program specific sole source CB.docx

ISPFS Digital Forensic Unit Software Use and Sole-Source Letter for Products from Cellebrite In every case, all software listed here is not employed until proper right-to-search documentation (search warrant, written consent, documented verbal consent) is granted by the courts or the owner of the digital device.

Examiners are trained on how to convert lines of computer code to interpretable data long hand but, tools that perform these conversions/interpretations save examiners hours of tedious effort and speed up examinations and ease navigation of increasingly larger amounts of data extracted from digital devices. Forensic software/tools convert digital evidence and/or cellular device/computer code to a human-interpretable format.

Successful analysis of device data of course relies upon the software/tools but of equal import is the associated examiner certification training; not just in the operation of forensic software but also training in the complexities of file architecture of an operating system specific to a given device.

Due to substantial hardware/software architecture and format differences, there are really three divisions of device types of data acquisition/extraction: computers/memory devices, cellular devices, and video/audio data/devices. Due to format differences within all three of these device types, DFU requires a number of specialized tools for each device type.

In order to ensure each software/tool is operating properly, DFU conducts performance verification testing of all software/tools against a known data set (called a “reference”) then testing another tool of the same category of application with the same reference to replicate the results on the reference from software to software within a narrow mean. DFU performance verifications can take up to a week to conduct.

All examinations are potentially subject to court trial. DFU Examiners also must be “performance verified” via rigorous training and certification in the software/tools/examination techniques that are in-use in the lab. Certification training and testing must be completed for each DFU Examiner on software already in service for performance verification and courtroom testimony purposes. These training courses, certifications, re-certifications, and tests can be very expensive (tuition for just one of these classes commonly ranges from $2,000 to $7,000); not to mention associated time/travel/lodging costs incurred to attend the training. ISPFS has already spent thousands of dollars on tuition and travel to attain certifications that are directly attached to the forensic software in-use; these certifications are not transferrable to a separate software/tool.

Cellular Devices: the modern cellular devices architecture and data structures are so different and complicated as to require two separate steps, and therefore two separate categories, of tool to accomplish cellular device forensic work: Data Extraction which is a two-part solution in itself composed of defeating encryption/security on a cellular device AND extraction of all data contained on the device. Without manufacturer-imposed encryption and security measures, cellular device data extraction would be a much simpler proposition. Any encrypted data is uninterpretable by man or machine without a way to decrypt the data into a recognizable file structure. Data encryption is protected by extremely complex algorithms that are impossible to “unlock” or decrypt without the key. Criminal suspects rarely volunteer their device decryption key so very complex processes are employed by highly specialized forensic software to break the decryption and extract the data forensically. Research into decryption technology and engineered solutions require a lot of time and effort from a large team of highly trained and specialized mathematicians and software engineers. Due to the complex problem encryption introduces into forensic process, the software/tools to acquire data from cellular devices are very expensive. Additionally, only a handful of companies even attempt to offer products that are capable of decryption/data extraction for cellular devices; and Data Analysis, analysis of the data that is extracted from the cellular device.

For Cellular Device Data Decrypt/Extraction Cellebrite Universal Forensic Extraction Device (UFED) (in use by DFU. Considered an industry gold-standard for decryption) (full decryption package $111,000/year) (Associated training, $4,900 per course)

· Description

· Software that can defeat cellular device encryption/security and perform a full forensic extraction of data contained on a cellular device.

· Business Need

· Software/tool that can defeat current cellular device (e.g., smartphones: iPhone, Android) encryption/security and perform full data extraction of cellular devices. Cellular device encryption adds an additional and almost insurmountable step blocking simple extraction of data from a device.

· Unique Properties

· Cellebrite has one of the broadest libraries of data that can defeat modern cellular device (primarily iPhone, cheap Chinese, and Android devices’) encryption/security.

