Free Download

Built in Rust

Acquire Android Evidence Without a $15k Cellebrite. Free.

Logical acquisition via ADB. SMS, contacts, call logs, media, apps. Court-ready PDF report with SHA-256 hashes for $399 one-time. The 90% of cases that don't need a passcode break.

Sherlock Forensics Android Acquirer is a Windows and Linux forensic tool that performs logical acquisition of Android devices via ADB. It detects connected devices, checks bootloader status, inventories available data and extracts SMS, contacts, call logs, media and apps. Free for device detection and data inventory. The Forensic Edition at $399 one-time adds full data extraction, court-ready PDF reports with SHA-256 per-artifact hashing and chain of custody documentation. Replaces $10,000+ annual platforms like Cellebrite UFED for the logical acquisition cases that make up the majority of mobile forensic workflows.

Compare to Cellebrite ($15k+)

Linux requires: libgtk-3, libfontconfig1, libxkbcommon. See install instructions.

Version 0.6.0 | 39.88 MB | Windows 10/11 + Linux x64 | SHA256 verified

Cellebrite alternative

Android Forensics Without Cellebrite: The $399 Budget Alternative

The Android forensics market is dominated by Cellebrite UFED at $15,000+ per year and Magnet AXIOM at $4,000+ per year. Both are enterprise platforms designed for federal law enforcement, large police agencies and Fortune-500 forensic labs. For mid-market forensic firms, solo examiners, attorneys needing Android evidence in civil litigation, IT administrators doing internal investigations and law-enforcement secondary tools, that pricing is out of reach. Sherlock Forensics Android Acquirer is the $399 Cellebrite alternative for the buyer who needs court-ready Android forensics without the enterprise platform license.

The pricing gap is 38x at the high end. The capability gap is much smaller than the price difference suggests. Sherlock Forensics Android Acquirer does logical acquisition through ADB - the same Android Debug Bridge protocol Cellebrite and Magnet AXIOM use for their logical acquisition mode. The forensic features Cellebrite charges $15k+ for (court-ready PDF reports, SHA-256 per-artifact hashing, chain of custody logging, examiner attestation) are all in Sherlock at $399. The Magnet AXIOM alternative buyer gets the same logical acquisition surface at 1/10 the price.

Honest about scope: Sherlock Forensics Android Acquirer does NOT do physical acquisition (chip-off, JTAG, ISP), proprietary lock bypass (Cellebrite's "Advanced Logical" decryption of locked devices) or encrypted-backup decryption without the password. For a locked device with no backup password, Cellebrite is the only path. For the much larger set of cases (consented logical acquisition, unlocked device, known-password backup), the cellebrite alternative at $399 covers the same forensic ground.

Who buys the cellebrite alternative path: solo forensic examiners doing $500-$5,000 cases where a $15k tool fee kills the margin, mid-market forensic firms doing internal training without enterprise licensing, attorneys building Android evidence for civil litigation (custody, employment, IP theft), IT administrators conducting internal investigations on company-issued Android devices and law enforcement secondary tools for cases where the primary Cellebrite kit is in use elsewhere. The android forensics workflow runs the same regardless of which tool is in the buyer's hand; the Sherlock advantage is the price point and the no-subscription model.

Compare

Free vs Pro

FeatureFreePro ($399)
Device detection and identificationYesYes
Bootloader status checkYesYes
Data category inventoryYesYes
Helper APK installYesYes
Data extraction to folderNoYes
SMS/MMS extractionNoYes
Contacts extractionNoYes
Call log extractionNoYes
Media file extractionNoYes
App/APK extractionNoYes
Forensic PDF reportNoYes
SHA-256 hash verificationNoYes
Chain of custody loggingNoYes
Priority supportNoYes

Cost

Cost Comparison

SolutionPriceAcquisition TypeNotes
Cellebrite UFED$10,000 to $15,000+ / yearLogical, file system, physicalEnterprise platform, annual licensing, training required
GrayKey$15,000 to $30,000+ / yearPhysical (passcode bypass)iOS focused, restricted distribution, annual subscription
Magnet AXIOM$4,000+ / yearLogical, file systemAnnual licensing, analysis platform
Oxygen Forensic Detective$3,000+ / yearLogical, file systemAnnual licensing, broad device support
Sherlock Forensics Android Acquirer Pro$399 one-timeLogical via ADB, reads full-image (any source)Court-ready PDF, SHA-256 per artifact, no annual fees
Sherlock Forensics Android Acquirer Free$0Detection + inventory onlyNo extraction, no report

What We Are Honest About

Sherlock Forensics Android Acquirer performs logical acquisition via ADB only. We do not do chip-off, JTAG, ISP or physical extraction. We do not bypass passcodes, brute-force bootloaders or exploit baseband chips. If your case requires physical acquisition of a locked device with an unknown PIN, you need Cellebrite, GrayKey or a specialist lab. For the cases that do not require that ceiling, which is the majority of corporate, family law, eDiscovery and civil work, logical acquisition with full chain of custody is the right tool at the right price. Logical extraction still recovers data not visible in the device UI: scope-limited system logs, device metadata and the artifacts apps write to shared storage outside their sandbox. App-private SQLite databases and caches under /data/data/ need root. That covers 90% of real-world Android forensic requirements at 3% of the annual cost of enterprise tools.

