Learn the Differences Between ADF Forensic Tools

All ADF software shares the same intelligent search engine and rapid scan capabilities. The key differences in our digital forensic products are in the form factor and the features focused on deployment and usage scenarios. Users can select to deploy Mobile Forensics, Computer Forensics, or ADF PRO tools which combine all capabilities into a portable lab.

• – Forensic Examiners – Police, Government or Corporate Lab Investigations and Priority Triage
• – Field Investigators – Police, Sheriff, Law Enforcement, School Resource Officers, IT Security and Digital First Responders
• – Intel or Military Field Operatives – Force Protection and Field Intelligence Gathering

Request a Free Trial

Searching Digital Devices & Images

	Digital Evidence Investigator®	Mobile Device Investigator®
Instant previewing of mobile devices (no waiting for backups)	PRO
Scan connected and unlocked Android and iOS devices.	PRO
Scan connected ChromeOS devices.
Scan connected MTP devices (digital camera, legacy phones, etc.)	PRO
Scan Android and iOS ADF backups.	PRO
Scan ChromeOS ADF backups.
Scan iTunes backup.	PRO
Scan iTunes backup found on a target computer.	PRO
Preview connected and unlocked Android/iOS devices	PRO
RAM capture on Windows
Scan turned-on Windows computers (live scan with the Collection Key or via the remote agent)
Scan turned-on Mac computers (live or recovery scan via the remote agent scan)
Scan turned-off Windows and Linux computers (boot scan with the Collection Key)
Scan multiple computers on-site with a single Authentication Key (license dongle)
Scan drive images (E01, DD, AFF4, L01, ZIP)
Scan NTFS, FAT, ExFAT, HFS+, APFS, EXT2/3/4, YAFFS2 file systems
Scan devices connected to a suspect computer
Scan external devices (USB, CD, DVD, SD cards, MTP, etc.) attached to the forensic workstation.		License Add-on
Enter keywords just before a live/boot scan
Recover hundreds of file types.
Recover communication artifacts (emails, chats, contacts, etc.)
Recover system artifacts (user accounts, wifi connections, USB history, installed apps, etc.)
Recover application artifacts (peer-to-peer, anti-forensics, crypto-currency, etc.)
Recover web browser artifacts (browsing history, bookmarks, search terms, synced tabs, etc)
Recover deleted pictures from unallocated space.
Recover deleted pictures from system files.
Recover deleted records from apps using the SQLite database.
Prompt for password of encrypted partitions (FileVault2 HFS/APFS, Bitlocker)
Ignore files from a whitelist (import from NSRL and VICS/CAID)
Conduct live scans in Stealth mode
Automatically start a boot or live scan
Present custom forms before a scan (consent forms or other)
Forensically Sound

Imaging Digital Devices

	Digital Evidence Investigator®	Mobile Device Investigator®
Image suspect drives and storage devices (EWF and DD)
Image Mac and Windows computers from the remote agent (ZIP)
Advanced logical acquisition of Android, iOS devices	PRO
Advanced logical acquisition of ChromeOS devices
Create Load Files after Android/iOS devices acquisition	PRO

Screen Recordings and Screenshots

	Digital Evidence Investigator®	Mobile Device Investigator®
Take screenshots and screen recordings from any video sources	License add-on	License add-on
Take screenshots of Android and iOS devices	PRO
Take screenshots of ChromeOS devices
Make screen recordings of Android and iOS devices	PRO
Make screen recordings of ChromeOS devices
Scan screenshots and screen recordings to perform OCR and obtain a scan result	PRO

Analysis & Reporting

	Digital Evidence Investigator®	Mobile Device Investigator®
Review evidence directly on suspect computer
Comprehensive filtering and sorting of results
Hide duplicated files to reduce noise
Analyze all files, artifacts, and users' activities in a single timeline
View links between files of interest and user’s activities
View conversations in familiar color-coded "chat" bubbles
Tag and comment on relevant records to build report
Automatic visual classification of pictures and videos
Extract and translate entities from documents and communications	License Add-on	License Add-on
Create comprehensive reports
Export reports to HTML, PDF, VICS, and CSV formats
Export reports to a standalone viewer executable that can easily be shared and doesn't need to be installed