· Alternatives

· Magnet Graykey- (in use by DFU. Considered an industry gold-standard for decryption) (full decryption package $108,400/year) (Associated training, $3,900 per course). Like Cellebrite, considered the gold standard of cellular device encryption defeat and data extraction. Software/tool that can defeat current cellular device (e.g., smartphones: iPhone, Android) encryption/security and perform full data extraction of cellular devices. DFU Examiners are certified and trained in Graykey as well. Graykey has been performance verified and approved for use in the DFU lab.

· Belkasoft X Phone (requires purchase of an annual license, $8,000/year) (Associated training, $1,000 per course) The manufacturer claims to defeat encryption/security on some phones; does not claim to perform on the level of Graykey or Cellebrite for vast library of supported cellular devices nor the capability of Graykey/Cellebrite. This software is a good cellular device data analysis tool. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· EnCase Mobile Investigator (requires purchase of an annual license, $7,000/year) (Associated training, $3,000 per course) The manufacturer claims to defeat encryption/security on some phones; does not claim to perform on the level of Graykey or Cellebrite for vast library of supported cellular devices nor the capability of Graykey/Cellebrite. This software is a good cellular device data analysis tool. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· MSAB XRY (requires purchase of an annual license, $11,000/year) (Associated training, $1,200-$3,500 per course) The manufacturer claims to defeat encryption/security on some phones; does not claim to perform on the level of Graykey or Cellebrite for vast library of supported cellular devices nor the capability of Graykey/Cellebrite. This software is a good cellular device data analysis tool. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· Detego Field Triage Mobile (requires purchase of an annual license, $2,795/year) (Associated training, $400 per course) The manufacturer claims to defeat encryption/security on some phones; does not claim to perform on the level of Graykey or Cellebrite for vast library of supported cellular devices nor the capability of Graykey/Cellebrite. This software is a good cellular device data analysis tool. DFU did a trial with Detego a few years ago and didn’t get one phone extraction while Cellebrite/Graykey succeeded in extracting all (DFU developed the opinion that Detego overpromises with their product. Detego is a product of the United Kingdom and, as a result, is very Eurocentric in their solutions). Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· MobilEdit (requires purchase of an annual license) (software $7,000/year, cellular device peripheral (e.g., smartwatch) data extraction $3,000/year) (Associated training, $1,000 per course) The manufacturer claims to defeat encryption/security on some phones; does not claim to perform on the level of Graykey or Cellebrite for vast library of supported cellular devices nor the capability of Graykey/Cellebrite. This software is a good cellular device data analysis tool. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use. MobilEdit is also a European product and as a result mostly offers acquisition of cellular devices available in Europe. MobilEdit has concentrated its efforts on breaking encryption/security and analysis of Chinese manufactured cellular devices.

· Oxygen Forensics (requires purchase of an annual license, $6,500/year) (Associated training, $2,400 per course) The manufacturer claims to defeat encryption/security on some phones; does not claim to perform on the level of Graykey or Cellebrite for vast library of supported cellular devices nor the capability of Graykey/Cellebrite. This software is a good cellular device data analysis tool. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use. **NOTE: As of 9/23/2026, multiple Oxygen company officers have been arrested by USDOJ for wire fraud-company officers falsified statements to the U.S. Government that their company had no foreign ties to adversaries of the U.S. and their software was developed wholly within the U.S. Unfortunately, many company officers are Russian and software development was almost entirely done in Russia.

· Notes

· For cellular device forensics, all listed software requires annual licenses and offer data extraction capabilities from each company’s developed library of phones. However, cellular devices are vastly different by make/model, even same models, year-to-year may have very different security features or even new operating systems than previous phones; not all phones will be covered by all providers. Of these tools however, while most expensive, Cellebrite and Graykey are considered the gold standard. No other software comes close to Cellebrite and Graykey in capability to overcome most devices encryption (of primary consideration); in commitment of resources to research/development; in maintenance of a vast library of supported phones; in rendering consistent data extractions; and in offering constant updates to their device libraries. Cellebrite and Graykey extraction capabilities are on such a level as to relegate all other offerings to data analysis-only. DFU Examiners are certified in Graykey and Cellebrite. Graykey and Cellebrite have been performance verified and approved for DFU lab use. NOTE: Cellebrite/Graykey capabilities improve case turnaround time and allow the best service to all jurisdictions in Idaho. Prior to use of Cellebrite and Graykey, DFU’s success rate with all phones submitted for extraction dropped to 15% (primarily due to the levels of encryption in cellular devices); with the adoption of Cellebrite/Graykey that percentage jumped to 85-90%.

