ADF Triage-G2

ADF Triage-G2 is digital forensic triage software for computer and media exploitation during sensitive site exploitation. ADF describes that work as supporting military and intelligence needs such as counterterrorism, force protection, and national security. The tool is designed for non-technical operators and uses a two-step process to scan devices, extract information, and analyze intelligence. It can be carried on a small USB key for field reconnaissance. Standard Rosoka features identify entities and translate text; ADF says its text analytics processes documents in 230+ languages to find entities and locations in unstructured material. Evidence sources include mobile devices, computers, USB devices, storage media, documents, emails, text communications, and digital images. Listed capabilities include mobile forensics and disk imaging, with exports to PDF, VICS, HTML, and CSV. Evidence environments include Windows, Mac, Linux, iOS, Android, and ChromeOS. Boot-mode tools do not change disks, according to ADF; live scans avoid changing timestamps but leave traces, which stealth mode makes harder to locate. Pricing is on request, with a free 30-day evaluation for qualified organizations. Licenses run for one or three years and include support, maintenance, and upgrades during the term.

Triage-G2 combines device triage, multilingual text analysis, and field deployment for sensitive-site evidence work. Organizations should account for the qualified-organization trial terms and the traces left by live scans.

Triage-G2 is aimed at qualified organizations conducting sensitive-site digital evidence work, including military and intelligence users. Its design for non-technical operators and portable deployment may suit field reconnaissance teams.

Overview

ADF Triage-G2 is digital forensic triage software for examining computers, mobile devices, and other evidence in sensitive-site exploitation. It is best suited to qualified military, intelligence, and other organizations that need field deployment and multilingual document analysis. Its scope is specialized: teams must weigh subscription licensing against live-scan traces and a boot-scan limitation.

Key features

The two-step scan, extraction, and analysis workflow is designed for non-technical operators, while deployment from a small USB key suits field reconnaissance where portability matters. Training is part of the picture: ADF says operators are trained by its forensic specialists and certified trainers, or by the National Forensic Science Technology Center.

Evidence sources include iOS and Android devices, computers, USB devices, storage media, documents, emails, text communications, and digital images. Logical acquisition and analysis also support ChromeOS. Image and folder scans cover Windows, Mac, Linux, iOS, and Android, with dd and e01 image formats. RAID rebuilding is not supported for image scans, so teams that need that step should choose another workflow.

Rosoka entity extraction and multilingual translation are standard. Its text analytics handles documents in 230+ languages to identify entities and locations in unstructured material, a meaningful advantage for teams working across languages. Exports are available in PDF, VICS, HTML, and CSV.

Boot-mode scans are described as forensically sound and do not change disks. Live scans access target files without modifying timestamps, but the application still leaves traces on the target computer. Stealth mode makes those traces harder to locate; it does not eliminate them. Powered-off computer scans require supported BIOS, UEFI, Secure UEFI, or Mac EFI 2.0 firmware, an Intel 64-bit or compatible CPU, and at least 2 GB RAM. Windows Dynamic Disks are unsupported for boot scans, and live scans support simple volumes only.

Pricing

Triage-G2 uses custom pricing and is sold on one-year or three-year subscription licenses. Support, maintenance, and upgrades are included during the term, but the license stops working when that term expires, so renewal is central to continued use. There is no free plan.

A free 30-day evaluation license is offered to qualified organizations, with full support during evaluation. This is a short-term way for eligible teams to assess fit, not an ongoing free tier.

Platforms

Triage-G2 is listed for Android, iOS, Linux, macOS, and Windows. Its evidence workflows extend to ChromeOS, while image and folder scans cover Windows, Mac, Linux, iOS, and Android. Technical specifications also describe powered-on Windows Vista/7/8/10 and Server 2008/2012 targets, alongside powered-off systems meeting the stated firmware requirements.

Who it's for

ADF positions sensitive-site exploitation for military and intelligence officers working on counterterrorism, force protection, and other national security needs. Triage-G2 is therefore a focused choice for qualified organizations with trained operators and a need to collect and analyze mixed digital evidence in the field. It is less suitable for teams that need RAID rebuilding from images, support for Windows Dynamic Disks in boot scans, or a license that continues beyond its paid term.

Pros and cons

Pros

• Broad evidence coverage: supports mobile devices, computers, storage media, communications, documents, and digital images, with ChromeOS included for logical acquisition and analysis.
• Multilingual analysis included: Rosoka processes documents in 230+ languages and identifies entities and locations, without being a separate add-on in the standard product.
• Field-ready workflow: USB-key deployment and a process designed for non-technical operators suit reconnaissance teams working away from a fixed workstation.
• Supported subscription services: support, maintenance, and upgrades are included during the one- or three-year license term.

Cons

• Qualified-organization trial: the 30-day evaluation is not a general free option, and there is no free plan.
• Term-dependent access: the license stops working at expiration, requiring renewal for continued use.
• Live scans leave traces: stealth mode makes them harder to find but does not remove them; this matters when minimizing evidence on the target is critical.
• Workflow exclusions: image scans do not rebuild RAID, boot scans do not support Windows Dynamic Disks, and live scans are limited to simple volumes.

Alternatives

Digital Forensics Software is a useful starting point for comparing tools across the category.

• OSForensics is worth considering if a free plan or trial matters more than Triage-G2’s stated focus on sensitive-site field work.
• Paraben E3 Forensic Platform may suit buyers who prefer a published monthly plan, including Basic-Monthly at $60 a month, over custom pricing.
• Belkasoft X Forensic is an option for government customers considering a perpetual license rather than Triage-G2’s term-based subscriptions.
• MSAB XRY may fit recognized law enforcement, military, government departments, or qualifying private businesses seeking a quote-based tool.
• Exterro FTK Imager is a better match for a Windows-only imaging and preview need, with a free tool and a $499 a year Pro plan.
• SUMURI PALADIN is a Linux alternative with a free PALADIN LTS option; corporate users must donate at least $25.
• Arkime is a free, open-source option for readers seeking software with no license fees.
• CAINE is a free Linux and Windows ISO alternative.

Verdict

Choose ADF Triage-G2 if your qualified organization needs portable sensitive-site evidence triage, broad device coverage, and multilingual analysis in one specialized workflow. Its principal advantage is the combination of field deployment and standard Rosoka analysis; look elsewhere if a general free tier, RAID rebuilding, Windows Dynamic Disk boot scans, or trace-free live scanning is essential.