ADF Triage-G2 vs Hayabusa

ADF Triage-G2 is digital forensic triage software for computer and media exploitation during sensitive site exploitation. ADF describes that work as supporting military and intelligence needs such as counterterrorism, force protection, and national security. Designed for non-technical operators, it uses a two-step process to scan devices, extract material, and analyze intelligence. It can be deployed on a small USB key for field reconnaissance. Rosoka entity extraction and multilingual translation are standard; ADF says its text analytics processes documents in 230+ languages to identify entities and locations in unstructured documents. The software handles evidence from computers, iOS and Android devices, USB devices, storage media, documents, emails, text communications, and digital images. Listed export formats are PDF, VICS, HTML, and CSV. Boot-mode tools do not change disks, according to ADF; live scans avoid changing file timestamps but leave traces, which stealth mode makes harder to locate. Pricing is available on request, with one-year or three-year subscription licenses that include support, maintenance, and upgrades during the term. There is no free plan; a free 30-day evaluation is available to qualified organizations.

Hayabusa is a free, open-source tool for Windows event log forensics and threat hunting. It processes EVTX logs from one host or thousands into CSV, JSON or JSONL timelines. Analysis features include computer and event ID metrics, logon summaries, keyword pivoting, HTML summary reports and MITRE ATT&CK mapping. It supports the Sigma specification, including v2 correlation rules; the project describes its curated detection rules as numbering over 4,000. The project says its multithreaded Rust implementation can deliver up to a 5x speed improvement and describes Rust as memory-safe. Hayabusa can run live on one system, process collected logs offline or hunt across endpoints through the Velociraptor Hayabusa artifact. Results can be imported into Elastic Stack, Timesketch and Timeline Explorer, while JSON can be analyzed with jq. Special Windows live-response packages bundle the program with encoded rules and configuration files to reduce files written to the system and help avoid antivirus false positives on YAML rule files. It runs on Windows, macOS and Linux, but no Linux ARM MUSL binary is provided because it does not run properly. The software uses AGPLv3; detection rules use DRL 1.1.