ADF Triage-G2 vs SUMURI PALADIN

ADF Triage-G2 is digital forensic triage software for computer and media exploitation during sensitive site exploitation. ADF describes that work as supporting military and intelligence needs such as counterterrorism, force protection, and national security. Designed for non-technical operators, it uses a two-step process to scan devices, extract material, and analyze intelligence. It can be deployed on a small USB key for field reconnaissance. Rosoka entity extraction and multilingual translation are standard; ADF says its text analytics processes documents in 230+ languages to identify entities and locations in unstructured documents. The software handles evidence from computers, iOS and Android devices, USB devices, storage media, documents, emails, text communications, and digital images. Listed export formats are PDF, VICS, HTML, and CSV. Boot-mode tools do not change disks, according to ADF; live scans avoid changing file timestamps but leave traces, which stealth mode makes harder to locate. Pricing is available on request, with one-year or three-year subscription licenses that include support, maintenance, and upgrades during the term. There is no free plan; a free 30-day evaluation is available to qualified organizations.

SUMURI PALADIN is a donation-supported live Linux environment for forensic imaging, triage, and recovery. PALADIN 9 LTS uses Ubuntu 24.04 LTS and is modified to prevent changes to attached media and disable automatic mounting at boot. Its graphical Toolbox handles imaging, logical acquisitions, hashing, and device mounting, with read-only options and logging. Included software includes Autopsy, The Sleuth Kit, and other open-source forensic tools. Supported image formats include E01/Ex01, RAW (.dd), SMART, AFF, VHD, and VMDK. PALADIN LTS can mount and image through NFS or SMB networks and supports BitLocker-encrypted Windows partitions from Vista through Windows 10. It integrates Arsenal Image Mounter Remote Agent for advanced mounting and live or remote analysis. Persistent Mode preserves reports and configurations between prepared sessions, subject to extra free space. PALADIN runs as a Linux live environment on 64-bit and 32-bit PC hardware.