ADF Triage-G2 vs Tsurugi Linux

ADF Triage-G2 is digital forensic triage software for computer and media exploitation during sensitive site exploitation. ADF describes that work as supporting military and intelligence needs such as counterterrorism, force protection, and national security. Designed for non-technical operators, it uses a two-step process to scan devices, extract material, and analyze intelligence. It can be deployed on a small USB key for field reconnaissance. Rosoka entity extraction and multilingual translation are standard; ADF says its text analytics processes documents in 230+ languages to identify entities and locations in unstructured documents. The software handles evidence from computers, iOS and Android devices, USB devices, storage media, documents, emails, text communications, and digital images. Listed export formats are PDF, VICS, HTML, and CSV. Boot-mode tools do not change disks, according to ADF; live scans avoid changing file timestamps but leave traces, which stealth mode makes harder to locate. Pricing is available on request, with one-year or three-year subscription licenses that include support, maintenance, and upgrades during the term. There is no free plan; a free 30-day evaluation is available to qualified organizations.

Tsurugi Linux is a free Linux distribution for digital forensics, incident response, malware analysis, and OSINT. Its 64-bit [LAB] edition is based on Ubuntu 24.04.3 LTS with a custom kernel based on version 6.19.10, including kernel-level device write blocking. It also provides a Computer Vision analysis section and an OSINT profile switcher. The system can run live, although the project’s primary aim is an installed forensics lab. Tsurugi Acquire is a separate lightweight 32-bit live edition for booting a computer and acquiring mass-storage devices. The related Bento toolkit contains over 300 applications for live forensics and incident response on Windows, Linux, and macOS. The project recommends checking image hashes and verifying signatures with its PGP public key. [LAB] updates come from official Ubuntu repositories, but the FAQ warns that dist-upgrade can break the operating system. Tsurugi Linux [LAB] and Tsurugi Acquire are free under the GNU General Public License and supplied without warranty; some included tools are not open source. Evidence work can cover disks, volatile memory, mobile devices, file systems, OS artifacts, and cloud sources.