The Magnet AXIOM Alternative for iPhone Analysis

Magnet AXIOM is a capable platform. For labs that consolidate computer, cloud and mobile evidence into single cases it earns its keep. The difficulty for a solo examiner, a small agency or a firm with an occasional iPhone matter is the license model: an annual subscription commonly quoted at $4,000 or more per year, renewing whether the pipeline held forty phone cases or four. Three years of an AXIOM seat runs into five figures before the first hour of analysis is billed.

When the work in front of you is iPhone evidence, a device you can unlock, a backup folder or a full-filesystem extraction someone already captured, the economics invert. Sherlock Forensics iPhone Analyzer covers that analysis at $599 one-time, owned permanently with free updates. The question is not which platform is bigger; it is what your caseload actually needs a seat for.

Organizations that bought VeraKey (Grayshift, now Magnet Forensics) for consent-based full-filesystem capture face a second bill for the analysis seats that open what it captures. Sherlock removes that coupling: full-filesystem ingestion is validated on VeraKey extractions as well as Cellebrite UFED. Point Sherlock at the extracted tree; it detects the layout, resolves every artifact at its real on-device path, reads device identity from authoritative on-device sources and runs the full parser suite.

That turns the license math around. Acquisition stays on the platform you already own. Every additional reviewer, the second examiner, the investigator, outside counsel, works the extraction in Sherlock at $599 per seat one-time, with the free edition available for triage before any purchase at all.

The honest read of that table: AXIOM is broader; Sherlock is deeper value on the specific iPhone analysis seat. Sherlock also analyzes the full-filesystem extraction your acquisition platform produced, Cellebrite UFED or VeraKey, which is the exact scenario where paying subscription money for a second analysis platform hurts most. Sherlock does not open AXIOM's own case file formats; it reads the extraction trees themselves.

Sherlock presents 130+ dedicated artifact views, each searchable and exportable, feeding one merged timeline and one global search: threaded messages and iMessage, WhatsApp with groups, call history, Safari, photos with capture GPS, keychain-derived Wi-Fi passwords, app permissions and the deep full-filesystem groups added in version 1.2.0, pattern-of-life from Screen Time and power-log records, significant locations with dwell times, messaging recovered from web caches and notification previews for apps with no readable message store, health workouts with GPS routes and contact intelligence.

Reporting is court-ready out of the box: case and evidence numbers, examiner identification, disclosed methodology, an optional SHA-256 evidence-integrity manifest and provenance carried verbatim from the acquisition descriptors, the documentation elements described in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics. Built by CISSP, ISSAP and ISSMP certified examiners with 20 years of court-defensible practice.

The examiners who feel the subscription squeeze hardest are the ones this seat is built for. A solo or mid-market forensic practice that sees a handful of iPhone matters a quarter cannot amortize an annual platform the way a full-time lab can; at $599 owned, the tool pays for itself on the first engagement. A criminal defense examiner reviewing the prosecution's extraction needs weeks of access, not a year of subscription. A corporate investigations or HR team that captures consented devices occasionally needs the analysis capability on the shelf, not on the meter. And a smaller law-enforcement agency that already stretched its budget on acquisition tooling can put a Sherlock seat in front of every investigator on the case instead of queueing them behind one licensed workstation.

In each of those situations the free edition changes the purchase conversation: open the actual evidence first, confirm the views cover the matter and buy the seat when the case has already proven it needs one.

Credibility requires saying it plainly. If your caseload consolidates computers, cloud accounts and multiple mobile platforms into single cases or depends on Magnet's acquisition capabilities, AXIOM justifies its subscription and Sherlock does not replace it. Sherlock does not perform full-filesystem or physical acquisition of any iPhone and does not bypass locks; its own acquisition is Apple's supported logical path, requiring the passcode and the Trust prompt.

What Sherlock replaces is the analysis seat for iPhone evidence: acquired logically from an unlocked device, opened from an existing backup folder or ingested from a Cellebrite UFED or VeraKey full-filesystem extraction. For that seat, the work is covered at $599 one-time.

Download the free edition, open a device, a backup or an extraction and see the analysis surface yourself. If it covers your iPhone caseload, the full seat is $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: Read a Cellebrite UFED extraction · iPhone full-filesystem analysis · What Cellebrite actually costs