Exploits, Tools & Data Recovery · The Forensic Tool Landscape · Lesson 1 of 5

Commercial Forensic Suites

Meet the big forensic vendors, what their tools do and who may buy them.

The big names

You saw in Mobile Forensics that an examination moves through stages: get a copy of the data, make sense of it, then report what it shows. A handful of companies sell the commercial software, and sometimes hardware, that most labs use for those stages. Their products tend to do four jobs:

• Acquire: make a copy (an extraction) of data from a phone, a backup or a cloud account.
• Decode: turn raw files and databases into readable records such as messages, calls and locations. The rules a tool uses to read one app's data are called parsers.
• Analyze: search, filter and build timelines and maps across everything decoded.
• Report: export findings in a form other people can review.

Here are the main names, as their own public pages describe them:

• Cellebrite (Israel) now sells its forensic software as Inseyets, which it calls an all-in-one suite. Parts include Inseyets.UFED for extraction (the successor to its long-running UFED line), Inseyets.PA (Physical Analyzer) for decoding and analysis, Cellebrite Reader for reviewing results, and a separately sold add-on for access to locked devices.
• Magnet Forensics (founded in Canada) sells Axiom, which it says can recover, analyze and report on data from mobile, computer, cloud and vehicle sources, plus Axiom Cyber for corporate investigations. In 2023 the investment firm Thoma Bravo agreed to buy Magnet and combine it with Grayshift, maker of Graykey, which Magnet describes as a way to access and extract data from iOS and Android devices.
• MSAB (Sweden) sells XRY for extraction, XAMN for analysis and XEC for managing a lab's tools and users.
• Oxygen Forensics sells Oxygen Forensic Detective, which it markets for phones, cloud services and drones.
• Belkasoft sells Belkasoft X, which covers computers, phones and cloud data in one product.

Some products do one job, while suites try to cover all four. Many labs own more than one, which matters later in this course.

Who can buy them

These aren't consumer apps. Vendors sell licenses, often yearly subscriptions, to organizations, and most check who a customer is first.

• Law enforcement and government: police labs, border agencies, military and intelligence units. MSAB says it serves law enforcement, defense and government agencies in more than 100 countries.
• Corporate and legal: companies investigating misconduct or breaches, and firms doing eDiscovery (collecting electronic evidence for lawsuits). Cellebrite and Magnet both market products for these teams.

Tools that get past a lock screen are kept on a shorter leash. Magnet labels Graykey exclusive for public safety, says it isn't available to the private sector, and only accepts vetted inquiries from agency email addresses. Cellebrite sells locked-device access as a separate add-on.

Vendors also limit where they sell. Cellebrite says it doesn't sell to countries sanctioned by the US, EU, UK or Israeli governments, or to those on the blacklist of the Financial Action Task Force (an international anti-money-laundering body). It announced in October 2020 that it had stopped selling in China and Hong Kong, and in March 2021 Haaretz reported it would stop sales to Russia and Belarus. In a September 2021 statement Cellebrite listed Bangladesh, Belarus, China, Hong Kong, Macau, Russia and Venezuela as places it had chosen not to do business, partly over human rights concerns. In December 2024 it said that since 2020 it had stopped selling to customers in more than 60 countries.

A policy isn't perfect control. The Intercept reported in 2021 that Chinese police kept buying Cellebrite products through resellers after the exit. Cellebrite replied that its units there had been deactivated, that one named reseller had destroyed its units and that the other was never an authorized reseller.

Governments add their own rules, since vendors in Israel, Sweden and the US must follow their countries' export and sanctions laws. Licenses help too. Cellebrite says customers who break its license terms lose support and renewals, and that most of its hardware stops working once a license expires.