Read a VeraKey Extraction Without a Second Enterprise Seat

Organizations buy VeraKey for what it does at the acquisition step: consent-based full-filesystem capture of modern iPhones in corporate, HR and internal-investigation settings. What arrives after the capture is a filesystem tree. The traditional next step is an enterprise analysis platform with its own annual subscription, a second bill that often exceeds the first over the life of the tooling.

Sherlock Forensics iPhone Analyzer decouples the two. It ingests the VeraKey extraction directly: detection of the extraction layout is automatic, every artifact resolves at its real on-device path and the full parser suite runs against the capture's depth. Ingestion is validated against a real device image, an iPhone 14 on iOS 16.5.1, alongside the same validation on Cellebrite UFED extractions.

The result is a working model where acquisition stays on the platform built for it and every reviewer who needs to work the evidence gets a $599 one-time seat instead of a subscription, with the free edition available to triage the capture before any purchase at all.

1. Unpack the extraction. Extract the VeraKey capture to a local folder on the analysis workstation so the full-filesystem tree is browsable.
2. Open the tree in Sherlock. Point the tool at the extracted tree. Detection is automatic; no conversion step and no enterprise analysis license required.
3. Confirm device identity. Sherlock reads model, iOS build and identifiers from authoritative on-device sources inside the extraction itself, so the identity reflects what the filesystem actually records rather than an external label.
4. Work the evidence. Analyze across 130+ dedicated views, run global and keyword-watchlist search, flag items as you go and read the automated findings.
5. Report. Produce the court-ready HTML report with case and evidence numbers, examiner details, disclosed methodology and an optional SHA-256 evidence-integrity manifest. Export any view to CSV or JSON.

A full-filesystem capture carries the behavioral layer that lighter acquisitions never copy out. Sherlock's deep view groups are built for exactly that layer:

• Pattern of life: Screen Time app usage with daily totals, power-log app usage, app install and uninstall history with versions, the launch-by-launch app sequence, Siri actions and analytics and the Focus and Do Not Disturb timeline, the picture of how the device was actually used around the moments an investigation cares about.
• Whereabouts: significant locations with dwell times and enter and exit transitions, Apple Maps history, Find My devices and accessories, Waze destinations and named place-visit life events.
• Messaging recovery: chat recovered from on-device web caches for Skype, Facebook Messenger, Google Chat, LINE, imo, MeWe, Gettr, MEGA Chat, Instagram direct messages, TikTok direct messages, Discord and Reddit, with delivered-notification previews that survive in-app deletion. Recovered from web caches and notification previews for apps whose message stores are not directly readable, labeled as such in the interface and the report.
• Media, health and contacts: hidden and deleted photos, screenshots, per-photo camera make and model, edited photos, health workouts with GPS routes, heart-rate history, contact frequency and significant contacts.
• Apps, accessories and web: Bluetooth and Bluetooth LE device history, AirDrop and sharing history, Snapchat memories and the cross-app cached-web-request view that surfaces in-app web and API activity.

The classic artifact set runs against the same capture: threaded messages and iMessage, WhatsApp with groups, call history, Safari, photos with capture GPS, notes, calendars and the automated findings that flag hidden-vault apps and privacy-sensitive permission grants. Everything feeds one merged timeline and one global search.

VeraKey's natural habitat is the consented examination: a company device in an insider-threat or IP-theft inquiry, an HR matter where the employee handed over the phone, an internal investigation running under policy and counsel's guidance. Those matters need the same evidentiary discipline as a criminal case and rarely have a full-time lab behind them.

Sherlock fits that shape. Analysis runs fully offline on the investigator's workstation, so the capture never leaves the organization's custody. It is 100 percent read-only, so the evidence is never modified. The court-ready report documents examiner identity, methodology and an optional SHA-256 evidence-integrity manifest, the documentation elements described in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics, so a workplace matter that later escalates to litigation arrives with its record already in order. Authority and consent scope are questions for counsel; the tool's job is to make the technical record defensible.

Sherlock analyzes the extraction VeraKey produced; it does not perform full-filesystem acquisition of any iPhone and it does not bypass locks. Sherlock's own acquisition of a device in hand uses Apple's supported logical path, which requires the passcode and the Trust prompt. The deep behavioral groups above light up when the case source is a full-filesystem extraction.

Confirmed ingestion formats are VeraKey and Cellebrite UFED full-filesystem extractions, each validated against real device images. If your capture came from a different platform, contact us before purchasing and we will confirm whether the layout is readable.

Download the free edition, point it at the extracted tree and see what the capture holds. Unlock the full analysis seat when the matter calls for it: $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: Read a Cellebrite UFED extraction · iPhone full-filesystem analysis · Magnet AXIOM alternative