Capabilities

Feature Overview

Device Detection

Automatically detects connected Android devices via ADB. Displays device serial number, manufacturer, model name, Android version and build number. Supports multiple simultaneous device connections for batch processing workflows.

Bootloader Check

Queries the bootloader lock status of the connected device. An unlocked bootloader indicates the device may have been modified, which is critical context for forensic analysis. This status is documented in the forensic report.

Data Categories

Nine independently selectable data categories for targeted acquisition.

  • SMS/MMS messages
  • Contacts
  • Call logs
  • Media (photos, videos, audio)
  • Installed apps and APKs
  • Wi-Fi saved networks
  • Browser history and bookmarks (rooted devices)
  • Calendar events
  • Device accounts

Full Filesystem Image Viewer

Version 0.5.0 adds a full-filesystem image viewer. When a full-filesystem image of a device is available, from any source, it opens in a dedicated viewer with sections for overview, timeline, messages, email, calls, contacts, web, media, places, crypto and apps. The same record types and the same court-ready report are produced whether the source is the logical helper output or the raw databases inside a full image, so both read the same way. Obtaining a full-filesystem image is a rooted or beyond-logical step that depends on the specific device, so it is a case-by-case capability rather than a one-click option on every Android.

Deep App Databases From the Image

A full-filesystem image reaches the app-private storage under /data that a logical pull cannot. From it Sherlock parses the Chrome and Samsung Internet forensic set (full history, per-visit navigation events, saved logins, cookies, form autofill, saved address and payment profiles, bookmarks), Samsung email and Gmail (Gmail protobuf-decoded, with bodies that keep their paragraph formatting), Skype messages and call history and the Mycelium Bitcoin wallet with addresses and per-transaction outputs decoded from the wallet database and traceable on-chain. This is financial and communication evidence that a rooted full image reaches and a logical acquisition never does.

Deleted-Record Recovery From the Image

Inside a full-filesystem image the built-in SQLite reader replays the write-ahead log and walks the freelist, so records that were deleted but still present in the file come back and are clearly marked as recovered. This surfaces deleted photos with their paths, capture times and GPS, together with deleted messages. It recovers what survives in the WAL and freelist, not universally deleted data. Every recovered record is labelled as recovered so an examiner can testify to it.

Unified Sortable Timeline

Every dated artifact from every source in a full-filesystem image merges into one timeline, filterable by kind and date and sortable by time, type or detail in real columns. Export the timeline to CSV to build report exhibits.

Findings Surfaced

A "worth a look" panel on the overview and a "Findings of note" report section gather what Sherlock Forensics Android Acquirer noticed while reading an acquisition, most serious first. A device not in its factory state. A clock not set from the network, so its timestamps may not track real time. An app installed from an APK file that can also read the screen or every notification, which is the shape stalkerware takes. A SIM that has left the phone since it carried a message. Messaging accounts whose conversations a logical acquisition cannot reach. Files whose contents do not match their name. Each finding is stated as a fact about the material collected, not a conclusion by the tool. The examiner draws the conclusion.

Photo Geolocation

The tool reads GPS coordinates and capture time from each pulled photo's own EXIF, which is where and when the photo was taken. The device media index cannot report this because Android redacts those columns for an app without special permission. The file copied off the phone still carries it. Coordinates show on the files tab and travel into a marked photo's entry in the report.

Built-In Results Viewer

Sherlock Forensics Android Acquirer reads your acquisition back inside the tool across fourteen tabs: overview, device, conversations, calls, contacts, apps, contact map, usage, notifications, battery, files, networks, integrity and marked items. Prior versions collected evidence to a folder and left review to external tools. You now triage SMS and MMS threads, call logs, contacts, installed apps, app usage, notification access, battery and network history in one place, then mark the items that matter for the report.

Two-Party Integrity Verification

The on-device helper hashes each file on the phone and your workstation hashes what arrives. Where the two agree, two independent parties hashed the same bytes. Folder verification re-reads and re-hashes every file against the manifest so you can confirm nothing has changed since acquisition. Files are identified by content rather than extension, with disguise detection tuned not to false-positive on ZIP-backed formats. The manifest is unsigned, so this evidences that data was not disturbed after acquisition rather than proving its origin.

Self-Contained Runtime

Sherlock Forensics Android Acquirer ships as a single Windows executable with adb, fastboot and the signed helper APK bundled inside. First run unpacks the required tools to a scoped working directory. There is no external Android SDK, Platform Tools or JDK install required. The tool runs on a clean Windows 10 or 11 workstation with no developer tooling. Practitioners without an existing Android developer environment can acquire evidence in minutes rather than spending hours setting up SDK dependencies.

Helper APK

A signed companion application deployed to the target device during acquisition. The helper APK provides access to protected data categories that adb alone cannot reach on newer Android versions. It runs with standard permissions and does not root the device. The install is recorded in the acquisition manifest with the deployment UTC timestamp and the APK SHA-256. Staged copies are swept off the device afterward with removal verified. One-click helper removal returns the device to its pre-acquisition state.

Forensic Report PDF

Pro generates a multi-page forensic PDF report documenting the acquisition. Includes device identification, examiner details, acquisition timestamps, selected data categories, SHA-256 hashes for all extracted files, bootloader status and chain of custody metadata. Structured for court submission.

