$399 One-Time
Since 2006. CISSP, ISSAP and ISSMP certified. Court-ready Android forensic acquisition without the $15,000+ annual subscription.
Sherlock Forensics Android Acquirer is a $399 one-time alternative to Cellebrite for consent-based Android logical acquisition. It extracts SMS, contacts, call logs, media and apps via ADB with SHA-256 per-artifact hashing and court-ready forensic PDF reports. Built by CISSP, ISSAP and ISSMP certified examiners with 20 years of courtroom experience.
Free edition available | Windows 10/11 | No subscription required
The Problem
Cellebrite UFED is the industry standard for mobile forensics. It supports physical extraction, exploit-based device bypass, file system extraction and logical extraction across thousands of iOS and Android device profiles. For law enforcement agencies performing warrant-based examinations on locked devices, Cellebrite is an essential tool that justifies its price.
But unless you specifically need to recover deleted data or bypass device encryption, Cellebrite offers no advantage over logical acquisition. For everything currently on the device, logical extraction gets the exact same data: SMS, contacts, call logs, photos, videos, apps, browser history, Wi-Fi configurations and accounts.
Logical acquisition can also recover data not visible in the device UI. App SQLite databases, cached content, system logs, tombstone files and app-specific datastores are all accessible through ADB without physical extraction. Most examiners never realize how much data logical acquisition surfaces beyond what the user sees on screen.
Over 90% of civil litigation, HR investigations, insurance fraud and corporate cases need what is ON the device, not what was deleted. The real question: are you paying $15,000/year for deleted data recovery you need on 5% of your cases?
The iPhone reality: iOS Lockdown Mode (iOS 16+) disables USB data transfer when locked. USB Restricted Mode kills access after one hour. Cellebrite cannot reliably crack iPhones running iOS 17.4+ on A12+ chips. For locked, up-to-date iPhones, no commercial tool extracts deleted data reliably. For unlocked iPhones with a known passcode, logical acquisition gets everything needed.
The three-year cost tells the full story. Cellebrite UFED: $45,000. MSAB XRY: $36,000. Oxygen Forensic Detective: $10,500. Sherlock Forensics Android Acquirer Forensic Edition: $399. One payment. No renewals. No surprise invoices. No sales calls asking you to upgrade.
The Solution
Sherlock Forensics Android Acquirer is a Windows forensic tool that performs consent-based logical acquisition of Android devices via ADB. It was built by the same team that has delivered expert witness testimony in Canadian courts since 2006. Every design decision was driven by courtroom requirements: per-artifact hashing, chain of custody documentation, examiner credential reporting and forensic PDF output.
The Forensic Edition costs $399 USD. One-time payment. No annual licensing. No subscription renewals. No per-seat fees that multiply as your team grows. You own the license permanently with free updates included. The free edition lets you evaluate the tool on your own devices before you spend a dollar.
This is not a stripped-down version of an enterprise platform. It is a purpose-built tool designed for one job: extracting data from accessible Android devices and documenting the acquisition with forensic rigor. By focusing on logical extraction rather than trying to be everything for everyone, we deliver court-grade output at a price that private investigators, small departments and law firms can justify.
Compare
| Feature | Sherlock Acquirer | Cellebrite UFED | Oxygen Forensic | MSAB XRY |
|---|---|---|---|---|
| Price (USD) | $399 one-time | $15,000+/year | $3,500+/year | $12,000+/year |
| 3-Year Total Cost | $399 | $45,000+ | $10,500+ | $36,000+ |
| Licensing Model | One-time purchase | Annual subscription | Annual subscription | Annual subscription |
| Logical Acquisition | Yes | Yes | Yes | Yes |
| Physical Extraction | No | Yes | Limited | Yes |
| Consent-Based Focus | Yes | Partial | Partial | Partial |
| Court-Ready PDF Reports | Yes | Yes | Yes | Yes |
| Per-Artifact SHA-256 Hash | Yes | Yes | Yes | Yes |
| Free Updates | Yes | With active license | With active license | With active license |
| iOS Support | No | Yes | Yes | Yes |
| Training Required | Minimal | Recommended ($$$) | Recommended ($) | Recommended ($$) |
Pricing based on publicly available information as of April 2026. Cellebrite pricing varies by configuration and region. Contact each vendor for current quotes. For a deeper analysis of all tools including Magnet AXIOM and Autopsy, read our Android forensics tool comparison.
Included
Extract SMS/MMS messages, contacts, call logs, media files (photos, videos, audio), installed apps and APKs, Wi-Fi saved networks, browser history and bookmarks, calendar events and device accounts. Each category can be toggled independently to match your investigation scope.
A lightweight companion application deployed to the target device during acquisition. The helper APK provides access to protected data categories that ADB alone cannot reach on newer Android versions. It runs with standard permissions and does not root the device.
