program specific sole source MAGNET.docx

ISPFS Digital Forensic Unit Software Use and Sole-Source Letter for Magnet Forensic Products Software/tools that provide full extraction/acquisition/capture of data from a digital device (e.g., computer, cellular device) without changing or compromising any of the original data (forensic) on the original device. Software/tools then assist examiners in the analysis of the data captured in a forensic manner.

In every case, all software listed here is not employed until proper right-to-search documentation (search warrant, written consent, documented verbal consent) is granted by the courts or the owner of the digital device.

Examiners are trained on how to convert lines of computer code to interpretable data long hand but, tools that perform these conversions/interpretations save examiners hours of tedious effort and speed up examinations and ease navigation of increasingly larger amounts of data extracted from digital devices. Forensic software/tools convert digital evidence and/or cellular device/computer code to a human-interpretable format.

Successful analysis of device data of course relies upon the software/tools but of equal import is the associated examiner certification training; not just in the operation of forensic software but also training in the complexities of file architecture of an operating system specific to a given device.

Due to substantial hardware/software architecture and format differences, there are really three divisions of device types of data acquisition/extraction: computers/memory devices, cellular devices, and video/audio data/devices. Due to format differences within all three of these device types, DFU requires a number of specialized tools for each device type.

In order to ensure each software/tool is operating properly, DFU conducts performance verification testing of all software/tools against a known data set (called a “reference”) then testing another tool of the same category of application with the same reference to replicate the results on the reference from software to software within a narrow mean. DFU performance verifications can take up to a week to conduct.

All examinations are potentially subject to court trial. DFU Examiners also must be “performance verified” via rigorous training and certification in the software/tools/examination techniques that are in-use in the lab. Certification training and testing must be completed for each DFU Examiner on software already in service for performance verification and courtroom testimony purposes. These training courses, certifications, re-certifications, and tests can be very expensive (tuition for just one of these classes commonly ranges from $2,000 to $7,000); not to mention associated time/travel/lodging costs incurred to attend the training. ISPFS has already spent thousands of dollars on tuition and travel to attain certifications that are directly attached to the forensic software in-use; these certifications are not transferrable to a separate software/tool.

Data Extraction/Analysis Tools For Computers/Associated Memory Media:

Magnet Axiom (Annual license, $5,750 per license/year, currently two licenses in use) (Associated training, $3,900 per course)

· Description

· Software that can perform a full forensic extraction/acquisition of all data contained on a memory device (e.g., computer hard disk drive) and analysis of extracted data.

· Business Need

· Software/tool that provides full extraction/acquisition/capture of computer data from the first bit of data to the last bit without changing or compromising any of the original data (forensic) on the original device. This software should also feature notable analysis tools: text/code search tools with filters; picture searches (with specialized capabilities); flexible file organization/exclusion; video file searches; recognition of common file structures; code/compound file/database parsing; file extension mismatch; data categorization; registry parsing; peripheral device/WiFi network parsing; file concatenation; hash algorithm; searches by hash/characteristic; partition recovery; BitLocker recognition; analysis for correlating activity across multiple digital devices/pattern identification; and regular manufacturer updates to keep pace with technology development. Capability to analyze multiple devices’ data simultaneously and find related content and patterns a plus.

· Unique Properties

· Axiom can perform verified computer data extraction from a wide variety of devices. Not just computer hard drives, Unmanned Aerial Systems (UAS, “drones”), thumb drives, flash drives, any standard computer memory media.

· In addition, Axiom can also be used to analyze data from digital devices listed above, AND cellular device data (to DFU’s knowledge, Axiom is the only data extraction/analysis software that can manage cellular devices and computers analysis in one software).

· Axiom can also analyze multiple devices’ data simultaneously and find related content and patterns.

· Alternatives

· X-Ways Forensics (Currently in use by DFU, Annual license, $1,550 per license/per year, two licenses in use) (Associated training, $2,200 per course) X-Ways can perform verified computer data extraction from a wide variety of devices. One of the best price points for such a powerful and full featured forensic tool on the market. Considered an industry standard. In addition, X-Ways can also be used to simultaneously analyze computer, other devices, and parse out certain types of cellular device data. DFU Examiners are certified and trained in X-Ways as well. X-Ways has been performance verified and approved for use in the DFU lab.