Acquisition Output

Pro extracts all selected data to a structured local folder organized by data category. Each file is individually hashed with SHA-256. The output folder contains the raw extracted data alongside the forensic PDF report for a complete evidence package. Version 0.3.0 reads that acquisition back in the built-in results viewer, so you can triage the evidence inside the tool as well as hand the package on for external analysis or archival.

Data categories

What Android Data Sherlock Acquires: SMS, WhatsApp, Signal, Media, App Data

Sherlock Forensics Android Acquirer extracts the data categories that matter to a forensic examiner, with chain of custody preserved from the device through the forensic PDF report. The android acquisition surface covers nine primary data categories, each toggle-able independently.

SMS and RCS Messages, Including Deleted Text Messages

The SMS and RCS message categories include sent, received and draft messages. The android sms recovery surface includes soft-deleted messages still in the Android messaging app's trash folder (recoverable indefinitely until the user purges). Recently-deleted text messages on Android 11+ are recoverable through the messaging app's recently deleted section for 30 days. For permanently deleted text messages older than the 30-day window, file-system layer recovery via Sherlock Forensics Disk Imager (separate forensic acquisition workflow) is required.

WhatsApp Messages, Media, Voice Notes, Group Metadata

WhatsApp forensics is one of the most-requested mobile forensics capabilities. Its scope depends on root. WhatsApp message data on Android lives in app-private storage under /data/data/com.whatsapp/, which Android's sandbox puts beyond the reach of ADB on a non-rooted device. On a non-rooted phone Sherlock Forensics Android Acquirer acquires the encrypted WhatsApp backup that the app writes to shared storage under /sdcard when one exists. Reading it requires the crypt key. On a rooted device the full application database is acquired, which is where message threads, media attachments, voice notes, group chat metadata, contact list and call logs become available. For end-to-end encrypted WhatsApp backups stored in Google Drive, the encryption key is required (typically obtained through legal process or the user's voluntary cooperation). Whichever path applies, the extraction preserves message timestamps, sender IDs and media SHA-256 hashes for court-ready presentation.

Signal Messages and Metadata (Within E2E Limits)

Signal forensics on Android has hard limits. Two of them, not one. Signal's message database lives in app-private storage under /data/data/org.thoughtcrime.securesms/, which Android's sandbox puts beyond the reach of ADB on a non-rooted device. On a non-rooted phone Sherlock Forensics Android Acquirer reports contact sync only, meaning which of the device's contacts use Signal. On a rooted device the app database is acquired, which is where group membership, app data structure and timestamp metadata for message events become available. Signal's end-to-end encryption is the second limit: message body content stays protected on either path without the user's signal database password. The Signal forensics surface in Sherlock is honest about both limits; tools that claim to decrypt Signal without the password are usually claiming what they cannot deliver.

TikTok Forensics: Cache, Watched Videos, DMs

TikTok forensics is a growing category for civil and criminal investigations involving social-media evidence. The TikTok app cache on Android contains watched videos, paused-and-resumed playback positions, posted content metadata and direct message threads (when the user has granted access). Sherlock Forensics Android Acquirer extracts the TikTok cache data as part of the app data acquisition surface, with timestamps and SHA-256 hashes preserved.

Media Library: Photos, Videos, EXIF Metadata

The Android media library acquisition extracts photos, videos, audio recordings and the EXIF metadata embedded in image files. EXIF metadata captures device GPS coordinates, camera model, capture timestamps and editing history. For forensic photography evidence (where the chain of custody requires proof that a photo is unmodified from the moment of capture), the per-photo SHA-256 hash in the Sherlock acquisition surface establishes the chain of custody from device to exhibit.

App Data, SIM Card and System Categories

Additional data categories include installed app inventory (package names, install dates, signing certificates), SIM card data (ICCID, IMSI, stored contacts), Wi-Fi saved networks, browser history and bookmarks (rooted devices), calendar events and device accounts. Each category is toggle-able independently so the examiner can scope the acquisition to the legally-authorized data set.

Rooted vs non-rooted

Rooted vs Non-Rooted Android: What You Get From Each

The rooted device question is one of the most common buyer concerns in android forensics. Rooting an Android device grants superuser access to the full file system, which unlocks data categories that non-rooted android acquisition cannot reach. But rooting modifies the device, which can break chain of custody if not performed before the forensic acquisition begins under documented protocol.

Data categoryNon-Rooted AndroidRooted Device
SMS, contacts, call logsYes (via ADB + helper APK)Yes
WhatsApp messages and mediaEncrypted /sdcard backup only if presentYes (full app database)
Signal metadataContact sync only (which contacts use Signal)App database acquired, stays encrypted without the key
Media library + EXIFYes (public + app-scoped media)Yes (including app-private media stores)
System logs (logcat)PartialFull system log access
Encrypted app databases (e.g. password managers)NoSometimes (still requires app password)
Deleted text messages past 30-day windowNo (requires file-system forensics)Sometimes (database journal scan)
Chain-of-custody integrityPreserved (no device modification)Modified (rooting changes device state)

The honest forensic answer: for most cases (custody disputes, employment investigations, civil litigation involving Android evidence) the non-rooted android acquisition surface covers the data the case needs. Sherlock Forensics Android Acquirer is designed for the non-rooted path because that preserves chain of custody. If the case requires data only available on a rooted device, the examiner should consult counsel about whether to root and document the procedure under a forensic protocol. Rooting an Android device voids the manufacturer warranty in most cases; that consideration is separate from the forensic admissibility question.

