Sherlock Forensics Disk Imager
Sherlock Forensics Disk Imager is a Windows desktop tool for creating forensic images of physical drives for digital evidence acquisition. It writes raw DD images, including segmented files, and EWF E01 images that can be opened by forensic analysis tools. The imager records case, evidence and examiner details in a manifest and E01 metadata, computes SHA-256 hashes, and supports SHA-1 and MD5. Its verification workflow reads the source and completed image to check data integrity; additional functions include bad-sector logging, a live acquisition console, and a safeguard against saving an image to the same physical drive being read. Intended for digital forensic examiners, law enforcement, incident responders and corporate investigators, it supports dead-disk and Windows live-acquisition workflows on 64-bit Windows 10 and 11. The standalone executable runs locally without an installer or runtime dependencies.
Learn more
Android Acquirer
Android Acquirer is desktop software for consent-based logical acquisition and examination of Android phones and tablets. It connects through Android Debug Bridge (ADB) and a helper application to collect selected device data, including messages, contacts, call records, media, apps and artifacts. Examiners can review extracted records, preserve acquisition details and produce forensic PDF reports with chain-of-custody information and SHA-256 hashes. The software is intended for digital forensic examiners, law-enforcement and legal teams, corporate investigators and other professionals handling authorized device examinations. A free edition supports device detection and inventory checks; the Forensic Edition adds full extraction and reporting. Windows and Linux downloads are offered. It supports examiners who need documented, repeatable workflows for consent-based mobile-device investigations.
Learn more
BitVare MBOX Converter
MBOX Converter is capable to convert MBOX files from 20+ email clients. One can Convert bulk MBOX Files to PST, PDF, HTML, EML, MSG, EMLX, IMAP, etc. MBOX Converter provides multiple data preview options that will help its users in forensic and litigation purposes. MBOX Converter also calls a Forensic MBOX viewer and help users investigate MBOX file deeply. MBOX Converter perfectly works for digital forensic purposes. Also, provide the option to export directly MBOX files to Office 365, Gmail, Outlook.com, Thunderbird, etc. Maintain email's original formatting and folder structure after the MBOX File Conversion. The tool is well designed with an innate viewer option that helps users to preview email and their attached documents before the conversion. It will provide you Hex View and Raw View for examining MBOX Files for digital investigation.
Learn more
Sherlock Forensics iPhone and iPad Analyzer
Sherlock Forensics iPhone and iPad Analyzer is Windows software for acquiring and examining iPhone and iPad evidence through logical MobileBackup2 backups. It also analyzes Cellebrite UFED and Inseyets full-filesystem extractions created with separate acquisition tools. The application runs fully offline and does not modify evidence. It decrypts encrypted backups and organizes data into more than 200 searchable artifact views for messages, calls, contacts, Safari history, Apple Notes, Maps and other app data. The free edition previews 25% of each artifact view, capped at 100 rows. The Forensic Edition adds unlimited data, global search, CSV and JSON export, a court-ready HTML report, a raw SQLite browser, file extraction and screen capture. It can flag deleted records recovered from the examined data. Users include digital forensic examiners, investigators, law enforcement, legal teams and forensic labs that review and document mobile-device evidence.
Learn more
