Overview
Advanced Digital Forensic Solutions Inc. (ADF Solutions, Inc., or ADF Solutions) is a privately held, minority-owned small business based in Bethesda, Maryland. The company was founded in 2005 by J.J. Wallia and Raphael Bousquet.
ADF Solutions develops tools for media exploitation (MEDEX) and digital forensics triage. These tools scan computers and digital devices and rapidly extract intelligence and evidence to identify individuals who are a threat to public safety or national security. They are used in digital forensic labs and used by field operatives in defense, intelligence, law enforcement, border security, and other government agencies worldwide.
ADF Products
ADF offers three main products: Triage-G2, Triage-Examiner, and Triage-Responder.
Triage-G2 is a media exploitation (medex tool used by field operatives to extract intelligence from computers and peripheral devices. Triage-G2 was specifically designed to be used by nontechnical operators and deployed using a small, portable triage key (a 32GB USB drive) that doesn’t require a computer or other heavy equipment for field deployment. The keys can be prepared in advance at the base or in the field by using one click to select mission-specific search criteria. Triage-G2 is used by several U.S. defense and intelligence agencies.
Triage-Examiner is used by forensic examiners to scan suspect computers and prioritize the computers for full forensic examinations. Triage-Examiner is used by Law Enforcement agencies worldwide. Triage-Examiner Lab Add-On is an additional software component that works with Triage-Examiner for examiners who need to run the software on their laptops or forensic workstations to scan drive images, physical drives, DVDs, CDs, and other removable media that are connected to the workstation.
Triage-Responder is designed for nontechnical law enforcement investigators in the field to scan suspect computers for evidence of a crime. This tool also uses lightweight USB deployment and provides detailed field reporting capabilities. This tool was developed in partnership with the U.S. Department of Homeland Security Science and Technology Directorate.
Discontinued Products
• Triage-ID® • Triage-Lab® • Triage-Investigator®
ADF Patented Technology
ADF Solutions has been granted two U.S. patents (#7,941,386 and #8,219,588) for its SearchPak® technology.
SearchPak®
The SearchPak is a container of forensic search intelligence. It allows analysts and operators to precisely describe the forensic search or data exploitation to be conducted on a target system. As a secure container, the SearchPak can be used to automate recurring data exploitation jobs and can be shared among agencies or between operators. SearchPaks can be user-defined and are encrypted with an AES 256-bit encryption key.
Agencies can create their own SearchPaks and share them among examiners, teams, and other operators.
SearchPaks can be generic or mission-specific:
Examples of Generic SearchPaks
• Collect all pictures, videos, and documents accessed in the past six months on a target machine. • Detect any installed application that can facilitate hiding data. • Collect all iPhone backup files.
Examples of Mission-Specific SearchPaks
• Collect files that match a set of known hash values. • Collect all documents, text files, or emails that contain the keyword “Operation Kandahar.”
DHS S&T First Responder Cyber Forensic Field Kit
In 2010, ADF Solutions was selected by the U.S. Department of Homeland Security Science and Technology Directorate to develop a universal forensic triage field kit that would aid law enforcement officers in extracting information and evidence from computers and other devices being examined in active criminal or terrorist investigations. Once extracted, the data can immediately be viewed, so investigators can take appropriate action while saving the data for future forensic analysis.
As the result of this DHS initiative, ADF Solutions released Triage-Responder in 2012. The tool is being deployed to federal, state, and local law enforcement agencies throughout the U.S.
Media Exploitation
ADF Solutions focuses on digital forensic triage and can be applied to document and media exploitation. Triage-G2 has features designed specifically for media exploitation.
According to technopedia.com, document and media exploitation is defined as the extraction, translation, and analysis of physical and digital documents and media to generate useful and timely information. Also known as DOMEX, it is a very similar discipline to computer forensics or digital forensics.
Company Timeline
2005: ADF Triage-ID® field forensic triage tool is released 2006: ADF Triage-Lab® forensic triage tool for laboratory is released 2008: ADF Solutions releases Triage-Live®, a forensic triage tool to scan a powered-on computer 2009: ADF Solutions granted U.S. patent for forensic triage technology 2010: Complete ADF Triage platform released: Triage-Examiner® and Triage-G2® 2010: ADF Solutions granted another U.S. patent for forensic triage technology 2011: ADF awarded contract from the U.S. Department of Homeland Security to build triage “First Responder Cyber Forensic Field Kit” 2012: ADF releases Triage-Responder®, a forensic triage tool designed specifically for first responders and nontechnical investigators
News
Digital forensic triage and/or ADF Solutions has been described or highlighted in many different publications: