SSA - Magnet Forensics 11-3-2026.pdf

Request Form to Division of Purchasing (DOP)

Sole Source Authorization - SSA - New

If you have any questions please contact us at DOPHelpDesk@adm.idaho.gov

Form ID 26325

Generated after Receipt by DOP

Year

Requestor Information

Agency Name* Idaho State Police

Agency Acronym*

ISP

Requestor Name* Olivia French

Phone* 208-884-7033

E-mail* olivia.french@isp.idaho.gov

Property Being Purchased:* Magnet Forensics AXIOM, Graykey, and Witness digital forensic software licenses.

This field has a 300 character limit

Type of Exemption Check all that apply

Type of Exemption*

A solicitation has been completed and my Agency wishes to award contracts to multiple vendors for the same or smilar property (Multiple Award Authorization)

My Agency wishes to administer or award a solicitation at a dollar amount above its normal Delegated Purchasing Authority (Limited/One-Time DPA)

The property required is available on one or more open contracts, but my Agency wishes to purchase from a different vendor. (Note: if total value is over $10,000, Agency must also check the box for exemption from competition if requesting to pruchase from a specific vendor). (Utilization of Open Contract).

A solicitation is being developed (by my Agency under its DPA or in conjunction with DOP) and my Agency wishes to limit responses to a specific manufacturer/brand name (I.e. no substitutions). (Note: this option assumes that multiple vendors can offer the identified brand name; otherwise, select the option for exemption from competition to request a Sole Source Authorization (Brand Name Only)

A solicitation has been completed and there is a need to negotiate with one or more vendors. (Authorization to Negotiate)

My Agency is seeking to purchase directly from an identified vendor without completing a solicitation OR wishes to perform a level of competition that is less formal than would typically be required. (Various exemptions-additional questions to follow) mailto:olivia.french@isp.idaho.gov

Additional Questions*

There is an immediate threat to public health, safety, or welfare (Emergency Purchase Authorization)

The required property can only be procured from a single supplier (sole manufacturer and distributor) (Sole Source Authorization)

There is an existing Policy Directive on the DOP website which requires authorization to be utilized (Utilization of Policy Directive)

It would be impractical, unreasonable, or disadvantageous to complete the required competitive process under the circumstances (One Time Exemption).

Sole Source Authorization

IDAPA 38.05.01.042.02 provides that sole source purchase shall be used only if a requirement is reasonably available from a single supplier.

Fiscal Year*

FY27

Type of Request*

New

Renew (Agency wishes to extend an existing sole source authorization)

Amend (Check this box to request a change to the goods/services, term or other conditions of the

SSA)

Both Renew and Amend

New

Name of Requested Vendor* Magnet Forensics (MF)

Desired Term in Years*

Anticipated Total Cost (for full desired term):

$625,750.00

Do you anticipate the need for renewals?

Yes No

Property* Describe the property you are seeking

Idaho State Police Forensic Services (ISPFS) is seeking software licenses for Magnet Forensics AXIOM, Graykey, and Witness for use by its Digital Forensic Unit (DFU). These specialized forensic software products provide distinct capabilities necessary to acquire, extract, analyze, and process digital evidence from computers, mobile devices, and digital video recording systems.

**Magnet AXIOM** provides forensic data acquisition and analysis capabilities for computers, mobile devices, and other digital storage media. The software allows examiners to recover and analyze digital evidence, interpret complex file structures, and correlate information across multiple devices to identify relevant evidence and patterns.

**Magnet Graykey** provides advanced mobile device unlocking, decryption, and forensic data extraction capabilities. The software enables examiners to access data from encrypted iOS and Android devices that may otherwise be inaccessible through conventional extraction methods.

**Magnet Witness** provides specialized forensic video acquisition and enhancement capabilities, including the extraction of video from digital video recorders (DVRs), separation of multiplexed video streams, and enhancement of video evidence to improve visibility and interpretation.

All three products are currently utilized by ISPFS and have undergone laboratory performance verification. Continued licensing will allow ISPFS to maintain established forensic examination capabilities, support examiner certifications, and provide reliable digital forensic services to law enforcement agencies throughout Idaho.

https://adminrules.idaho.gov/rules/current/38/380501.pdf

Justification* Check all that apply

Sole source provider of a licensed or patented good or service

Sole manufacturer AND distributor

Sole provider of factory-authorized/warranty service

Sole provider of items that are compatible with existing equipment, systems, programs, etc.

Other

Business Need* Describe the Agency's business need for the requested property

Idaho State Police Forensic Services (ISPFS) requires specialized forensic software to extract and analyze digital evidence from computers and mobile devices, bypass device encryption, & acquire and enhance video evidence. MF products support criminal investigations and laboratory operations.

This field has a 300 character limit

Description* Describe what makes the identified property unique. Why is it the only property that could meet your business need?