Court-ready chain of custody

Chain of Custody and Court-Ready Reports for Android Evidence

Android evidence in legal proceedings has to satisfy the same chain-of-custody requirements as any other digital evidence. Sherlock Forensics Android Acquirer captures the android chain of custody trail from the moment the forensic acquisition begins through the production of the court-ready PDF report.

The android chain of custody log records device serial number, manufacturer and model, Android OS version, bootloader status, acquisition timestamp, examiner identity (configurable), data categories acquired, per-artifact SHA-256 hashes and final report SHA-256. The log writes to a signed JSON sidecar alongside the acquired data so the chain-of-custody record travels with the evidence into the production set.

The android court-ready PDF report includes the cover page with case metadata, device identification, acquisition method (logical via ADB), data category inventory, per-artifact SHA-256 verification table, examiner attestation block and chain-of-custody footer on every page. The android court-ready format matches what e-discovery review platforms expect to ingest and what trial courts expect to see attached to a declaration.

The android evidence applications cover family law (custody disputes, divorce proceedings, allegations of digital harassment), civil litigation (employment, IP theft, breach-of-contract cases involving Android-stored communications), criminal defense (Android device evidence presented by the defense to challenge prosecution narratives) and corporate internal investigations (HR investigations, fraud, policy violations involving company-issued Android devices). For each scenario, the android chain of custody + court-ready PDF + SHA-256 verification trail establishes the android evidence admissibility under Federal Rule of Evidence 901 (or the jurisdictional equivalent).

For the parallel desktop-forensics evidence workflow, see the PST Viewer for email evidence. For the broader Cellebrite vs Magnet AXIOM comparison see the Cellebrite vs Magnet AXIOM 2026 comparison. For the HR-investigation use case specifically see Android evidence collection for HR investigations. For the tool-comparison context see Android forensics tool comparison 2026 and Android logical acquisition without Cellebrite.

Pricing

One-Time Payment. Yours Forever.

Pro License

$399 USD
Single machine license. No subscription. One-time payment. Yours forever.
  • All free features included
  • Full data extraction to folder
  • Nine selectable data categories
  • Court-ready forensic PDF report
  • SHA-256 hash verification per file
  • Chain of custody logging
  • Priority email support
  • Try the free version before you buy

5+ machines? Contact us for volume pricing.

Use Cases

Who Uses Android Acquirer

Law Enforcement

Police departments and federal agencies use Android Acquirer for rapid logical acquisition of suspect and victim devices. Court-ready PDF reports with SHA-256 hashing satisfy evidentiary requirements. Pairs with our expert witness services for testimony support.

Corporate Investigations

Internal investigation teams extract data from company-issued Android devices during policy violation inquiries, IP theft cases and employee misconduct investigations. The structured output folder integrates with existing case management systems. Pair with our chain of custody documentation for defensible evidence handling.

Family Law

Family law attorneys and private investigators acquire SMS messages, call logs and media from Android devices in custody disputes, divorce proceedings and harassment cases. Forensic PDF reports document the acquisition for court filing.

Incident Response

Security teams extract data from compromised Android devices during breach investigations. Installed apps, network history and account data help reconstruct the timeline of a security incident, with browser history added when the device is rooted. Used alongside our mobile forensics services.

eDiscovery

Litigation support teams preserve Android device data for electronic discovery obligations. The structured extraction with SHA-256 verification establishes chain of custody from the moment of acquisition. Defensible collection at a fraction of enterprise tool costs.

HR Investigations

HR teams extract SMS, messaging app content, photos and call logs from company-owned Android devices during harassment, discrimination and policy violation investigations. The forensic PDF report documents what was acquired, when, by whom and with what hash so the investigation withstands wrongful termination or grievance challenges. Pair with our workplace investigation services for end-to-end handling.

Corporate IR / Insider Threat

Incident response teams acquire compromised employee Androids during data exfiltration investigations, insider threat cases and breach response. App installs, Wi-Fi networks and account telemetry build the attacker timeline, with browser history added when the device is rooted. SHA-256 per-artifact hashes and chain of custody satisfy legal, insurance and regulatory reviewers without an annual enterprise license.

Guide

How to Acquire Android Evidence

  1. Enable USB DebuggingOn the Android device, navigate to Settings > About Phone and tap Build Number seven times to enable Developer Options. Then enable USB Debugging under Developer Options. Connect the device to your forensic workstation via USB.
  2. Launch Android AcquirerOpen Sherlock Forensics Android Acquirer on your Windows workstation. The tool automatically detects the connected device and displays the serial number, model and Android version.
  3. Review Device StatusVerify device identification details. Check the bootloader status (locked or unlocked). If needed, deploy the helper APK to access protected data categories on newer Android versions.
  4. Select Data CategoriesToggle the data categories you want to acquire. Choose from SMS, contacts, call logs, media, apps, Wi-Fi networks, calendar and accounts. Browser history is available when the device is rooted. Select only what is relevant to your investigation scope.
  5. Acquire and Generate ReportClick Acquire to extract selected data to a structured local folder. Pro users receive a forensic PDF report with device details, SHA-256 hashes for all extracted files and chain of custody documentation.

