The post Evolution of Forensic Intelligence Impacting Law Enforcement in 2026 appeared first on ADF Solutions.

The post From Seizure to Investigation in Minutes: What’s New in ADF Pro v6.3 appeared first on ADF Solutions.

The post Mastering Triage: Intro to ADF Pro appeared first on ADF Solutions.

The post Making the Case for Triage appeared first on ADF Solutions.

The post Satisfying the Landeck Ruling with ADF Pro appeared first on ADF Solutions.

The post UK Police Agency Cuts Device Submissions by 76% with ADF PRO appeared first on ADF Solutions.

In the fast-paced world of digital forensics, time is often the enemy. Investigators need tools that allow quick, reliable evidence collection without compromising integrity. That’s where ADF Solutions comes in. Their software empowers field examiners to triage computers using a simple USB device. This portable setup turns any compatible USB SSD drive into a powerful “Collection Key” for scanning suspect machines.

Whether you’re dealing with child exploitation cases, corporate investigations, or cyber threats, ADF Software streamlines the process by automating searches for critical artifacts like contraband, chat logs, browser history, and more. In this post, we’ll dive into the two primary scanning methods: live scan and boot scan. I’ll cover how to set them up, their steps, benefits, and when to choose one over the other. Let’s get started!

What is Digital Forensics Triage?

Before we jump into the scans, a quick primer: Triage in digital forensics is like emergency room sorting—it’s about rapidly identifying and prioritizing evidence on devices. ADF Software excels here by using predefined “Search Profiles” that target specific data, such as keywords, hashes for known illicit files (e.g., via VICS or CAID databases), or artifacts from apps like social media, P2P networks, and cryptocurrency wallets.

The magic happens via a USB Collection Key, which you prepare on your forensic workstation. This key is bootable and can include custom profiles for tailored scans. ADF supports Windows, macOS (including T2 and M1/M-series chips), Linux, and ChromeOS, and handles file systems such as NTFS, APFS, and EXT. It even decrypts encrypted volumes (e.g., BitLocker, FileVault) using the provided credentials.

When preparing the Collection Key, you have options to prepare the Collection Key with Search Profiles, which are your set of instructions for what is going to be captured and collected, or they can be set up to only show the individual captures, allowing you to customize on scene right before the scan.

Performing a Live Scan

A live scan is ideal when the target computer is already powered on, and you can’t afford to shut it down. Think volatile data like running processes and RAM contents that could vanish on reboot, or BitLocker encryption for which you do not yet have the credentials. Using a live scan on a running Windows computer with Digital Evidence Investigator (DEI) or ADF PRO can collect RAM, recover Bitlocker credentials, and also collect user credentials saved in browsers.

To conduct a live scan, the Collection Key is inserted, and a batch file is executed to open the ADF interface. The Collection Key can be prepared using Search Profiles that are preconfigured or customized for your investigation with specific keywords, hashes, and only the artifacts you want to collect. At this point, you will have access to the system drive and any attached device you would like to scan, such as physical drives, logical volumes, attached storage, or even network shares.

Once you commence the  “Scan.” The process runs in parallel, collecting artifacts while displaying real-time progress, thumbnails, matches (hashes and keywords), and image classifications such as weapons, vehicles, pornography, and more. Once complete, results are stored on the Collection Key. You can view them immediately or transfer them to your workstation for deeper analysis.

Benefits:

• Minimizes Data Loss: Captures live system data, including RAM dumps for volatile memory analysis.
• Speed: No reboot needed, making it perfect for time-sensitive field ops.
• Versatility: Works on locked or encrypted systems with credentials; supports remote agents for macOS.
• Non-Intrusive: Leaves minimal traces Windows log some artifacts from USB insertion and program execution. Once the program is executed, no dates, times, metadata, or files are changed.

However, live scans might not access everything if the OS restricts certain areas, and they’re not “forensically sound” as boot scans since the system is active.

Performing a Boot Scan 

For a more controlled environment, opt for a boot scan. This method boots the target computer directly from the USB, ensuring no modifications to the internal drives.

Getting started with the boot scan is simple. Insert the Collection Key and upon powering up, press the one-time boot menu key (available on most modern computers). The Collection Key is built on Windows, so it is trusted; therefore, no secure boot configuration is necessary. Next, select the Collection Key and it will boot to ADF. From here, you have access to the system drive, attached devices, and Search Profiles that are preconfigured or customized to your investigation with specific keywords, hashes and only the artifacts you want to collect. The rest of the process is the same as a live scan.