Setup & Configuration

	Digital Evidence Investigator®	Mobile Device Investigator®
Define and package custom search criteria (Search Profiles)
Create custom data Captures (keywords, SHA-1/MD-5 hash, grep search, file collection, PhotoDNA)
Import VICS and CAID datasets for auto-categorization
Configure properties of files to search (size, timestamps, etc.)
Configure folders and paths to scan
Customize headers of files to search
Import Captures and Search Profiles
Export Captures and Search Profiles
Out-of-the-box Search Profiles for "Media Exploitation"
Out-of-the-box Search Profiles for "Law Enforcement" (including Indecent Images of Children Profiles for CSAM investigations)
Use any USB drive as a Collection Key
Use BitLocker to protect the Collection Key
Prepare a Collection Key without Search Profiles to select Captures just before a Scan
Simple multi-workstation deployment with a single configuration file
Ready to use with no installation and no setup required

The post Product Page – Compare Products appeared first on ADF Solutions.

The post FAQ appeared first on ADF Solutions.

Upcoming Webinars

Making the Case for Triage

Register

Mastering Triage: Intro to ADF Pro

Register

From Seizure to Investigation in Minutes: What’s New in ADF Pro v6.3

Register

Past Webinars

Mastering Triage: Intro to ADF Pro

Watch

Making the Case for Triage

Watch

Satisfying the Landeck Ruling with ADF Pro

Watch

Triage Triumph: Boosting Your Confidence With Rapid Digital Evidence Collection – CyberSocialCon 2025

Watch

What’s New? ADF Features and Highlights: Nov 2025

Watch

Accelerate Your Investigations with Intelligent Triage

Watch

Discover How to Capture HDMI Data & Consent Forms

Watch

Discover How to Capture HDMI Data & Consent Forms

Watch

Navigating the Complexities of Multimedia Investigations

Watch

Scan to Solve: ADF’s New Features for Enhanced Investigations

Watch

Accelerate Federal Investigations with Advanced Digital Forensic Solutions

Watch

ICAC Investigations: The Art of Balancing Victim/Witness Consent and Evidence Collection

Watch

Faster Forensics: Streamline Your Investigations & Reduce Backlogs

Watch

Streamlining Supervision: Using Mobile Forensics in Probation & Parole

Watch

Seizing the Right Evidence, Anywhere

Watch

Guardians of the Digital Realm: ICAC Investigations With Mobile Preview

Watch

Mastering Computer Forensic Investigations Across Devices

Watch

Scan to Solve: ADF’s New Features for Enhanced Investigations

Watch

Empowering Agencies with DEI PRO: Mobile + Computer Investigations

Watch

Next-Gen Digital Solutions: Empowering Law Enforcement in the Modern Era

Watch

Enhancing Mobile Investigations: A Focus on Screenshots and Screen Recording

Watch

Mobile Devices and Consent: Building Trust with Victims and Witnesses

Watch

Victims, Witnesses, and Consent in the Digital Age 

Watch

Taking Command of Forensic Evidence: Best Practices for Leaders and Commanders

Watch

iOS 16 Screenshots:  Streamlining Mobile Forensic Investigations

Watch

Solving Human Trafficking Investigations On-Scene

Watch

The post Webinars appeared first on ADF Solutions.

The post Request Demo appeared first on ADF Solutions.

The post Request a Quote appeared first on ADF Solutions.

The post Upgrade Software appeared first on ADF Solutions.

ADF PRO is a software solution for rapid preview & triage of smartphones, computers and storage devices. ADF PRO is user-friendly and designed for front-line law-enforcement, analysts, and forensic examiners.

Triage | Collect | Acquire

Mobile Devices

• - Fast acquisitions
• - Scan multiple devices at a time
• - Live Preview evidence with profiling in seconds
• - Screen & video capture with audio & OCR

Computer and External Devices (USB, SD Cards, etc.)