Questions

Android Acquirer FAQ

What is logical acquisition of an Android device?
Logical acquisition extracts user-accessible data from an Android device through ADB (Android Debug Bridge) without modifying the device storage. It captures SMS messages, contacts, call logs, media files, installed apps and other data categories. This method preserves the original device state and produces results suitable for court proceedings.
Does the tool flag anything automatically?
Version 0.4.0 surfaces findings. A worth-a-look panel on the overview and a Findings of note report section gather what the tool noticed while reading an acquisition, most serious first: a device not in its factory state, a clock not set from the network so its timestamps may not track real time, an app installed from an APK file that can read the screen or every notification, a SIM that has left the phone since it carried a message, messaging accounts whose conversations a logical acquisition cannot reach and files whose contents do not match their name. Each finding is stated as a fact about the material collected, not a conclusion by the tool. The examiner reviews the fact and draws the conclusion.
Does the tool read location data from photos?
Version 0.4.0 reads GPS coordinates and capture time from each pulled photo's own EXIF, which records where and when the photo was taken. The device media index does not report these columns to an app without special permission because Android redacts them, but the photo file copied off the phone still carries them. The coordinates appear on the files tab and travel into a marked photo's entry in the report. This reads the EXIF the file carries; it does not track the device or recover a separate location history.
Does Sherlock Forensics Android Acquirer include a results viewer?
Yes. Version 0.3.0 adds a built-in results viewer with fourteen tabs that read an acquisition back inside the tool: overview, device, conversations, calls, contacts, apps, contact map, usage, notifications, battery, files, networks, integrity and marked items. You review SMS and MMS threads, call logs, contacts, installed apps, app usage and network history without exporting to a separate application, then mark items for the report. Prior versions collected to a folder and left review to external tools.
How does Sherlock Forensics Android Acquirer verify that acquired files were not altered?
The on-device helper hashes each file on the phone and the workstation hashes what arrives, so agreement means two independent parties hashed the same bytes. Folder verification re-hashes every file against the manifest to confirm nothing changed since acquisition. This is tamper evidence that data was not disturbed after collection. Because the manifest itself is unsigned, verification does not by itself prove the origin or authenticity of the evidence, which depends on examiner handling and chain of custody.
Do I need to install adb, the Android SDK or Java to use Sherlock Forensics Android Acquirer?
No. Sherlock Forensics Android Acquirer bundles adb, fastboot and the signed helper APK inside the .exe. First run unpacks the required tools automatically. There is no external Android SDK, Platform Tools or Java Development Kit install required. The tool runs on a clean Windows 10 or 11 workstation. Versions before 0.2.0 expected adb to be installed alongside the .exe; since 0.2.0 the tool is fully self-contained and works on a fresh workstation.
Does Android Acquirer require root access?
No. Sherlock Forensics Android Acquirer performs logical acquisition through ADB without requiring root access. The helper APK extends data access to additional categories without rooting the device. Root access would modify the device and compromise forensic integrity.
What is the helper APK and is it safe?
The helper APK is a signed companion application that Sherlock Forensics Android Acquirer deploys to the target device during acquisition. It provides access to data categories that adb alone cannot reach, such as SMS messages and call logs on non-rooted Android devices. Since 0.2.0 the helper install is recorded in the acquisition manifest with the deployment UTC timestamp and the APK SHA-256, so chain of custody is captured at deployment rather than reconstructed after the fact. Staged copies are swept off the device after acquisition with removal verified. One-click helper removal returns the device to its pre-acquisition state. The APK is code-signed and its hash is documented in the report.
Are forensic reports from Android Acquirer admissible in court?
Sherlock Forensics Android Acquirer Forensic Edition generates forensic PDF reports with SHA-256 hash verification, device identification, acquisition timestamps, examiner details and chain of custody documentation. The tool is built by CISSP, ISSAP and ISSMP certified examiners with 20 years of courtroom experience. Admissibility depends on jurisdiction and proper evidence handling, but the reports document everything courts typically require for mobile device evidence.
What Android versions are supported?
Android 6.0 (Marshmallow) through Android 15. Device detection and bootloader checks work across all supported versions. Some data categories may have limited availability on older Android versions depending on manufacturer modifications.
What data categories can be extracted?
The tool supports nine data categories: SMS/MMS messages, contacts, call logs, media files (photos, videos, audio), installed applications and APKs, Wi-Fi saved networks, browser history and bookmarks (rooted devices), calendar events and device accounts. Each category can be toggled independently before acquisition. Logical acquisition also recovers data not visible in the device UI, including scope-limited system logs and shared-storage artifacts apps write outside their sandbox. App-private SQLite databases under /data/data/ require root or file-system extraction. You do not need physical extraction for 90% of forensic cases.
Is the $399 price a subscription?
No. The $399 USD Pro license is a one-time payment. No subscriptions and no recurring charges. You own the license permanently with free updates included.
How does Android Acquirer compare to Cellebrite?
Cellebrite UFED is an enterprise platform costing $10,000+ annually with physical and file system extraction capabilities. Sherlock Forensics Android Acquirer focuses on logical acquisition at $399 one-time with no annual fees. For investigators who need court-ready logical extractions without enterprise licensing costs, Android Acquirer provides the essential capabilities at a fraction of the price. See our full Cellebrite alternative comparison for a detailed feature-by-feature breakdown including pricing, acquisition types and court readiness.
Does Sherlock Forensics Android Acquirer work on Linux?