Benefits:

• Forensically Sound: Read-only access prevents any changes to the target media.
• Comprehensive Access: Bypasses OS restrictions to scan internal storage, recover deleted files, and decrypt volumes.
• Portability: Great for powered-off devices or for imaging the entire drive post-scan.
• Efficiency: Supports multiple OS types, including UEFI Secure Boot and Macs, with parallel artifact collection.

Live Scan vs. Boot Scan: When to Choose What

Use Live Scan for active systems where shutting down risks data loss. Use Boot Scan for thorough, tamper-proof analysis on seized devices (e.g., in lab settings or when full drive access is crucial for CSAM investigations). In both, you can follow up with imaging: 

Hybrid approaches work too—start with a live scan for quick intel, then boot for deeper dives.

Conclusion 

ADF Software on a USB device revolutionizes computer triage by making it accessible, fast, and reliable for non-technical users. Whether opting for the convenience of a live scan or the rigor of a boot scan, you’ll collect actionable evidence like prohibited files, user activity, and hidden artifacts in minutes. If you’re in law enforcement, HR, or cybersecurity, tools like Digital Evidence Investigator can transform your workflow to triage from a USB device.

Request a demo today at www.adfsolutions.com

The post How to Triage from a USB Device: Boot and Live Scan Computers appeared first on ADF Solutions.

Since its inception in 2005, ADF has been at the forefront of digital forensics, pioneering intelligent triage solutions for both forensic labs and frontline users. The company has continuously developed fast, scalable, and user-friendly tools that empower investigators with minimal training. As technology has evolved, so too has ADF’s commitment to adapting its offerings to meet the needs of a new generation of tech-savvy investigators.

“In today’s landscape, rapid on-scene triage is essential for effective law enforcement,” stated J.J. Wallia, CEO of ADF Digital Forensic Solutions. “Our rebranding is not merely a cosmetic change; it reflects our promise to deliver solutions that enable agencies to make quicker and more informed decisions at crime scenes.”

The new ADF logo features a modern design in burnt orange and dark charcoal, symbolizing the company’s bright future and competitive edge. This revamped visual identity ensures that ADF remains synonymous with energy, vitality, and resilience against emerging digital forensic challenges. Each product logo has been specifically designed to reflect the distinct capabilities of ADF’s offerings.

In addition to a fresh color palette, the updated website provides a user-friendly interface that allows law enforcement personnel to easily navigate through ADF’s comprehensive range of products and resources.

Sidharth Kumar, Director of Marketing at ADF, commented, “Our rebranding is a testament to our mission of providing top-notch digital forensic solutions. This refined identity not only articulates who we are today but also positions us as a future-ready partner for organizations facing critical challenges in digital investigations.”

As ADF embarks on this exciting new chapter, law enforcement agencies can count on an enriched experience that aligns with their evolving needs. The company encourages partners and agencies to explore the new website and discover the next generation of digital forensic technologies designed to enhance community safety.

For more information about ADF Solutions, visit www.adfsolutions.com.

Media Contact:

Sidharth Kumar 
Director of Marketing 
ADF Digital Forensic Solutions 
+1 202-803-5731 
skumar@adfsolutions.com

The post ADF Launches Refreshed Brand Identity to Celebrate 20 Years of Innovation appeared first on ADF Solutions.

Begin by unlocking the device, setting Auto-Lock to Never, and accessing the “Add Device Wizard.” Following the prompts to establish a device connection, you’ll have access to more data than the Media Transfer Protocol (MTP), which only retrieves media.

For those with iOS 16 or higher, enable screen mirroring via AirPlay by connecting both the iOS device and ADF workstation to the same WiFi access point, ensuring a smooth connection for casting. If issues arise, consider alternative methods like MyPublicWiFi for a local network setup without internet access.

Watch the video to learn more:

REQUEST A FREE TRIAL

The post How to connect to an iOS device for Screencasting appeared first on ADF Solutions.

We have several options available for conducting triage, including, but not limited to, a quick “show me” approach, “early case assessment,” “critical incident” evaluation, and “intelligent triage.” Let’s briefly explore each of these methods and their potential applications.