• - Capture RAM to acquire volatile memory
• - Boot scans - Physical
• - Live scans - Logical
• - Stealth Mode
• - Live Preview evidence with profiling in seconds
• - Use Built-in or Custom Search Profiles
• - Real-time keyword search, filtering & profiling
• - Compatible with your lab forensic programs

Analysis

• - SQLite processed evidence & intelligence
• - Image-based classifications (CSAM, People, Age, Weapons, Currency, Vehicles, Upskirting, Bestiality, Documents, Project VIC, and CAID)
• - View relationships between artifacts
• - Search keywords, regular expressions, hash values, and PhotoDNA

Report

• - Real-Time result viewing
• - Tag and comment evidence
• - Share with investigators, prosecutors, etc.
• - Shareable Report Viewer
• - Export formats: HTML, CSV, and PDF
• - Export Files in JSON for 3rd party apps

Options

• - Rugged Mil-Spec Field and Triage Tablets
• - HDMI Capture
• - Training:
  • - Free weekly introductory sessions
  • - Certified On Demand and In-Person

ADF PRO

The Ultimate All-in-One Forensics Tool

ADF PRO is the all-in-one digital evidence forensics, triage, and media exploitation software built for speed, scalability, and ease of use for front-line investigators who need results. ADF software quickly processes and analyzes smartphones (iOS, Android, and ChromeOS), computers, external drives, drive images, and other media storage (USB flash drives, memory cards, etc.).

With ADF PRO, you get all the capabilities of ADF Digital Evidence Investigator and Mobile Device Investigator in a single license.

• Easily Build Custom Reports And Dashboards
• Legacy Software Modernization
• Software For The Open Enterprise

Talk to an ADF Expert

The post Product Page – ADF PRO (2026) appeared first on ADF Solutions.

Rapid Digital Evidence
On-Scene

Modern forensic triage solutions designed to accelerate case resolution and reduce backlogs, all with minimal training.

Get a Demo

Actionable Intelligence From Devices, Fast

When officers arrive at the crime scene, they use the ADF software to quickly triage devices and access only the digital evidence necessary to prove the case, bringing what is needed back to the lab. This swift approach ensures faster justice to victims, witnesses, and their families, while protecting their privacy.

ADF technology provides an extremely easy-to-use interface for both technical and non-technical investigative teams, enabling them to tackle today’s complex forensic challenges. By utilizing ADF, your team can save time, reduce costs, and ultimately save lives.

Start Free Trial

For Investigators with Minimal Training

ADF tools are designed for frontline operational users who manage various tasks, with mobile data recovery and analysis being only one part of their role. These tools allow for quick extractions and require little training to use. ADF simplifies the extraction process for non-experts by offering guided workflows that assist users throughout the extraction and analysis process.

Mobile Device Investigator (MDI)

– Scan iOS and Android devices
– Easy preview and screen captures
– Fast acquisitions in minutes

Learn More

Digital Evidence Investigator (DEI)

– Rapidly assess Mac, Windows, Linux, and ChromeOS machines
– Boot and live scan options
– Present evidence in a timeline view

Learn More

ADF PRO

– The combined power of DEI and MDI
– Single solution for all device types
– Designed for any remote environment

Learn More

The Only Tool for On-Scene Triage

The mounting volume of digital evidence, resource limitations, data contamination, potential for human error, case bias, and other risks can doom a timely investigation. ADF provides a single, forensically sound workflow that assures forensic teams with vital data they need fast from field to lab to prosecution.

Begin Your Learning Journey

Internet Crimes Against Children (ICAC)

ADF tools help investigators swiftly detect and prevent the proliferation of child sexual abuse material while creating a safer digital environment.

Learn More

Human Trafficking

Agencies can leverage ADF to monitor cryptocurrency transactions linked to human trafficking activities. They can investigate for evidence using custom search profiles.

Learn More

Case Backlog

Reduce the workload of lab examiners by solving cases in the field. Only ADF provides insights that surpass those of traditional triage tools.

Learn More

Digital Forensics Training

ADF offers a variety of immersive,hands-on training options — available in-person, live, or self-paced— to accommodate the busy schedules of forensic examiners and investigators. Our training program serves as the perfect opportunity for the law enforcement community to enhance their skill set and stay updated on the latest features.

Learn More

Solving Forensic Challenges for Organizations Worldwide

Testimonials From Our Customers

“In two years, all law enforcement agencies will be adopting a triage program to qualify cases. ADF Solutions provides software tools and a program infrastructure that is unparalleled today.”

Forensic Examiner

Nottingham Police

“The ADF tools are our only option to search a suspect computer and find evidence quickly in 30 minutes or less.”

Forensic Examiner

Unnamed US Border Agency

“We triaged nine computers at one time, and it took only two and a half hours. The ADF Triage program was outstanding and a time saver.”

