and Features

What are the limitations of Triage-Investigator (vs. DEI)

Both Digital Evidence Investigator (DEI) and Triage-Investigator scan suspect computers using ADF Search Profiles. However, Triage-Investigator can only use the default Search Profiles shipped with the software OR custom profiles created in DEI, whereas with DEI you can create custom Search Profiles.
Each copy of Triage-Investigator DOES NOT NEED a corresponding copy of DEI to setup custom Search Profiles. However, agencies should have at least one copy of DEI to provide custom Search Profiles to all Triage-Investigator installations at the same agency. Without this, Triage-Investigator users will be limited to only the default Search Profiles shipped with the software. For details on the default Search Profiles, please contact

Can the ADF tools be used by non-technical users?

Yes. ADF has been providing easy-to-use yet powerful triage tools for non-technical users since 2005, and we have numerous client success stories.

Are the ADF tools forensically sound?

Yes, this is a key feature of ADF tools. See table below.
Description Powered-OFF Computers Powered-ON Computers
Forensically sound Yes Partially
Change to file time stamps No No
USB key registry entry in standard mode No Yes
USB key registry entry in stealth mode (Triage-G2 only) No No

What are the key differences among the ADF tools?

See our ADF triage tool comparison page here. (ADD LINK)