· Belkasoft X Computer (requires purchase of an annual license, $1,200/year) (Associated training, $1,000 per course) The manufacturer claims all the extraction capabilities of Axiom, however, per the industry, not nearly as robust a data analysis tool as Axiom. Would require an additional separate software/annual license to analyze cellular device data. Would require examiners to re-train/re-certify. Would require a new performance verification to be approved for lab use.

· Detego Field Triage Computer (requires purchase of an annual license, $1,200/year) (Associated training, $1,000 per course) The manufacturer claims all the extraction capabilities of Axiom, however, per the industry, not nearly as robust a data analysis tool as Axiom. Would require additional separate software to analyze cellular device data. Would require examiners to re-train/re-certify. Would require a new performance verification to be approved for lab use.

· FTK Forensic Tool Kit (requires purchase of an annual license, $5,175/year) (Associated training, $3,450 for year subscription to training catalog) The manufacturer claims all the extraction capabilities of Axiom, however, per the industry, not nearly as robust a data analysis tool as Axiom. Would require an additional separate software/annual license to analyze cellular device data. Would require examiners to re-train/re-certify. Would require a new performance verification to be approved for lab use.

· OpenText EnCase (requires purchase of an annual license, $4,000/year) (Associated training, $3,000 per course) The manufacturer claims all the extraction capabilities of Axiom, however, per the industry, and DFU experience, not nearly as robust a data analysis tool as Axiom. Would require additional separate software to analyze cellular device data. DFU used EnCase heavily until about ten years ago. DFU determined loss of efficacy in casework. Would require examiners to re-train/re-certify. Would require a new performance verification to be approved for lab use.

· Get Data Forensic Explorer (FEX) (requires purchase of an annual license, $2,695/year) (Associated training, $3,500 per course) The manufacturer claims all the extraction capabilities of Axiom, however, per the industry, not nearly as robust a data analysis tool as Axiom. FEX does not offer a cellular device examination module. One DFU Examiner used FEX heavily on a full license trial basis during a competency test. DFU found FEX deficient in the analysis tools when compared with Axiom and X-Ways (in use in DFU). Would require examiners to re-train/re-certify. Would require a new performance verification to be approved for lab use.

· Notes

· ISPFS has invested thousands of dollars already to obtain certification in the use of Axiom for all DFU Examiners; certification is current.

· Axiom is currently performance verified and approved for use by DFU Examiners.

· DFU uses alternative software to cross check performance (called a performance verification) on a known test hard drive or cellular phone to ensure scientific repeatable results within a mean of 90%. This is one of the reasons why DFU employs more than one type of software per category.

For Cellular Devices: the modern cellular devices architecture and data structures are so different and complicated as to require two separate steps , and therefore two separate categories of tool, to accomplish cellular device forensic work: Data Extraction which is a two-part solution in itself composed of defeating encryption/security on a cellular device AND extraction of all data contained on the device. Without manufacturer-imposed encryption and security measures, cellular device data extraction would be a much simpler proposition. Any encrypted data is uninterpretable by man or machine without a way to decrypt the data into a recognizable file structure. Data encryption is protected by extremely complex algorithms that are impossible to “unlock” or decrypt without the key. Criminal suspects rarely volunteer their device decryption key so very complex processes are employed by highly specialized forensic software to break the decryption and extract the data forensically. Research into decryption technology and engineered solutions require a lot of time and effort from a large team of highly trained and specialized mathematicians and software engineers. Due to the complex problem encryption introduces into forensic process, the software/tools to acquire data from cellular devices are very expensive. Additionally, only a handful of companies even attempt to offer products that are capable of decryption/data extraction for cellular devices; and Data Analysis, analysis of the data that is extracted from the cellular device.

For Cellular Device Data Extraction/Decryption Magnet Graykey (Currently in use by DFU. Considered an industry gold-standard for decryption) (full decryption package $108,400/year) (Associated training, $3,900 per course)

· Description

· Software that can defeat cellular device encryption/security and perform a full forensic extraction of data contained on a cellular device.