For Cellular Device Data Analysis:

Cellebrite Physical Analyzer (PA) (Currently in use by DFU, Annual license, $4,400 per license/per year, one license in use, considered an industry gold standard) (Associated training, $4,800 each course)

· Description

· Software that features tools to analyze the unique file systems of cellular device extracted data.

· Business Need

· Software/tools that can analyze the extracted data and parse out unique files systems of cellular devices.

· Unique Properties

· PA has the capability to perform all needs listed above and has the capability to interpret/parse/analyze complicated data packets from Apple iCloud servers, Instagram, Facebook, Google, Snapchat, Discord, TextNow, Vimeo, SkyECC, What’s App, Unmanned Aerial Systems (UAS), vehicle infotainment systems, and computer data extractions.

· PA can analyze multiple cellular device data extractions at once for analysis to find correlating evidence and patterns.

· Alternatives

· Magnet Axiom (Currently in use by DFU. Annual license, $5,750 per license/year, currently two licenses in use. Considered an industry gold-standard for cellular device data analysis) (Associated training, $3,900 per course) Axiom can be used to analyze computer, digital devices, AND cellular device data (to DFU’s knowledge, Axiom is the only data extraction/analysis software that can manage cellular devices and computers analysis in one software). Axiom can also be used to analyze Cellebrite data extractions. DFU Examiners are certified and trained in Axiom as well. Axiom has been performance verified and approved for use in the DFU lab.

· Belkasoft X Phone (requires purchase of an annual license, $8,000/year) (Associated training, $1,000 per course) This software is a good cellular device data analysis tool but does not possess PA’s additional parsing and cross-device analysis capabilities; higher annual license cost than PA. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· EnCase Mobile Investigator (requires purchase of an annual license, $7,000/year) (Associated training, $3,000 per course) This software is a good cellular device data analysis tool but does not possess PA’s additional parsing and cross-device analysis capabilities; higher annual license cost than PA. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· MSAB XRY (requires purchase of an annual license, $11,000/year) (Associated training, $1,200-$3,500 per course) This software is a good cellular device data analysis tool but does not possess PA’s additional parsing and cross-device analysis capabilities; higher annual license cost than PA. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· Detego Field Triage Mobile (requires purchase of an annual license, $2,795/year) (Associated training, $400 per course) This software is a good cellular device data analysis tool but does not possess PA’s additional parsing and cross-device analysis capabilities; higher annual license cost than PA. Detego is a product of the United Kingdom and, as a result, is very Eurocentric in their solutions). Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· MobilEdit (requires purchase of an annual license) (software $7,000/year, cellular device peripheral (e.g., smartwatch) data extraction $3,000/year) (Associated training, $1,000 per course) This software is a good cellular device data analysis tool but does not possess PA’s additional parsing and cross-device analysis capabilities; higher annual license cost than PA. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use. MobilEdit is also a European product and as a result mostly offers acquisition of cellular devices available in Europe. MobilEdit has concentrated its efforts on analysis of Chinese manufactured cellular devices.

· Oxygen Forensics (requires purchase of an annual license, $6,500/year) (Associated training, $2,400 per course) This software is a good cellular device data analysis tool but does not possess PA’s additional parsing and cross-device analysis capabilities; higher annual license cost than PA. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use. **NOTE: As of 9/23/2026, multiple Oxygen company officers have been arrested by USDOJ for wire fraud-company officers falsified statements to the U.S. Government that their company had no foreign ties to adversaries of the U.S. and their software was developed wholly within the U.S. Unfortunately, many company officers are Russian and software development was almost entirely done in Russia.

· Notes

· None