Icon Menu
Icon Search

ADF Digital Evidence Investigator

ADF Solutions has designed triage and digital forensic training programs to equip both technical and non-technical investigators with the knowledge and skills they need to use ADF software tools to immediately extract conclusive intelligence and evidence from computers and digital media.

Each course is taught by an ADF Digital Forensic Specialist and Trainer on-site at your location. We typically recommend a class size of up to 12 students in a computer lab.

Four courses are currently offered based on the product you and your team purchase and want to be trained on. If your team is using a PRO version of ADF software or a combination of ADF products we will train your team on how to use each product as well as how ADF software products work together to help you solve investigations.

ADF Solutions offer four Digital First Responder classes are:

  • Digital Evidence Investigator (View DEI Training Course Outline) - Now Available Online as a Self Paced Course with Certification

  • Mobile Device Investigator (View MDI Training Course Outline) - Now Available Online as a Self Paced Course with Certification

  • Triage-Investigator (View Triage-Investigator® Training Course Outline)

  • Triage-G2 (View Triage-G2® Training Course Outline)


We offer a 2-Day hands-on, instructor-led Digital Evidence Investigator training.  Students  will learn how to configure DEI, operate the digital forensic software, analyze and interpret the evidence and forensic results. 

Available Online

This course is also available online with self-paced learning via our learning management system. Start today to earn your DEI Certified User Certificate today. The online self paced learning can be completed in about 16 hours. 

Course Outline

Introductions & Getting Started

  • Digital Forensic Evidence and Triage Basics

  • Overview of How to Use Digital Evidence Investigator® (also knows as DEI)

    • DEI Terminology – Artifact Captures

    • DEI Terminology – File Captures

    • DEI Search Profiles – Quick, Intermediate and Comprehensive

    • Digital Evidence Investigator Workflow

Setup & Installation

  • Digital Evidence Investigator Software Installation and the Windows Assessment and Deployment Kit (WADK)

Booting & Bios 

  • Accessing BIOS/UEFI Setup

  • Accessing Boot Menu

  • UEFI and Fastboot Issues

  • Booting Apple Macintosh computers

Capture: Conducting a Scan

  • Case Study: Scanning attached media

  • Case Study: Scanning drive images

  • Case Study: Carrying out a boot scan

  • Case Study: Carrying out a live scan

Analysis: Navigating DEI 

  • Navigating Capture Results

  • Understanding Picture, Video, Keyword, Files and Timeline Views

  • Column Settings

  • Filtering Captures and Picture, Video, Keyword, Files and Timeline views

  • Tagging

  • Commenting


  • Case Study: Creating appropriate reports

  • Reporting - HTML

  • Reporting - CSV

  • Reporting – Stand-alone viewer

Customising with Keywords and Hash Values

  • Case Study: Creating hash captures and leveraging targeted folders

  • Case Study: Creating keyword and regular expression searches

  • Case Study: Creating appropriate search profiles

  • Case Study: Importing keyword and hash lists

  • Case Study: Identifying good and bad keywords


  • Device Imaging

Advanced Issues

  • Implications of thorough file identification and searching within containers

  • File type creation and implications

  • Searching browser cache issues

  • Case Study: Knowledge check

Get in touch with us today to discuss your training needs, learn more, or set up a private training for your investigators or examiners. 


Duration - 16 hours

Available on demand

Enquire about this training course