· Business Need

· Software/tool that can defeat current cellular device (e.g., smartphones: iPhone, Android, cheap Chinese manufactured devices, etc.) encryption/security and perform full data extraction of cellular devices. Cellular device encryption makes simple extraction of data very difficult.

· Unique Properties

· Graykey has one of the broadest libraries of data that can defeat modern cellular device (primarily iPhone, cheap Chinese, and Android devices’) encryption/security.

· Alternatives

· Cellebrite Universal Forensic Extraction Device (UFED) (Currently in use by DFU. Considered an industry gold-standard for decryption) (full decryption package $111,000/year) (Associated training, $4,900 per course). Like Graykey, considered the gold standard of cellular device data extraction. Cellebrite also has one of the broadest libraries of data that can defeat modern cellular device (primarily iPhone, cheap Chinese, and Android devices’) encryption/security. DFU Examiners are certified and trained in UFED as well. UFED has been performance verified and approved for use in the DFU lab.

· Belkasoft X Phone (requires purchase of an annual license, $8,000/year) (Associated training, $1,000 per course) The manufacturer claims to defeat encryption/security on some phones but does not claim a vast library of cellular device decryption and data extraction on the level of Graykey or Cellebrite. This software is a good cellular device data analysis tool. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· EnCase Mobile Investigator (requires purchase of an annual license, $7,000/year) (Associated training, $3,000 per course) The manufacturer claims to defeat encryption/security on some phones but does not claim a vast library of cellular device decryption and data extraction on the level of Graykey or Cellebrite. This software is a good cellular device data analysis tool. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· MSAB XRY (requires purchase of an annual license, $11,000/year) (Associated training, $1,200-$3,500 per course) The manufacturer claims to defeat encryption/security on some phones but does not claim a vast library of cellular device decryption and data extraction on the level of Graykey or Cellebrite. This software is a good cellular device data analysis tool. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· Detego Field Triage Mobile (requires purchase of an annual license, $2,795/year) (Associated training, $400 per course) The manufacturer claims to defeat encryption/security on some phones but does not claim a vast library of cellular device decryption and data extraction on the level of Graykey or Cellebrite. This software is a good cellular device data analysis tool. DFU did a trial run with Detego a few years ago and didn’t get one phone extraction while Cellebrite/Graykey succeeded in extracting all (DFU developed the opinion that Detego overpromises with their product. Detego is a product of the United Kingdom and, as a result, is very Eurocentric in their solutions). Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· MobilEdit (requires purchase of an annual license) (software $7,000/year, cellular device peripheral (e.g., smartwatch) data extraction $3,000/year) (Associated training, $1,000 per course) The manufacturer claims to defeat encryption/security on some phones but does not claim a vast library of cellular device decryption and data extraction on the level of Graykey or Cellebrite. This software is a good cellular device data analysis tool. MobilEdit is also a European product and as a result mostly offers acquisition of cellular devices available in Europe. MobilEdit has concentrated its efforts on breaking encryption/security and analysis of specific Chinese manufactured cellular devices. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· Oxygen Forensics (requires purchase of an annual license, $6,500/year) (Associated training, $2,400 per course) The manufacturer claims to defeat encryption/security on some phones but does not claim a vast library of cellular device decryption and data extraction on the level of Graykey or Cellebrite. This software is a good cellular device data analysis tool. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use. **NOTE: As of 9/23/2026, multiple Oxygen company officers have been arrested by USDOJ for wire fraud. Company officers falsified statements to the U.S. Government that their company had no foreign ties to adversaries of the U.S. and their software was developed wholly within the U.S. Unfortunately, many company officers are Russian and software development was almost entirely done in Russia.

