LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.ADF Solutions
Digital Evidence Investigator
Digital Evidence Investigator, or DEI, is ADF's triage tool for computers and storage media. It scans a machine from a USB Collection Key, live or from boot, against prepared search profiles. ADF's site now leads with ADF PRO, which adds mobile devices. The DEI page is marked for customer renewals.
SoftwareCommercialTransitioningWindows
Profile
- Manufacturer
- ADF Solutions
- Category
- Computer forensics
- Product type
- Software
- Platforms
- Windows
- Licensing
- Commercial
- Product status
- Transitioning
- Educational level
- Beginner
- Last verified
- 2 November 2026
Marked Transitioning. ADF's DEI page carries the heading Customer Renewals Only and its home page lists Digital Evidence Investigator, Mobile Device Investigator and ADF PRO, the last described as the combined product. The earlier name DEI PRO does not appear on the pages checked. The page gives a recommended specification of Windows 10 64-bit, which is why Windows is listed. The DEI page failed to load on a first attempt on 2 November 2026 and loaded on a second.
What Digital Evidence Investigator is
Triage answers a different question from a full examination: is there anything here that justifies seizing this machine and sending it to the lab? DEI is built for that moment. An officer prepares search profiles, built-in or custom, on a Collection Key. At the scene the key either boots a switched-off Windows or Linux computer, which ADF describes as forensically sound because the target media is not written to, or runs a live scan on a running Windows or Mac system, capturing RAM as well. Results appear as the scan runs, with keyword, regular expression, hash and PhotoDNA matching, image classification and a timeline of files, artefacts and user activity.
An Authentication Key, which is the licence dongle, lets one licence scan several computers on site. Findings can be tagged, commented and exported to HTML, PDF, CSV and VICS, with JSON for other applications. A shareable report viewer lets investigators and prosecutors read them. ADF's comparison page shows that connected iOS and Android devices need ADF PRO, the combined computer and mobile product that has replaced the earlier DEI PRO name. The DEI page itself carries the heading Customer Renewals Only, so a new buyer is being steered to ADF PRO.
Primary applications
Where it is used
- On-scene triage of computers before a seizure decision
- Boot scans of switched-off Windows and Linux machines without writing to the disk
- Live scans of running Windows and Mac systems with RAM capture
- Scanning USB drives, SD cards and optical media
- Early case assessment with profiles for specific offence types
- Sharing results with investigators through the report viewer
Who uses it
- Front-line and search team officers
- Investigators doing early case assessment
- Corporate security teams checking machines on site
- Students learning the difference between triage and examination
Capabilities and limits
Major capabilities
- Boot scan of turned-off Windows and Linux computers with the Collection Key
- Live scan of Windows and Mac computers, including RAM capture
- Built-in and custom search profiles
- Keyword, regular expression, hash value and PhotoDNA matching
- Image classification and artefact relationships
- Single timeline of files, artefacts and user activity
- Authentication Key for multiple on-site scans under one licence
- Reports in HTML, PDF, CSV and VICS, plus JSON export
- Recommended host specification of Windows 10 64-bit
Technical limitations
- Triage, not full examination; a positive result still needs a laboratory analysis
- Live scans change the running system and can miss areas the operating system restricts
- Linux targets support boot scan only; ChromeOS and mobile devices need ADF PRO
- The product page is marked Customer Renewals Only, so new purchasers are directed to ADF PRO
- Search profiles find what they were told to look for; a poorly built profile misses evidence
Learning with DFRTI
Independent professional education covering the principles and workflows of Digital Evidence Investigator. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- What a forensically sound boot scan is and why live scans differ
- Basic Windows and Mac artefacts
- Legal limits on searching a device at the scene
Disciplines
Related tools
- Magnet AxiomAxiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.Magnet Forensics
- OpenText Forensic (EnCase)EnCase Forensic, one of the oldest names in computer forensics, is now called OpenText Forensic (EnCase). OpenText says it is the same product, renamed to fit its cybersecurity portfolio.OpenText
- Exterro FTK ImagerFTK Imager is the free tool most learners meet first. It makes forensic images of drives, folders and memory, verifies them with hashes and lets an examiner preview evidence before committing to a full acquisition.Exterro
- AutopsyAutopsy is a free, open source examination platform that puts a graphical interface and ingest modules on top of The Sleuth Kit. For a student it is the first tool that shows a whole case from image to report at no cost.Sleuth Kit Labs
- KAPE (Kroll Artifact Parser and Extractor)KAPE copies the files an examiner needs from a Windows system or image in minutes and then runs other programs over them. It is the quickest route from a live machine to parsed artefacts.Kroll
Courses that cover this tool
LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.
StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.
StorageDigital Storage ForensicsUSB / Pen Drive ForensicsExamine pen drives and memory sticks and prove which USB device touched which computer.
LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.