Magnet Forensics is the sole developer and manufacturer of the proprietary AXIOM, Graykey, and Witness digital forensic software products.

Each product provides specialized capabilities that support different aspects of digital forensic examinations conducted by Idaho State Police Forensic Services (ISPFS). These products are currently utilized by the Digital Forensic Unit (DFU) and have undergone performance verification testing to ensure the accuracy, reliability, and repeatability of forensic results.

**Magnet AXIOM** provides comprehensive digital forensic acquisition and analysis capabilities for computers, mobile devices, and other digital storage media. Unlike many competing forensic tools that focus primarily on either computer or mobile device examinations, AXIOM allows examiners to analyze evidence from both within a single software platform. Its advanced capabilities include recovering and interpreting complex file structures, analyzing application data, identifying deleted files, and correlating evidence across multiple devices.

AXIOM can simultaneously analyze data from computers, mobile devices, and other storage media to identify relationships and patterns relevant to criminal investigations. This functionality reduces the need for separate analysis platforms and improves examination efficiency.

**Magnet Graykey** provides advanced mobile device unlocking, decryption, and forensic data extraction capabilities. Modern mobile devices utilize increasingly sophisticated encryption and security measures that prevent conventional forensic tools from accessing stored information. Graykey maintains an extensive library of supported devices and security configurations, allowing examiners to extract evidence from encrypted iOS and Android devices that may otherwise be inaccessible. Graykey is considered an industry-leading solution for mobile device extraction and provides capabilities that complement Cellebrite, another forensic tool currently utilized by ISPFS. Because device compatibility and encryption bypass capabilities vary between manufacturers, maintaining both solutions is necessary to maximize successful evidence recovery.

Prior to implementing Graykey and Cellebrite, ISPFS experienced a mobile device extraction success rate of approximately 15%. Following implementation, the success rate increased to approximately 85–90%. This improvement demonstrates the importance of maintaining access to these specialized technologies to support criminal investigations throughout Idaho.

**Magnet Witness** provides specialized forensic video acquisition, processing, and enhancement capabilities. Digital video recorders (DVRs) frequently utilize proprietary operating systems, recording formats, and multiplexed video streams that make extracting and analyzing evidence difficult. Witness can acquire video directly from a broad range of DVR systems and separate multiplexed recordings into individual video files for examination. The software also provides video enhancement tools to improve the visibility of recorded events. These capabilities are particularly important when video evidence must be recovered from systems that do not provide standardized export methods.

Before implementing Witness, DFU examiners frequently spent hours manually separating video streams for analysis. Witness significantly reduces the time required to perform these tasks and allows examiners to process video evidence more efficiently.

In addition to their proprietary capabilities, all three Magnet Forensics products are already integrated into ISPFS's forensic examination processes. DFU examiners have completed specialized training and certifications associated with these products, representing a substantial investment in tuition, travel, and personnel time. These certifications are specific to the software and are not transferable to competing products.

ISPFS also conducts laboratory performance verification testing to ensure forensic tools produce accurate and repeatable results. AXIOM, Graykey, and Witness have already completed this process and are approved for laboratory use. Replacing these products would require additional software purchases, examiner training and certification, and new performance verification testing before alternative software could be implemented.

Although other manufacturers offer digital forensic software, the available products differ in their supported devices, extraction capabilities, analytical functions, and video processing features. No single alternative identified by ISPFS provides a complete replacement for the combined capabilities of AXIOM, Graykey, and Witness within the laboratory's existing forensic workflows.

ISPFS also utilizes specialized forensic products from Cellebrite and X-Ways. These products serve complementary functions and provide additional examination and verification capabilities rather than eliminating the need for Magnet Forensics software. Maintaining multiple forensic tools allows ISPFS to examine a broader range of digital evidence and independently verify forensic findings when necessary.

Magnet Forensics has provided a sole manufacturer letter dated May 22, 2026, confirming that it and its affiliated companies are the exclusive manufacturers of AXIOM, Graykey, and Witness. The company has also confirmed that its proprietary training courses are provided exclusively by Magnet Forensics and its authorized instructors.

The requested exemption is specific to the continued licensing of these proprietary products. Their specialized capabilities, established laboratory use, examiner certifications, and completed performance verification make continued use necessary to maintain ISPFS's current forensic examination capabilities. Purchasing alternative software would result in additional costs, potential operational disruptions, and possible limitations in evidence recovery and analysis.

For these reasons, ISPFS is requesting a sole source exemption to continue utilizing Magnet Forensics AXIOM, Graykey, and Witness in support of criminal investigations and digital forensic services throughout Idaho.

Alternatives* Describe the research you conducted to identify other potential property/sources. What potential alternatives did you find and why will they not meet the Agency's business needs?

