Mobile Forensic Tool Selector
Choose the right mobile forensic approach by device OS, lock state and extraction goal. Honest about real capabilities and limits, no false promises.
Recommended approach
Tool family: Cellebrite UFED, MSAB XRY, iLEAPP (open-source parsing)
Feasibility: High
Honest capability note: With access (unlocked or known passcode) a logical or full file system extraction is realistic. Parsing can be done with commercial suites or open-source iLEAPP for transparency and verification.
Chain of custody / admissibility: Use a write-blocked / forensically sound workflow, record hashes (SHA-256) of every image, and keep a documented chain of custody for court admissibility.
BFU vs AFU matters: After First Unlock (AFU) more keys are in memory and more data is reachable; Before First Unlock (BFU) most data stays encrypted. No tool magically unlocks a current locked iPhone.
Cellebrite UFED, GrayKey and the alternatives
Commercial suites such as Cellebrite UFED, GrayKey, Magnet AXIOM and MSAB XRY each cover different device families and acquisition methods. None of them is a universal master key; capability depends on the chipset, the iOS or Android version and the lock state. For a deeper comparison see our guide on what Cellebrite UFED is and its alternatives.
Capabilities, limits and honest expectations
Modern device encryption sets real boundaries. The checkm8 exploit only helps legacy iPhones (A11 and older), and a current locked iPhone in BFU state keeps user data encrypted. Setting honest expectations protects both the investigation and the evidence. Learn more in our overview of digital forensics.
Chain of custody and court admissibility
Whether you use a commercial suite or open-source parsers like iLEAPP and ALEAPP, admissibility depends on a forensically sound, hashed and documented workflow. Our team handles acquisition and reporting under a documented chain of custody, see our digital forensics and evidence service.
DSET is an Ankara based digital forensics and data recovery company. For a confidential assessment of your mobile device case, contact DSET on +90 536 662 38 09 or [email protected].