|Description||Powered-OFF Computers||Powered-ON Computers|
|Change to file time stamps||No||No|
|USB key registry entry in standard mode||No||Yes|
|USB key registry entry in stealth mode (Triage-G2 only)||No||No|
All ADF forensic tools share the same search and scan engine. The differences are aimed at 1) usage scenarios – specifically military operations, forensic lab examination, and field investigations, and 2) user risk management.
Triage-G2® has been designed to meet military media exploitation requirements. The tool is primarily used by operators who have training to both run the tool (basic mode) and with additional training, the option to configure the tool (advanced mode). It also offers a stealth mode for live scans, advanced search configurations, and an integrated authentication and collection key for optimized workflow. It is however limited to scanning a single computer at one time.
Digital Evidence Investigator® (DEI) has been designed to meet both forensic lab and field triage requirements. It is primarily used by both forensic examiners and investigators who have training to run and configure the tool (advanced mode only). It also offers advanced search configurations, and separate authentication and collection keys which allows users to scan multiple computers simultaneously. It does not offer stealth mode during live scans or the ability to switch to basic user mode.
Triage-Investigator® has been designed for field triage requirements. It is primarily used by investigators with limited digital forensic training in running the tool (basic mode only). This basic user mode allows for ease of use and limits user risk. It also offers a separate authentication and collection keys which allows users to scan multiple computers simultaneously. It does not offer stealth mode during live scans, advanced search configurations, or the ability to switch to advanced mode.
See our ADF forensic tool comparison page here: ADF Product feature comparison
|Live (on) computers|
|Dead (off) computers|
|Removed hard drives|
|External media (CDs, DVDs, SD cards, USB drives, etc.)|
|Drive images (dd, e01)|