Idaho State Police Forensic Services (ISPFS) evaluated alternative digital forensic software solutions to determine whether other products could meet the operational requirements of its Digital Forensic Unit (DFU). The evaluation considered forensic data acquisition and analysis capabilities, mobile device encryption bypass, supported devices and file systems, video extraction and enhancement capabilities, compatibility with existing laboratory procedures, examiner training requirements, and the costs associated with implementing alternative software.

ISPFS currently utilizes Magnet Forensics AXIOM, Graykey, and Witness. Each product serves a distinct forensic function, and alternatives were evaluated based on their ability to provide comparable capabilities.

**1. Alternatives to Magnet AXIOM – Computer and Digital Evidence Analysis**

Magnet AXIOM provides forensic data acquisition and analysis capabilities for computers, mobile devices, and other digital storage media.

The following alternatives were identified:

- **X-Ways Forensics:** Currently utilized by ISPFS and considered an industry-standard forensic examination tool. X-Ways provides comprehensive computer forensic acquisition and analysis capabilities and is used to independently verify forensic findings. However, AXIOM provides additional capabilities for analyzing mobile device data and correlating evidence across multiple devices within a single platform. X-Ways complements AXIOM but does not eliminate the need for its broader analysis capabilities.

- **Belkasoft X Computer:** Provides computer forensic acquisition and analysis capabilities but does not offer the same level of integrated computer and mobile device analysis as AXIOM. Additional software would be required for mobile device examinations, along with examiner training, certification, and laboratory performance verification.

- **Detego Field Triage Computer:** Offers computer data acquisition and examination capabilities but does not provide the same depth of forensic analysis or integrated mobile device examination capabilities as AXIOM. Implementation would require additional software, examiner training, and laboratory verification.

- **FTK (Forensic Toolkit):** Provides computer forensic acquisition and analysis capabilities but does not offer the same integrated computer and mobile device analysis functionality currently utilized through AXIOM. Additional licensing and examiner training would be necessary, along with performance verification before laboratory implementation.

- **OpenText EnCase:** Previously utilized extensively by ISPFS. However, the DFU determined that EnCase was less effective for its forensic casework and transitioned to other solutions. Returning to EnCase would require additional training, certification, and performance verification without providing the same analytical capabilities currently available through AXIOM.

- **GetData Forensic Explorer (FEX):** Evaluated by a DFU examiner through a full-license trial during a competency test. ISPFS determined that its analysis capabilities were less effective than those available through AXIOM and X-Ways. FEX also lacks a dedicated cellular device examination module, limiting its ability to replace AXIOM.

Based on this evaluation, ISPFS determined that AXIOM provides specialized cross-device analysis capabilities that are not fully replicated by the alternatives reviewed. Maintaining AXIOM alongside X-Ways also supports independent verification of forensic results.

**2. Alternatives to Magnet Graykey – Mobile Device Decryption and Data Extraction**

Magnet Graykey provides specialized capabilities to bypass mobile device encryption and security measures and extract digital evidence from supported iOS and Android devices. The following alternatives were identified:

- **Cellebrite UFED/Inseyets:** Currently utilized by ISPFS and considered an industry-leading mobile device extraction solution. Cellebrite provides advanced unlocking and extraction capabilities comparable to Graykey. However, the two products maintain different libraries of supported devices, operating systems, and security configurations. A device that cannot be successfully accessed using one product may be supported by the other. Maintaining both solutions maximizes the laboratory's ability to recover digital evidence from encrypted devices.

- **Belkasoft X Phone:** Provides mobile device extraction and analysis capabilities but does not offer the same extensive device support or advanced encryption bypass capabilities as Graykey. Implementation would require additional licensing, examiner training, and laboratory verification.

- **EnCase Mobile Investigator:** Offers mobile device forensic capabilities but has more limited encryption bypass and device extraction capabilities compared to Graykey. Additional training, certification, and performance verification would be required.

- **MSAB XRY:** Provides mobile device extraction and analysis capabilities but does not offer the same breadth of supported devices and encryption bypass capabilities as Graykey. Implementation would require additional software licensing, training, and verification.

- **Detego Field Triage Mobile:** ISPFS previously conducted a trial of Detego to evaluate its extraction capabilities. During testing, Detego was unsuccessful in extracting data from the tested mobile devices, while Graykey and Cellebrite successfully completed the extractions.

Based on these results, Detego was determined to be unsuitable as a replacement for Graykey.

- **MOBILedit:** Offers mobile device extraction and analysis capabilities, including support for certain devices and peripheral equipment.

However, its supported device library and encryption bypass capabilities do not provide the same level of coverage as Graykey. Additional licensing, training, and laboratory verification would be required.

- **Oxygen Forensics:** Provides mobile device extraction and analysis capabilities but does not offer the same level of encryption bypass functionality or supported device coverage as Graykey. Implementation would require additional licensing, training, and laboratory performance verification.