Yes. Sherlock Forensics Android Acquirer is available as a native Linux x64 binary. Download the .tar.gz archive, extract and run. Requires libgtk-3, libfontconfig1 and libxkbcommon.
Is the $399 license refundable?
The Pro license is sold as a final-sale digital product, no refunds. This is why the free version is unrestricted for device detection, bootloader checks and data category inventory. Test it against your case workflow on your hardware before purchasing. If something is technically broken, contact us at 888.883.4550 and we will make it right.
Does Android Acquirer send any device data to Sherlock Forensics?
No. All acquisition runs locally on your workstation. Evidence data, hashes and forensic PDF reports stay on your machine. No telemetry, no cloud upload, no phone-home. The tool talks to the connected Android device via ADB and writes output to your chosen local folder.
What is Android forensic acquisition?
Android forensic acquisition is the process of extracting digital evidence from an Android device in a way that preserves its integrity for legal proceedings. Logical acquisition uses ADB to copy user-accessible data without modifying the device. Physical acquisition images the underlying NAND or UFS storage and requires root, bootloader unlock, chip-off or JTAG. Sherlock Forensics Android Acquirer performs court-ready logical Android acquisition at $399 with SHA-256 per-artifact hashing and full chain of custody logging.
Can I do Android forensics without Cellebrite?
Yes. Sherlock Forensics Android Acquirer is a $399 Cellebrite alternative built for solo examiners, mid-market forensic firms, defense attorneys and IT teams who cannot justify a $15,000+ Cellebrite UFED license. The tool covers Android forensics via ADB across Android 6 through 15 and produces forensic PDF reports with SHA-256 hashes. It does not bypass screen locks or chip-off the device, but for the majority of civil litigation and internal investigation work the data accessible via ADB is sufficient evidence.
How do I extract WhatsApp messages from an Android phone forensically?
On a non-rooted Android device, the WhatsApp local backup at /sdcard/WhatsApp/Databases/ can be acquired via ADB if WhatsApp has produced one. Sherlock Forensics Android Acquirer pulls the database file, msgstore.db.crypt encrypted databases, media library and group metadata into a forensic container with SHA-256 hashes. For full WhatsApp forensics including app-private data, a rooted device widens the scope to /data/data/com.whatsapp/. Sherlock supports both rooted device and non-rooted android extraction paths.
Can I recover deleted text messages from an Android device?
Sometimes. Android SMS recovery depends on whether the device has been used since deletion, the storage medium and whether root access is available. Sherlock Forensics Android Acquirer acquires the SMS database file (/data/data/com.android.providers.telephony/databases/mmssms.db on rooted devices) which can contain deleted text messages in unallocated SQLite pages. On non-rooted android, only currently active SMS records are accessible via ADB. The forensic PDF report documents exactly what android sms recovery scope the acquisition achieved.
Do I need to root the Android device to do forensic acquisition?
No. Sherlock Forensics Android Acquirer performs logical Android forensics on non-rooted Android devices via ADB and the helper APK. Rooting the device modifies storage and breaks chain of custody, which courts disfavor. Non-rooted android extraction covers SMS, contacts, call logs, media, installed apps, Wi-Fi networks and calendar. Rooted device extraction additionally exposes browser history together with app-private data directories under /data/data/ such as WhatsApp, Signal and Telegram. Sherlock supports both acquisition paths.
What is the difference between logical and physical Android acquisition?
Logical Android acquisition extracts user-accessible data through ADB without modifying the device, producing court-ready Android evidence for the majority of civil, criminal and internal investigation work. Physical Android acquisition images the raw storage (NAND, eMMC or UFS) including unallocated space and deleted artifacts, but requires root, bootloader unlock, chip-off or JTAG-class tools. Cellebrite UFED and Magnet AXIOM offer both. Sherlock Forensics Android Acquirer focuses on logical Android acquisition at $399 versus $15,000+ for the enterprise platforms.
How does Sherlock Forensics Android Acquirer compare to Magnet AXIOM?
Magnet AXIOM is a $4,000+ annual subscription enterprise forensic platform covering Android, iOS, computer and cloud acquisition with deep analytics and case-management integration. Sherlock Forensics Android Acquirer is a $399 one-time license focused on Android logical acquisition via ADB with court-ready PDF reporting. AXIOM is the right tool for full-time forensic labs handling complex multi-device cases. Sherlock is the right Magnet AXIOM alternative for solo examiners, defense attorneys, IT teams and labs that need Android evidence acquisition without a four-figure annual contract.
Is Sherlock Forensics Android Acquirer court-ready for evidence admission?
Sherlock Forensics Android Acquirer Forensic Edition produces court-ready Android evidence reports with SHA-256 hashes per artifact, full android chain of custody logging, examiner identification, device fingerprint, acquisition timestamps and Daubert-aligned methodology documentation. The tool is built by CISSP, ISSAP and ISSMP certified examiners with 20+ years of courtroom testimony. Admissibility depends on jurisdiction and on the examiner following proper evidence-handling procedure, but the report format documents everything courts typically require for android court-ready digital evidence.
Can Sherlock acquire Signal messages from Android?
Signal forensics on Android is constrained by Signal's end-to-end encryption and on-device database protection. Sherlock Forensics Android Acquirer acquires the Signal application data directory on a rooted device, which includes the encrypted SQLite database, attachments cache and account metadata. Decryption of the Signal database requires the user passphrase or an extracted database key, which Sherlock does not attempt to crack. On non-rooted android, Signal data is generally inaccessible due to Android's app-private storage sandbox.
What Android versions does Sherlock Forensics Android Acquirer support?
Sherlock Forensics Android Acquirer supports Android 6.0 Marshmallow through Android 15 across Samsung, Google Pixel, OnePlus, Xiaomi, Motorola and most major OEM devices. Device detection, bootloader status check and the nine-category data inventory work on all supported versions. Newer Android security restrictions (scoped storage in Android 10, package visibility in Android 11) may reduce non-rooted android data scope on some categories, which the helper APK partially mitigates for SMS and call logs.

