Sherlock Forensics Software Pricing

Browser-artifact triage for Chrome, Edge, Firefox, Safari and Tor.

• Recovers history, downloads, cookies, autofill and bookmarks across 5 browser families
• Recovers from a stopped Windows machine with no Chrome instance running
• Free to view, $49 USD one-time to export and bulk-process

Windows physical-port lockdown for forensic and DLP workstations.

• Blocks mass storage, MTP, phone tethering and rubber-ducky HID injection at the kernel layer
• Tamper-detection event log with operator authentication for unlock
• Free Watchdog tier, $39 USD Pro tier with policy export

View, edit and threat-scan PDFs without trusting them. Phishing and JavaScript action scanning on a safe-by-default Rust parser.

• Built-in phishing detection, JavaScript and action scanning and a safe-by-default parser
• View and edit PDFs without a heavyweight reader
• Free to view; Pro $29 USD per year, an annual subscription rather than a one-time license

Pure-Rust PST, OST, MSG and EML viewer. No Outlook required.

• Deleted-item recovery via 4 carving methods (dumpster, B-tree, slack space, page scan)
• Court-ready PDF reports with per-message SHA-256 and sender-IP attribution
• Single $67 USD one-time license unlocks PST, OST, MSG and EML viewers; 5-seat team license $335 USD one-time at per-seat parity

Forensic OCR on receipts, screenshots, scanned PDFs and damaged documents.

• Tesseract 5 LSTM engine with Sherlock preprocessing pipeline (smart bicubic upscaling, adaptive binarization, deskew, multi-pass voting)
• Bates-numbered evidence export with per-word confidence sidecar and EDRM XML v1.2 output
• Free to read, $67 USD one-time for batch operations and signed forensic reports

Windows event log and EVTX forensic triage at IR speed.

• Reads .evtx and .evt with plain-English narrative translation alongside raw event JSON
• Automated detection rules for Kerberos ticket abuse, credential dumping and lateral movement signatures across the Windows security log timeline
• Free triage tier, $97 USD Forensic Edition for chain-of-custody export and forensic PDF reports

World's first pure-Rust Lotus Notes parser. No HCL or IBM runtime required.

• Direct NSF-to-PST conversion for Outlook import alongside structured JSONL forensic export
• EDRM XML metadata for Relativity, Concordance, Logikcull, Reveal and Everlaw ingest
• Free to view, $297 USD lifetime Forensic Edition (EV code-signed, single 6.5 MB exe)

Android logical acquisition with court-ready chain of custody.

• Logical acquisition over ADB across Android 6 Marshmallow through Android 15 (Samsung, Pixel, OnePlus, Xiaomi, Motorola and all major OEMs)
• SHA-256 evidence container with verifiable manifest and operator attribution
• Free triage tier, $399 USD Forensic Edition for full acquisition and reporting

Windows forensic workstation for iPhone and iPad evidence. Logical MobileBackup2 acquisition with encrypted-backup decryption.

• 200+ artifact views: iMessage, WhatsApp, call history, Safari, keychain, locations, home screen and app permissions
• Encrypted-backup offline decryption (RFC 3394 keybag unwrap and AES) and deleted-content SQLite carving
• Free preview tier (25% of every artifact); Forensic Edition $599 one-time for full data and court-ready HTML reports

Data recovery that measures the rebuild rather than guessing it.

• Deleted-file recovery, carving, RAID reconstruction, lost-partition search and previous Windows versions
• Rebuilds RAID by scoring layouts against the file system and refuses an out-of-sync disk
• Free tier images and browses a drive; Pro $295 USD one-time

Search a photo and video library by what is inside each file. Local Windows, no cloud.

• Find any person, pet, place, sign or spoken word across thousands of photos and videos from one search box
• Face and pet recognition, text-in-image reading, speech transcription and timestamped video timelines, all on your PC
• Free up to 500 items; Pro $59 USD one-time for unlimited, activated with a key