ISPFS determined that Graykey and Cellebrite provide complementary capabilities that are necessary to maximize successful evidence recovery. Prior to implementing these technologies, the laboratory experienced a mobile device extraction success rate of approximately 15%. Following implementation, that rate increased to approximately 85–90%.

Because mobile device security measures and supported operating systems vary significantly, replacing Graykey with a single alternative could reduce the laboratory's ability to successfully extract evidence from certain devices.

**3. Alternatives to Magnet Witness – Digital Video Acquisition and Enhancement**

Magnet Witness provides specialized capabilities to acquire, process, and enhance digital video evidence, particularly recordings obtained from digital video recorders (DVRs) utilizing proprietary formats and multiplexed video streams. The following alternatives were identified:

- **Amped FIVE:** Provides forensic video analysis and enhancement capabilities. ISPFS previously utilized this software; however, it does not offer the same ease of separating multiplexed video streams into individual files as Witness. Implementation would also require additional examiner training and performance verification.

- **Axon Investigate:** Currently utilized by ISPFS and provides forensic video analysis and enhancement capabilities, including frame-rate recognition and correction. However, it does not offer the same efficient separation of multiplexed video streams as Witness. The two products provide complementary capabilities rather than serving as complete replacements for one another.

- **Cognitech TriSuite 64:** Provides video enhancement capabilities but does not offer comparable functionality for separating multiplexed video streams or correcting frame rates. Additional laboratory verification would be necessary, and manufacturer-provided training was not identified.

- **Salient Sciences VideoFOCUS:** Provides forensic video enhancement capabilities but lacks the efficient multiplexed video separation functionality available through Witness. Implementation would require additional training and performance verification.

- **DVR Recovery:** Provides video recovery and separation capabilities but is primarily limited to certain Hikvision and Dahua DVR systems.

Its limited device compatibility prevents it from serving as a comprehensive replacement for Witness.

ISPFS determined that Witness provides specialized DVR acquisition and multiplexed video separation capabilities that are not adequately replicated by the alternatives evaluated. Prior to implementing Witness, examiners frequently spent hours manually separating video recordings for examination. Continued use of Witness reduces the time required to process this evidence and improves laboratory efficiency.

**4. Existing Investments and Operational Considerations**

In addition to evaluating competing software capabilities, ISPFS considered the financial and operational impacts of replacing its existing Magnet Forensics products.

All three products are currently implemented within the DFU and have undergone laboratory performance verification testing. Examiners have also completed specialized training and certifications associated with the software. These certifications are product-specific and are not transferable to competing forensic applications.

Transitioning to alternative products would require additional software licensing, examiner training and certification, and new performance verification testing before implementation. These requirements would result in additional expenditures and could disrupt forensic examination operations or delay criminal investigations.

ISPFS also utilizes specialized forensic software from Cellebrite and X-Ways. These products serve complementary functions and provide additional capabilities for examining different types of digital evidence and independently verifying forensic findings. ISPFS is pursuing separate sole source exemptions for these products based on their respective proprietary capabilities and established laboratory use.

**5. Conclusion**

Although alternative digital forensic software products are commercially available, ISPFS has not identified alternatives that would fully replace the specialized capabilities of Magnet AXIOM, Graykey, and Witness within its existing forensic operations.

Magnet Forensics has provided documentation confirming that it and its affiliated companies are the sole manufacturers of these proprietary products. While competing manufacturers offer similar categories of forensic software, they cannot provide the identical Magnet Forensics products or their proprietary functionality.

Based on the alternatives evaluated, existing laboratory requirements, prior investments in examiner certification and software verification, and the operational need to maintain multiple complementary forensic tools, ISPFS has determined that continued licensing of Magnet AXIOM, Graykey, and Witness is necessary to maintain reliable and efficient digital forensic examination services.

For these reasons, ISPFS is requesting a sole source exemption for the continued use of these products in support of criminal investigations throughout Idaho.

File Upload and Certification

Notes

File Upload

MF Training Confirmation Letter 2023-10-20 (FE).pdf 262.86KB program specific sole source MAGNET.docx 31.99KB

Sole Manufacturer Letter (2026-05-22).docx.pdf 172.29KB

Maximum File Size 250 MB

Agency Certification*

By submitting this form, I certify that the information provided above is true and accurate to the best of my knowledge, supports the requirement for a sole source procurement, and is in the best interest of the State.

Signature* Date Submitted* 2026-11-03

Approval - SSA

Administrator Intends to approve*

Yes No

(Pending legal notice and appeal period)

Optional Posting?* This exemption will be sent for posting before final approval.

Yes No

Notes Public View

This field has a 300 character limit

File Upload

Maximum File Size 250 MB

DOP Signature*

DOP Printed Name* Mike Gwinn

DOP Title* Deputy Administrator

Date Time 2026-11-03