Changelog

Release History

Version 0.6.0 - 2026-07-29 - Full-filesystem analysis tier, deeper messenger and location forensics

  • Full-filesystem analysis tier. Loads full-filesystem extractions from Cellebrite and Magnet directly for deep analysis beyond a logical pull. Recovers a modern-Android app inventory from binary XML, account stores present even before the first unlock and the media store on the mainline module path. Builds an app-usage, screen, unlock and boot timeline, a permission-usage timeline, app shortcuts, recents and application exit reasons.
  • Messenger content from a full image. Recovers WhatsApp including deleted-for-everyone, Telegram, Google Messages (RCS, SMS and MMS), Google Chat, TikTok and Lemon8 direct messages. Decrypts Session and SimpleX when the key is recovered and reads the WeChat feed without the key.
  • Location depth. Adds Google on-device Timeline, Google Maps photo-location trail and last camera position, MIUI Gallery place names, video capture GPS, Health Connect workout routes, saved and airport Wi-Fi travel history and a fused Last Location view.
  • Deleted-record recovery extended. Measures deleted MMS, WhatsApp and trashed media, on top of the existing deleted photo and message recovery.
  • Document and secret forensics. Decrypts app secrets stored in EncryptedSharedPreferences, scans pulled PDFs for threats and reads OOXML document metadata and OpenVPN configurations.
  • Reworked interface. A per-source section rail, iOS-parity views, sortable and filterable tables, a calendar month view, cleaner contacts, a usage bar chart and an FFS Matrix quick reference with a Request Your Device path.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 131a69672c2a206ddf51e883368f1f48fb4408089b7f691ef6ec0a95936622fa. TSA countersignature present.

Version 0.5.0 - 2026-07-18 - Full-filesystem image support and deep app-database forensics

  • Full-filesystem image viewer. A rooted or beyond-logical acquisition of /data opens in a dedicated full image viewer with sections for overview, timeline, messages, email, calls, contacts, web, media, places, crypto and apps. The same record types and court-ready report are produced whether the source is the logical helper output or the raw databases in a full image.
  • Deep app databases parsed from the image. Chrome and Samsung Internet full forensic set (history, per-visit events, saved logins, cookies, form autofill, saved address and payment profiles, bookmarks), Samsung email and Gmail (Gmail protobuf-decoded), Skype messages and calls, contacts and call log and text messages from the Samsung call-log store, device accounts, calendar, app-usage sessions, removed-app history, the Play Store install ledger, the media store and Samsung media hub, location history and the Amazon account store. A logical pull cannot reach this app-private storage.
  • Deleted-record recovery. The SQLite reader replays the write-ahead log and walks the freelist inside a full image, so deleted records that still survive in the file come back and are marked as recovered, including deleted photos with paths, times and GPS, together with deleted messages.
  • Cryptocurrency evidence. Mycelium Bitcoin wallet addresses and per-transaction outputs are decoded from the wallet database and are traceable on-chain.
  • Unified sortable timeline and CSV export. Every dated artifact across all sources merges into one timeline you can filter by kind and date and sort by time, type or detail and export to CSV for report exhibits.
  • Older devices handled honestly. The helper-required panel now explains when a device is too old for the helper instead of dead-ending, with a button to send the device details to support directly.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: ea4944bc58d247fd78db006b29d6cf497228906ab1a86c08f22dfa825bf73284. TSA countersignature present.

Version 0.4.0 - 2026-07-17 - Findings surfaced, photo locations read, a fuller exhibit

  • Findings up front. A "worth a look" panel on the overview and a "Findings of note" report section gather what the tool noticed while reading an acquisition, most serious first: a device not in its factory state; a clock not set from the network, so its timestamps may not track real time; an app installed from an APK file that can also read the screen or every notification, which is the shape stalkerware takes; a SIM that has left the phone since it carried a message; messaging accounts whose conversations a logical acquisition cannot reach; files whose contents do not match their name; photos carrying their own GPS coordinates; devices the handset was paired with before. Each is stated as a fact about the material collected, not a conclusion by the tool.
  • Photo geolocation. The tool reads GPS coordinates and capture time from each pulled photo's own EXIF. The device media index cannot report this because Android redacts those columns for an app without special permission. The file copied off the phone still carries it. Coordinates show on the files tab and travel into a marked photo's report entry.
  • A fuller exhibit. The PDF report identifies the handset from its own build properties (make, model, Android version, security patch, build fingerprint and bootloader state) rather than an operator-typed label alone. It names the apps granted powerful access (accessibility, keyboard, notification-listener role), flags any installed from outside a store and summarises every collected category including user accounts and SIM or telephony.
  • More collected and parsed. The on-device helper reads each calendar event's calendar name and attendees, where each app was installed from (a store or a sideloaded APK) and the permissions each app holds. Bluetooth device kind, per-app battery residency and notification-listener holders are read out of the raw dumps.
  • Marking and navigation. Conversations, calendar events, saved Wi-Fi networks and paired Bluetooth devices are markable for the report. Apps, contacts and call lists are searchable by name or number. The section tabs moved from a top strip that clipped on an unmaximised window into a scrollable left sidebar shown when a case is open.
  • Fixes a customer would hit: the GET DATA button is always clickable and opens the acquire screen when no device is connected; the section tabs no longer run off the right edge on an unmaximised window; the media tab no longer asks you to read a photo's location by hand; and the paired-device list no longer vanishes when there are no saved Wi-Fi networks.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 87ecaeb4ae3ee3f5942c5aecbe67a03330b9bf90fb2b4bd617ee300a41c7d96f. TSA countersignature present.