The Show-Me Triage

Let’s start with the quickest and most commonly used form of triage: the “show-me” triage. This method is particularly effective in child exploitation investigations, where multimedia content and specific keywords can help you quickly locate the data necessary for decision-making. It is mainly utilized on-site during a search warrant or a knock-and-talk situation. This approach helps investigators make swift decisions, allowing them to rule out devices as well as locate them. 

The “show-me” triage is fast and often depends on the visual inspection of the investigator or analyst to determine if the multimedia content meets the threshold for seizing the device. However, depending on the tool used, this method can be one-dimensional, may generate false positives, and can leave you uncertain about the findings.

Early Case Assessment

Utilizing a customizable tool can enhance your ability to conduct a quick multimedia and visual search, incorporating case-specific hash values, unique keywords, and artifacts. This approach can lead to user-specific interactions with the multimedia content. An “Early Case Assessment,” performed within a “preview” or “scan-only” framework, allows for the rapid visualization of data. You can pause at any moment to report on what you’ve collected, enabling accurate documentation of your actions and decisions.

If you are a forensic investigator who typically sends devices to a regional lab, early case assessment enables you to gather data directly from the device using Advanced Logical Acquisition. This allows you to continue your investigation while the device is being sent to the lab and you await the results. In some instances, this method can lead to an earlier and more successful resolution of the case.

Consider an investigator who receives a CyberTip related to Child Sexual Assault Material (CSAM), along with unique keywords and hashes pertinent to the case. By employing a triage methodology, the investigator can create customized search parameters, incorporating the Cat 1 Project Vic hashes to scan both computer and mobile devices for relevant data linked to the CyberTip. 

Using ADF PRO on the scene, the investigator scans a live Windows computer and also boots a computer using a USB Collection Key loaded with ADF PRO and the customized search parameters. While scanning the computers, the investigator utilizes the license to preview and obtain Advanced Logical Acquisitions from multiple devices. 

Through this process, the investigator determines that the live Windows computer is directly connected to the downloading of the material referenced in the CyberTip. Additionally, the scan of the powered-off computer—identified as a Linux machine—also reveals the presence of contraband. All of this is accomplished within a timeframe consistent with the duration typically required for executing a search warrant. 

The investigator not only makes on-site decisions faster based on the CSAM discovered but also conducts an interview using the relevant data. Devices deemed irrelevant are cleared and left at the scene, allowing the lab to focus on the devices that are pertinent to the case.

The Critical Incident Triage

This brings us to the “Critical Incident” triage, where investigators are faced with a large number of devices and need to find specific information, typically related to date, time, or GPS metadata. In these scenarios, a preview can be conducted, allowing multimedia to be sorted and filtered quickly based on specific criteria. This process enables investigators to select only the devices necessary for immediate review. In cases involving victims or witnesses, the data can be collected, and the devices can be returned promptly and efficiently.

In this context, a critical incident occurs in a contained area, leading to the collection of numerous devices to secure any multimedia (pictures and videos) from that day that may aid the investigation. By utilizing the preview function of Mobile Device Investigator (MDI), investigators can quickly view and filter multimedia based on a specific timeframe or geographic location related to the incident. Within minutes, they can collect pictures, videos, properties, integrity hashes, date/times, and device information. This approach allows for minimal intrusion on the devices, enabling them to be returned to the witnesses swiftly.

Intelligent Triage

Triage methods vary in their processes depending on the type of case and the data available upfront. When these methods are combined or customized, they help adapt and respond effectively; this is where intelligent triage comes into play. Intelligent triage refers to an advanced, technology-driven approach to efficiently sorting, prioritizing, and analyzing data from devices in real-time, especially in time-sensitive or critical situations. Unlike traditional triage methods, which often involve extensive data collection followed by lengthy analysis, intelligent triage utilizes smart tools to streamline the process. This allows users to quickly identify and extract the most relevant information needed at that moment.

How ADF Helps

ADF Solutions has been a leader in digital triage for over 20 years, empowering you to customize, adapt, and effectively manage your cases while filtering out the noise. Our technology enables law enforcement professionals to automate a substantial portion of the evidence collection process, enhancing their confidence in investigations.  

Need assistance with your particular use case? Contact ADF today for a quick demo.

The post How to Master Triage For Your Forensic Investigations appeared first on ADF Solutions.