· Notes

· For cellular device forensics, all listed software requires annual licenses and offer data extraction capabilities from each company’s developed library of phones. However, cellular devices are vastly different by make/model, even same models, year-to-year may have very different security features or even new operating systems than previous phones; not all phones will be covered by all providers. Of these tools however, while most expensive, Cellebrite and Graykey are considered the gold standard. No other software comes close to Cellebrite and Graykey in capability to overcome most devices encryption (of primary consideration); in commitment of resources to research/development; in maintenance of a vast library of supported phones; in rendering consistent data extractions; and in offering constant updates to their device libraries. Cellebrite and Graykey extraction capabilities are on such a level as to relegate all other offerings to data analysis-only. DFU Examiners are certified in Graykey and Cellebrite. Graykey and Cellebrite have been performance verified and approved for DFU lab use. NOTE: Cellebrite/Graykey capabilities improve case turnaround time and allow the best service to all jurisdictions in Idaho. Prior to use of Cellebrite and Graykey, DFU’s success rate with all phones submitted for extraction dropped to 15% (primarily due to the levels of encryption in cellular devices); with the adoption of Cellebrite/Graykey that percentage jumped to 85-90%.

For Cellular Device Data Analysis:

Magnet Axiom (Annual license, $5,750 per license/year, currently two licenses in use) (Associated training, $3,900 per course) ***This is not a duplicate expense from Magnet. Axiom holds dual ability for computer and cellular device analysis.***

· Description

· Software that can perform a full forensic examination of all data extracted from a cellular device

· Business Need

· Software/tool that can analyze the extracted data and parse out unique files systems of cellular devices. Capability to analyze multiple devices’ data simultaneously and find related content and patterns a plus.

· Unique Properties

· Axiom has the capability to perform all needs listed above and has the capability to interpret/parse/analyze complicated data packets from Apple iCloud servers, Instagram, Facebook, Google, Snapchat, Discord, TextNow, Vimeo, SkyECC, and What’s App.

· As noted above, Axiom can also be used to analyze computer, digital devices listed above, AND cellular device data (to DFU’s knowledge, Axiom is the only data extraction/analysis software that can manage cellular devices and computers analysis in one software).

· Axiom can also analyze multiple cellular device data extractions and/or multiple devices’ data simultaneously and find related content, correlating evidence, and patterns.

· Alternatives

· Cellebrite Physical Analyzer (PA) (Currently in use in DFU lab, Annual license, industry gold standard, in use by DFU, $4,400 per license/per year, one license in use) (Associated training, $4,800 each course) Along with Axiom, PA is considered the gold standard for cellular device data analysis and has the capability to perform all needs listed above and has the capability to interpret/parse/analyze complicated data packets from Apple iCloud servers, Instagram, Facebook, Google, Snapchat, Discord, TextNow, Vimeo, SkyECC, and What’s App. DFU Examiners are certified and trained in PA as well. PA has been performance verified and approved for use in the DFU lab.

· Belkasoft X Phone (requires purchase of an annual license, $8,000/year) (Associated training, $1,000 per course) This software is a good cellular device data analysis tool but does not possess PA’s additional parsing and cross-device analysis capabilities; higher annual license cost than PA. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· EnCase Mobile Investigator (requires purchase of an annual license, $7,000/year) (Associated training, $3,000 per course) This software is a good cellular device data analysis tool but does not possess PA’s additional parsing and cross-device analysis capabilities; higher annual license cost than PA. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· MSAB XRY (requires purchase of an annual license, $11,000/year) (Associated training, $1,200-$3,500 per course) This software is a good cellular device data analysis tool but does not possess PA’s additional parsing and cross-device analysis capabilities; higher annual license cost than PA. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· Detego Field Triage Mobile (requires purchase of an annual license, $2,795/year) (Associated training, $400 per course) This software is a good cellular device data analysis tool but does not possess PA’s additional parsing and cross-device analysis capabilities; higher annual license cost than PA. Detego is a product of the United Kingdom and, as a result, is very Eurocentric in their solutions). Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· MobilEdit (requires purchase of an annual license) (software $7,000/year, cellular device peripheral (e.g., smartwatch) data extraction $3,000/year) (Associated training, $1,000 per course) This software is a good cellular device data analysis tool but does not possess PA’s additional parsing and cross-device analysis capabilities; higher annual license cost than PA. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use. MobilEdit is also a European product and as a result mostly offers acquisition of cellular devices available in Europe. MobilEdit has concentrated its efforts on analysis of Chinese manufactured cellular devices.