Forensic Examiner

Canadian Law Enforcement Agency

“I was investigating a case of malicious code distribution at a local university library. The library had 83 computers. I triaged all the computers with ADF Pro and identified seven computers that had evidence related to the investigation. I was able to focus only on imaging and processing these seven computers. The ADF Triage program saved us from having to image and analyze 76 computers. The cost and time savings are immeasurable.”

Forensic Examiner

Dutch Police

“The Search Profile technology is a revolution in the world of computer forensics. Our examiners have been able to close out many cases using the ADF triage tools.”

Forensic Examiner

Unnamed U.S. Federal Law Enforcement Agency

Latest Resources and Trends

View All Resources

• 13 April 2026
• Sybil Mayard

Evolution of Forensic Intelligence Impacting Law Enforcement in 2026

Read More

• 2 February 2026
• Richard T. Frawley

How to Triage from a USB Device: Boot and Live Scan Computers

Read More

• 17 January 2026
• Sidharth Kumar

ADF Launches Refreshed Brand Identity to Celebrate 20 Years of Innovation

Read More

• 16 December 2025
• Richard T. Frawley

How to connect to an iOS device for Screencasting

Read More

From Seizure to Investigation in Minutes: What’s New in ADF Pro v6.3

• April 3, 2026

Mastering Triage: Intro to ADF Pro

• March 25, 2026

Making the Case for Triage

• March 18, 2026

Satisfying the Landeck Ruling with ADF Pro

• March 18, 2026

UK Police Agency Cuts Device Submissions by 76% with ADF PRO

• March 16, 2026

How to Triage from a USB Device: Boot and Live Scan Computers

• February 2, 2026

ADF Launches Refreshed Brand Identity to Celebrate 20 Years of Innovation

• January 17, 2026

How to connect to an iOS device for Screencasting

• December 16, 2025

How to Master Triage For Your Forensic Investigations

• December 3, 2025

The post Home Page appeared first on ADF Solutions.

We have several options available for conducting triage, including, but not limited to, a quick “show me” approach, “early case assessment,” “critical incident” evaluation, and “intelligent triage.” Let’s briefly explore each of these methods and their potential applications.

The Show-Me Triage

Let’s start with the quickest and most commonly used form of triage: the “show-me” triage. This method is particularly effective in child exploitation investigations, where multimedia content and specific keywords can help you quickly locate the data necessary for decision-making. It is mainly utilized on-site during a search warrant or a knock-and-talk situation. This approach helps investigators make swift decisions, allowing them to rule out devices as well as locate them. 

The “show-me” triage is fast and often depends on the visual inspection of the investigator or analyst to determine if the multimedia content meets the threshold for seizing the device. However, depending on the tool used, this method can be one-dimensional, may generate false positives, and can leave you uncertain about the findings.

Early Case Assessment

Utilizing a customizable tool can enhance your ability to conduct a quick multimedia and visual search, incorporating case-specific hash values, unique keywords, and artifacts. This approach can lead to user-specific interactions with the multimedia content. An “Early Case Assessment,” performed within a “preview” or “scan-only” framework, allows for the rapid visualization of data. You can pause at any moment to report on what you’ve collected, enabling accurate documentation of your actions and decisions.

If you are a forensic investigator who typically sends devices to a regional lab, early case assessment enables you to gather data directly from the device using Advanced Logical Acquisition. This allows you to continue your investigation while the device is being sent to the lab and you await the results. In some instances, this method can lead to an earlier and more successful resolution of the case.

Consider an investigator who receives a CyberTip related to Child Sexual Assault Material (CSAM), along with unique keywords and hashes pertinent to the case. By employing a triage methodology, the investigator can create customized search parameters, incorporating the Cat 1 Project Vic hashes to scan both computer and mobile devices for relevant data linked to the CyberTip. 

Using ADF PRO on the scene, the investigator scans a live Windows computer and also boots a computer using a USB Collection Key loaded with ADF PRO and the customized search parameters. While scanning the computers, the investigator utilizes the license to preview and obtain Advanced Logical Acquisitions from multiple devices. 

Through this process, the investigator determines that the live Windows computer is directly connected to the downloading of the material referenced in the CyberTip. Additionally, the scan of the powered-off computer—identified as a Linux machine—also reveals the presence of contraband. All of this is accomplished within a timeframe consistent with the duration typically required for executing a search warrant. 