Multi-page forensic PDF documenting the complete acquisition. Includes device identification, examiner details, acquisition timestamps, selected data categories, bootloader status and chain of custody metadata. Structured for direct court submission.
Every extracted file is individually hashed with SHA-256 at the moment of extraction. Hash values are included in the forensic report, establishing cryptographic proof that evidence has not been modified since acquisition. This is the same verification standard used by Cellebrite.
Automatic detection of connected Android devices via ADB. Displays serial number, manufacturer, model, Android version and build number. Checks bootloader lock status to document whether the device may have been modified prior to examination.
$399 is a one-time payment. No annual renewal. No per-seat licensing. No surprise invoices. Free updates included. If your team grows, additional licenses are $399 each. Volume pricing available for 5+ machines.
Transparency
We believe transparency about limitations is a sign of competence. Here is what Sherlock Forensics Android Acquirer does not do. If your use case requires any of these capabilities, you need a different tool and we will tell you which one.
For the majority of corporate, civil and family law cases involving consent-based examination of accessible Android devices, logical acquisition provides everything you need. If you are unsure whether your case qualifies, call us at 604.229.1994. We will tell you honestly in five minutes. Refer to NIST SP 800-101 Rev 1 for guidelines on when logical versus physical extraction is appropriate.
Use Cases
Family law cases, insurance fraud investigations and background checks. Your clients hand you their unlocked phone and you need to extract messages, call logs and photos with forensic documentation that holds up in court. You do not need a $15,000 tool for this. You need a $399 tool that generates the same SHA-256 verified reports.
Budget-constrained departments that process victim devices, consent searches and voluntarily surrendered phones. The device is already unlocked. The owner is cooperating. You need forensic documentation, not exploit research. Sherlock handles consent-based acquisitions while your Cellebrite budget goes toward the cases that actually need physical extraction.
Employee misconduct investigations, policy violation inquiries and IP theft cases involving company-issued Android devices. The organization owns the device and has authorization to examine it. Forensic extraction with chain of custody documentation protects the company in subsequent legal proceedings.
Litigation support teams preserving client device data for electronic discovery obligations. No annual licensing means no wasted cost between cases. Buy once, use whenever a case requires Android device preservation. The structured extraction with SHA-256 verification establishes a defensible collection from the moment of acquisition.
Regulatory compliance investigations, internal audits and whistleblower evidence preservation. When a compliance matter requires examination of an employee's company-owned device, Sherlock provides the forensic documentation that auditors and regulators expect to see. Chain of custody logging ensures the evidence trail is defensible.
Small and mid-size forensic practices that handle a mix of corporate and civil cases. Keep Cellebrite for the cases that require physical extraction. Use Sherlock for the consent-based logical acquisitions that make up the bulk of your caseload. Save $14,600 per year on licensing for work that never required enterprise tooling.
Total Cost
| Tool | Year 1 | Year 2 | Year 3 | 3-Year Total |
|---|---|---|---|---|
| Cellebrite UFED | $15,000 | $15,000 | $15,000 | $45,000 |
| MSAB XRY | $12,000 | $12,000 | $12,000 | $36,000 |
| Oxygen Forensic Detective | $3,500 | $3,500 | $3,500 | $10,500 |
| Sherlock Forensics Android Acquirer | $399 | $0 | $0 | $399 |
The three-year cost difference between Sherlock and the next commercial option (Oxygen) is over $10,000. That $10,000 is justified only if you need Oxygen's cloud acquisition, iOS support or analytics features. For consent-based Android logical extraction, the forensic output is equivalent. For a complete breakdown, see the full tool comparison. To understand how ADB-based extraction works at the command level, read our ADB forensics guide.
Legal
A common concern with affordable forensic tools is whether courts will accept their output. The answer is straightforward: courts do not certify forensic tools. Under the Daubert standard, admissibility depends on methodology, documentation quality and examiner qualifications.
Sherlock Forensics Android Acquirer Forensic Edition produces the same documentation elements that courts require from any forensic tool:
A well-documented examination using a $399 tool is more admissible than a poorly documented examination using a $15,000 tool. The examiner's methodology determines admissibility, not the price tag. For guidance on forensic tool validation, refer to the NIST Computer Forensics Tool Testing Program.
Questions
Get Started
Download the free edition to evaluate on your own devices. Upgrade to the Forensic Edition for $399 when you need full extraction and court-ready reports. Built by the same team that delivers expert witness testimony and mobile forensic investigations in Canadian courts. See also: private investigator forensic tools.
Call us. We will assess your requirements in a five-minute phone call and tell you honestly whether logical acquisition will produce the evidence you need. If it will not, we will recommend the tool that will.
Call 604.229.1994Sherlock Forensics Android Acquirer is provided for lawful use. Terms of Service