· Oxygen Forensics (requires purchase of an annual license, $6,500/year) (Associated training, $2,400 per course) This software is a good cellular device data analysis tool but does not possess PA’s additional parsing and cross-device analysis capabilities; higher annual license cost than PA. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use. **NOTE: As of 9/23/2026, multiple Oxygen company officers have been arrested by USDOJ for wire fraud-company officers falsified statements to the U.S. Government that their company had no foreign ties to adversaries of the U.S. and their software was developed wholly within the U.S. Unfortunately, many company officers are Russian and software development was almost entirely done in Russia.

· Notes

· None

For video acquisition/forensics:

Digital Video Recorders (DVRs) are devices that capture/record video/audio streams from Closed Circuit TV (CCTV) video cameras used for private/public security. From a forensic standpoint, DVRs are problematic on three fronts: 1) many DVRs “duplex” or “multiplex” the videos to show each camera’s view on one screen all at once (these video signals must be separated from each other into separate files for specific incident viewability and video enhancement); 2) there is a lack of standardization of DVR video encoding and data export interface. Each DVR typically has a proprietary operating system and therefore potentially very different encoding. The data export interface to share a video with, for example law enforcement, are all specific to the manufacturer (of which, there are many with widely variable quality and ease of use); and 3) Most DVRs offer users the capability to change the frames per second (fps) rate of the video recordings (slower frames per second would mean the storage on the DVR would not fill as rapidly (fewer frames to save)). This practice, while maximizing storage, also can visually alter the speed of events from their true speed. These factors make it very difficult for examiners to acquire DVR data without highly specialized software/tools to extract the video files in a format that is easy to view, organize, rectify video speed to true speed, and enhance characteristics of the video.

Magnet Witness (Currently in use by DFU, Annual license, $5,250/year)

· Description

· Software that features tools to acquire and enhance video to improve viewability of specified events captured on the video file.

· Business Need

· Software/tools that enhance various aspects of a video signal to improve audio clarity/viewability of actions captured by the video (contrast, brightness, saturation, zoom, smoothing, etc.). Separation of multiplexed video into individual streams/files a plus. Capability to recognize and rectify frame rate a plus.

· Unique Properties

· To DFU’s knowledge, Witness is the sole software offering broadly capable of direct Digital Video Recorder (DVR) video file acquisition, regardless of proprietary operating system or interface. Witness is one of the few software that can automatically recognize and separate video signals into separate files. In-use for years in DFU, Witness also offers unparalleled performance in video forensics and enhancement tools. Witness does not recognize and rectify frame rates. DFU Examiners are certified in Witness.

· Alternatives

· Amped FIVE (requires purchase of an annual license, $4,000/year) (Associated training, approximately $1,200 per course) The manufacturer offers excellent forensic and enhancement capabilities. DFU used Amped FIVE for years until it was assumed by Axon but went solo again. This software does not offer easy separation of multiplexed video streams/files. This software does not recognize and rectify frame rates. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· Axon Investigate (Currently in use by DFU, Annual license, $3,000/year) The manufacturer offers excellent forensic and enhancement capabilities. This software does not offer easy separation of multiplexed video streams/files. This software does recognize and rectify frame rates.

· Cognitech TriSuite 64 (requires purchase of an annual license, $1,400/year) (no training offered) The manufacturer offers video enhancement capabilities. This software does not offer easy separation of multiplexed video streams/files. This software does not recognize and rectify frame rates. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· Salient Sciences VideoFOCUS (requires purchase of an annual license, approximately $5,000-6,000/year) (Training included in price) The manufacturer offers excellent forensic and enhancement capabilities. This software does not offer easy separation of multiplexed video streams/files. This software does not recognize and rectify frame rates. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· DVR Recovery (one-time purchase of license, $1,200) The manufacturer offers excellent forensic and enhancement capabilities. This software does offer easy separation of multiplexed video streams/files but is limited to Chinese manufactured Hikvision and Dahua products only. This software does not recognize and rectify frame rates. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· Notes

· Multiplexed video streams must be “de-muxed” or “de-multiplexed” (separated into individual video streams/files) for enhancement and viewability. Magnet Witness is unparalleled in performance of this very important operation. Prior to adoption of this software, DFU Examiners would spend hours on each case manually separating out video files. DFU Examiners are certified and trained in the use of Witness. Witness has been performance verified and approved for use in the DFU lab.