ADF 6.3: Advancing Triage-First Digital Investigations

Introduction

Digital investigations are evolving.

Investigators today face an unprecedented volume of digital evidence — more devices, more applications, and increasing pressure to deliver answers quickly while maintaining evidentiary integrity. Traditional workflows built around full forensic acquisition alone are no longer sufficient for modern investigative environments.

ADF 6.3 introduces new capabilities designed to help agencies move faster from device seizure to investigative insight while maintaining security, efficiency, and operational confidence.

This release represents another step toward a triage-first investigative model, enabling investigators to identify relevant evidence earlier, reduce unnecessary processing, and focus forensic resources where they matter most.

Built for Faster Investigative Decisions

One of the most significant advancements in ADF 6.3 is the introduction of targeted device acquisition and scanning.

Investigators can now selectively acquire and analyze connected Android, iOS, and ChromeOS devices with the option to automatically delete acquisitions immediately after analysis. When deletion is selected, acquisitions are encrypted on-the-fly prior to scanning, ensuring sensitive data remains protected and unrecoverable once removed.

This capability supports agencies that must balance investigative speed with strict data-handling and privacy requirements.

Instead of collecting everything first and reviewing later, investigators can quickly determine investigative value at the point of triage.

Expanded Access to Mobile Evidence

Mobile devices continue to generate critical investigative intelligence across communications, location activity, and personal data applications.

ADF 6.3 expands supported evidence sources, including:

• Gmail data extraction with plain text and HTML message bodies
• Samsung Notes artifact integration
• Google Maps saved locations
• Zangi communications data, including messages, contacts, and calls
• Improved browser cache analysis capturing additional referenced media files

These additions help investigators uncover context and relationships earlier in an investigation without expanding forensic backlogs.

Supporting Real-World Forensic Workflows

Modern investigations rarely rely on a single acquisition method. Agencies often work across multiple tools and evidence sources.

ADF 6.3 introduces expanded compatibility with existing forensic ecosystems, including:

• Scanning of iTunes backups, including encrypted backups with password validation
• Support for FFS logical images created using Cellebrite UFED tools
• Improved handling of encrypted storage environments such as FileVault2

These enhancements allow investigators to analyze more evidence sources within a unified triage workflow.

Designed Around Investigator Experience

Efficiency during investigations depends not only on capability but usability.

ADF 6.3 includes several workflow and interface improvements driven by investigator feedback:

• Reorganized navigation for faster access to investigative functions
• Dedicated viewing tabs for large artifacts such as message content and emails
• New dark mode interface for low-light environments
• Updated visual design aligned with ADF’s 2026 branding
• Performance improvements for Android acquisitions
• Easier access to acquisition metadata through direct hyperlinks

Together, these updates reduce friction during analysis and help investigators remain focused on investigative outcomes rather than tool management.

Strengthening Security Throughout the Acquisition Process

Handling digital evidence requires strict attention to data security.

ADF 6.3 enhances acquisition protection by enabling encryption before scanning begins when automatic deletion workflows are selected. This approach ensures that temporary investigative data is safeguarded throughout the process while minimizing long-term storage risks.

The result is a triage workflow that supports both operational efficiency and responsible evidence handling.

Continuing the Shift Toward Triage-First Investigations

Across law enforcement, corporate investigations, and digital forensic units, agencies are increasingly adopting triage workflows to address growing investigative demand.

ADF’s continued investment in targeted acquisition, expanded artifact coverage, and investigator-focused usability reflects a broader industry transition: moving from evidence collection alone toward faster investigative decision-making.

ADF 6.3 is designed to support that transition.

See ADF 6.3 in Action

ADF 6.3 is now available.

Organizations interested in learning how these capabilities support modern investigative workflows can explore the full release details or join our upcoming live session demonstrating the new features and real-world investigative use cases.

👉 Download ADF 6.3
👉 Register for the May 20 live webinar

Looking Ahead

Digital investigations will continue to evolve as devices, applications, and data volumes grow.

ADF remains focused on helping investigators adapt to that reality — delivering tools that prioritize speed, usability, and investigative clarity while maintaining forensic rigor.

ADF 6.3 represents another step forward in enabling investigators to obtain answers faster and operate with confidence in an increasingly complex digital landscape.