The investigator not only makes on-site decisions faster based on the CSAM discovered but also conducts an interview using the relevant data. Devices deemed irrelevant are cleared and left at the scene, allowing the lab to focus on the devices that are pertinent to the case.

The Critical Incident Triage

This brings us to the “Critical Incident” triage, where investigators are faced with a large number of devices and need to find specific information, typically related to date, time, or GPS metadata. In these scenarios, a preview can be conducted, allowing multimedia to be sorted and filtered quickly based on specific criteria. This process enables investigators to select only the devices necessary for immediate review. In cases involving victims or witnesses, the data can be collected, and the devices can be returned promptly and efficiently.

In this context, a critical incident occurs in a contained area, leading to the collection of numerous devices to secure any multimedia (pictures and videos) from that day that may aid the investigation. By utilizing the preview function of Mobile Device Investigator (MDI), investigators can quickly view and filter multimedia based on a specific timeframe or geographic location related to the incident. Within minutes, they can collect pictures, videos, properties, integrity hashes, date/times, and device information. This approach allows for minimal intrusion on the devices, enabling them to be returned to the witnesses swiftly.

Intelligent Triage

Triage methods vary in their processes depending on the type of case and the data available upfront. When these methods are combined or customized, they help adapt and respond effectively; this is where intelligent triage comes into play. Intelligent triage refers to an advanced, technology-driven approach to efficiently sorting, prioritizing, and analyzing data from devices in real-time, especially in time-sensitive or critical situations. Unlike traditional triage methods, which often involve extensive data collection followed by lengthy analysis, intelligent triage utilizes smart tools to streamline the process. This allows users to quickly identify and extract the most relevant information needed at that moment.

How ADF Helps

ADF Solutions has been a leader in digital triage for over 20 years, empowering you to customize, adapt, and effectively manage your cases while filtering out the noise. Our technology enables law enforcement professionals to automate a substantial portion of the evidence collection process, enhancing their confidence in investigations.  

Need assistance with your particular use case? Contact ADF today for a quick demo.

The post How to Master Triage For Your Forensic Investigations appeared first on ADF Solutions.

Empower Your Experience

We are user-driven, meaning we actively listen to our users. With each release, we incorporate features, fixes, and new artifacts at the request of our users. In addition to our daily interactions, we have a program for “super users”. These individuals have a direct line to our development team, where they can provide feedback and suggest new ideas. They also gain access to early release candidates for real-world testing, along with other perks that make this program beneficial. If you consider yourself an ADF Super User or a forensic examiner extraordinaire, please reach out to us. We are always looking to welcome new members to our team.

Updates for Your Favorite Apps

Artifacts play a crucial role in ADF tools and can be quite unpredictable; what works today might not work tomorrow. Rest assured, our teams are constantly working to ensure that when you select an item for parsing, you receive exactly what you expect. This month’s release brings us updates to several artifacts that are already implemented, such as Snapchat, Telegram, TikTok, Tinder and WhatsApp. Additionally, we are introducing support for Apple Wallet financial transactions from iOS. 

Watch ADF PRO v6.2 Webinar

Elevate Your Analysis

Enhancements to the user interface are always appreciated, as they aim to make your examinations and analysis easier. ADF tools have always been user-friendly, but a recent enhancement, the addition of a Home Button on every page, has garnered significant excitement from users. Additionally, we have made two key updates to the viewer section based on user input and request. You can now view your artifacts organized by apps as well as organized by artifact type, giving you a choice on how you are analyzing your data. We have also added a messages thread view in addition to the individual messages records, again giving you latitude in your analysis.

See Everything Together

One of the major improvements in this release is our acquisitions feature. Now, when you create an acquisition using ADF PRO or Mobile Device Investigator, there is a dedicated acquisitions screen where you can view and manage all your acquisitions in one place. Additionally, the acquisition process now allows you to add forms to the acquisition even if you are not going to scan it immediately. 

Conclusion

At ADF, we are driven by our mission to serve those who serve others. Some of our most exciting times come when we add new features and capabilities, as well as when we learn how these enhancements are being utilized. Of course, launch day is always a highlight for us as we release new features. We hope you’ll love what we’ve created!

Request a trial today at www.adfsolutions.com/free-trial

The post What’s New? ADF PRO v6.2.0 Features and Enhancements appeared first on ADF Solutions.