ADF Triage-G2

Overview

ADF Triage-G2 is a digital forensics tool for collecting and analyzing evidence from computers and digital devices. It is aimed at qualified military, intelligence, and other organizations conducting sensitive-site exploitation. Its portable workflow and multilingual analysis are strong fits for field teams, but buyers should weigh subscription terms and limits on boot and live scans.

Key features

The two-step process scans, extracts, and analyzes intelligence, with a workflow ADF says is designed for non-technical operators. Deployment from a small USB key suits field reconnaissance where a portable setup matters. ADF also says operators receive training from its digital forensic specialists and certified trainers, or through the National Forensic Science Technology Center.

Evidence sources span iOS and Android devices, computers, USB devices, storage media, documents, emails, text communications, and digital images. Logical acquisition and analysis also cover ChromeOS. Image and folder scans cover Windows, Mac, Linux, iOS, and Android, using dd or e01 images. RAID rebuilding is not supported for image scans, so teams that depend on rebuilding RAID from images should choose another workflow.

Rosoka entity extraction and multilingual translation are standard. Its text analytics processes documents in more than 230 languages to identify entities and locations in unstructured text, making the tool particularly relevant when investigations involve multilingual documents. Exports include PDF, VICS, HTML, and CSV.

Boot-mode scans are described as forensically sound and do not change disks. Live scans access files without modifying timestamps, but running the application leaves traces on the target computer; stealth mode makes those traces harder to locate, not absent. That distinction matters when teams need to select a collection method based on the target and the evidentiary constraints.

Powered-off computer scans require BIOS, UEFI, Secure UEFI, or Mac EFI 2.0 firmware, an Intel 64-bit or compatible CPU, and at least 2 GB RAM. Powered-on computer targets are Windows Vista, 7, 8, or 10, and Server 2008 or 2012. Windows Dynamic Disks are unsupported for boot scans, while live scans support simple volumes only.

Pricing

Triage-G2 uses custom pricing and is sold under one-year or three-year subscription licenses. Support, maintenance, and upgrades are included during the license term, but the license stops working when that term expires. This suits organizations planning a defined operational period and budget; teams seeking a perpetual license should look elsewhere.

Qualified organizations can request a free 30-day evaluation license for ADF products, with full evaluation support. This gives prospective buyers time to assess fit, but it is an evaluation rather than a free ongoing plan. Customer support is free by phone, email, or support request, and ADF says most requests are addressed the same business day.

Platforms

The product runs on Windows, Mac, Linux, iOS, and Android. Evidence environments include ChromeOS for logical acquisition and analysis. Image and folder scanning is listed for Windows, Mac, Linux, iOS, and Android; the supported target systems and hardware requirements still constrain which computer scans are practical.

Who it's for

Triage-G2 is best suited to qualified military, intelligence, and other organizations handling counterterrorism, force protection, and national-security work that need field collection across computer and mobile evidence, plus multilingual text analysis. It is a less natural fit for general-purpose investigations that require RAID rebuilding from images, Windows Dynamic Disk boot scans, or live scans without leaving traces.

Pros and cons

Pros: Portable USB deployment and a workflow intended for non-technical operators suit field teams.

Pros: Standard Rosoka analysis covers 230+ languages and identifies entities and locations in unstructured documents.

Pros: Broad evidence coverage includes mobile devices, computers, storage media, communications, and ChromeOS logical acquisition.

Cons: Custom pricing and a license that stops working at expiry make term and renewal planning important.

Cons: Live scans leave traces, even with stealth mode, while boot scans exclude Windows Dynamic Disks.

Cons: Image scans do not support RAID rebuilding.

Alternatives

Digital Forensics Software is the broader category for comparing tools. Choose Paraben E3 Forensic Platform if a free plan or monthly Basic and Essential subscriptions are preferable; its listed starting plans are $60 a month and $80 a month, respectively. OSForensics is worth considering when a free plan or trial edition is a priority. For a no-cost, free-software option on Linux, macOS, or Windows, consider Hayabusa, NetworkMiner, Plaso, or The Sleuth Kit. Belkasoft X Forensic is another paid option with a trial and perpetual licensing for government customers. Cellebrite Inseyets is a paid alternative with a trial.

Verdict

Choose ADF Triage-G2 if your qualified organization needs portable field triage, broad device and media evidence coverage, and built-in multilingual entity analysis. Its clearest advantage is bringing those capabilities into one field-oriented workflow; its main trade-offs are custom subscription pricing, trace-producing live scans, and restrictions on specific disk configurations. Teams needing RAID rebuilding or Windows Dynamic Disk boot scans should look elsewhere.