Version 0.3.0 - 2026-07-16 - Built-in results viewer and two-party integrity verification

  • RESULTS viewer with fourteen tabs reads an acquisition back inside the tool: overview, device, conversations, calls, contacts, apps, contact map, usage, notifications, battery, files, networks, integrity and marked items. Version 0.2.0 collected to a folder with no way to review it in the application.
  • Two-party integrity verification. The on-device helper hashes each file on the phone and the workstation hashes what arrives, so agreement means two independent parties hashed the same bytes. Folder verification re-hashes every file against the manifest to confirm nothing changed since acquisition. The manifest is unsigned, so this evidences that data was not disturbed, not that it is authentic.
  • New collections. Call log, app usage history, SIM and telephony, settings provider, paired and nearby Bluetooth, saved Wi-Fi networks, notification access, per-app battery stats and connectivity history.
  • Media and data files now pull actual bytes. Prior versions returned MediaStore metadata only, so a run could report success while collecting no photos. Fixed and verified.
  • Mark for report. Star items and add notes; they appear as their own PDF section, labelled as the operator's selection rather than a finding by the tool.
  • Fixes a customer would hit: manifest now records device artifacts with their folder so the report's own re-hash instruction is followable; the report no longer claims the helper was removed when it was not; SMS and MMS threading and MMS recipients corrected; PDF text wraps instead of running off the page; the extract button no longer hides below the fold on an unmaximized window.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: ae4c6e451f6c7df928f3d2da03e9daf69740aa3b5f612215c27e271a3b088914. TSA countersignature present.

Version 0.2.0 - 2026-07-16 - Self-contained binary and provenance-hardened helper lifecycle

  • Bundled adb, fastboot and signed helper APK unpack on first run. No external Android SDK, Platform Tools or JDK install required. Runs on a clean Windows 10 or 11 workstation with no developer tooling.
  • Helper install recorded in the acquisition manifest with UTC timestamp and APK SHA-256. Chain of custody captured at deployment, not reconstructed after the fact.
  • Staged copies swept off the device with removal verified. Belt-and-suspenders cleanup so nothing lingers on the phone after acquisition.
  • One-click helper removal returns the device to its pre-acquisition state. Auditable and reversible.
  • Fixed installation gap where prior versions expected adb beside the exe. Reported by a customer who tried to acquire without an existing Android developer environment. Fresh Windows 10 VM regression test added to release gate.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 47b6aad63aa5ac3df450b54b19948ecc7602e9d69608008daec7963ca20982c2. TSA countersignature present.

Get Started

Download Sherlock Forensics Android Acquirer Today

Free for device detection, bootloader checks and data inventory. Pro at $399 USD for full extraction and forensic PDF reports. Built by the same team that delivers expert witness testimony and mobile forensic investigations in Canadian courts. See also: chain of custody software, forensic report generator and ADB forensics guide, workplace investigation evidence and private investigator forensic tools. Questions? Call 888.883.4550.

Since 2006CISSP, ISSAP, ISSMP certified888.883.4550

Linux requires: libgtk-3, libfontconfig1, libxkbcommon. See install instructions.

131a69672c2a206ddf51e883368f1f48fb4408089b7f691ef6ec0a95936622fa

How to verify:
1. Open PowerShell (right-click Start menu, click Terminal)
2. Run: Get-FileHash .\sherlock-android-acquirer.exe
3. Compare the output with the hash above. If they match, the file has not been tampered with.

Sherlock Forensics Android Acquirer is provided for lawful use. Terms of Service

Related Sherlock Tool

For iPhone and iPad forensic coverage that pairs with Android Acquirer, see the new Sherlock Forensics iPhone and iPad Analyzer. Windows workstation for iOS logical acquisition with encrypted-backup decryption and 200+ artifact views. Cellebrite and Magnet AXIOM alternative at $599 one-time payment rather than annual subscription. Together Android Acquirer and iPhone Analyzer cover the full mobile forensic surface for Canadian and US investigators.

Download

Your email is optional. If you provide it, we send 3 product introduction emails over the next 2 weeks. No long-term marketing. No data sharing. Skip the field and download directly.

Checkout - Android Acquirer Forensic Edition

$399.00 USD. One-time payment. License key delivered to your email.

Secure via Stripe One-time purchase No subscription