Acquire Android Evidence Without a $15k Cellebrite. Free.

The Android forensics market is dominated by Cellebrite UFED at $15,000+ per year and Magnet AXIOM at $4,000+ per year. Both are enterprise platforms designed for federal law enforcement, large police agencies and Fortune-500 forensic labs. For mid-market forensic firms, solo examiners, attorneys needing Android evidence in civil litigation, IT administrators doing internal investigations and law-enforcement secondary tools, that pricing is out of reach. Sherlock Forensics Android Acquirer is the $399 Cellebrite alternative for the buyer who needs court-ready Android forensics without the enterprise platform license.

The pricing gap is 38x at the high end. The capability gap is much smaller than the price difference suggests. Sherlock Forensics Android Acquirer does logical acquisition through ADB - the same Android Debug Bridge protocol Cellebrite and Magnet AXIOM use for their logical acquisition mode. The forensic features Cellebrite charges $15k+ for (court-ready PDF reports, SHA-256 per-artifact hashing, chain of custody logging, examiner attestation) are all in Sherlock at $399. The Magnet AXIOM alternative buyer gets the same logical acquisition surface at 1/10 the price.

Honest about scope: Sherlock Forensics Android Acquirer does NOT do physical acquisition (chip-off, JTAG, ISP), proprietary lock bypass (Cellebrite's "Advanced Logical" decryption of locked devices) or encrypted-backup decryption without the password. For a locked device with no backup password, Cellebrite is the only path. For the much larger set of cases (consented logical acquisition, unlocked device, known-password backup), the cellebrite alternative at $399 covers the same forensic ground.

Who buys the cellebrite alternative path: solo forensic examiners doing $500-$5,000 cases where a $15k tool fee kills the margin, mid-market forensic firms doing internal training without enterprise licensing, attorneys building Android evidence for civil litigation (custody, employment, IP theft), IT administrators conducting internal investigations on company-issued Android devices and law enforcement secondary tools for cases where the primary Cellebrite kit is in use elsewhere. The android forensics workflow runs the same regardless of which tool is in the buyer's hand; the Sherlock advantage is the price point and the no-subscription model.

Sherlock Forensics Android Acquirer extracts the data categories that matter to a forensic examiner, with chain of custody preserved from the device through the forensic PDF report. The android acquisition surface covers nine primary data categories, each toggle-able independently.

SMS and RCS Messages, Including Deleted Text Messages

The SMS and RCS message categories include sent, received and draft messages. The android sms recovery surface includes soft-deleted messages still in the Android messaging app's trash folder (recoverable indefinitely until the user purges). Recently-deleted text messages on Android 11+ are recoverable through the messaging app's recently deleted section for 30 days. For permanently deleted text messages older than the 30-day window, file-system layer recovery via Sherlock Forensics Disk Imager (separate forensic acquisition workflow) is required.

WhatsApp Messages, Media, Voice Notes, Group Metadata

WhatsApp forensics is one of the most-requested mobile forensics capabilities. WhatsApp data on Android lives in the app's private storage area, which logical acquisition reads via ADB when the device is unlocked and USB debugging is enabled. The WhatsApp forensics surface in Sherlock Forensics Android Acquirer extracts message threads, media attachments, voice notes, group chat metadata, contact list and call logs. For end-to-end encrypted WhatsApp backups stored in Google Drive, the encryption key is required (typically obtained through legal process or the user's voluntary cooperation). The WhatsApp forensics extraction preserves message timestamps, sender IDs and media SHA-256 hashes for court-ready presentation.

Signal Messages and Metadata (Within E2E Limits)

Signal forensics on Android has hard limits because Signal's end-to-end encryption protects message content from any tool that does not have the user's signal database password. Sherlock Forensics Android Acquirer captures the Signal app metadata (contacts, group membership, app data structure, timestamp metadata for message events) within the limits of E2E encryption. For actual Signal message body content, the user's signal database password is required. The Signal forensics surface in Sherlock is honest about this limit; tools that claim to decrypt Signal without the password are usually claiming what they cannot deliver.

TikTok Forensics: Cache, Watched Videos, DMs

TikTok forensics is a growing category for civil and criminal investigations involving social-media evidence. The TikTok app cache on Android contains watched videos, paused-and-resumed playback positions, posted content metadata and direct message threads (when the user has granted access). Sherlock Forensics Android Acquirer extracts the TikTok cache data as part of the app data acquisition surface, with timestamps and SHA-256 hashes preserved.

Media Library: Photos, Videos, EXIF Metadata

The Android media library acquisition extracts photos, videos, audio recordings and the EXIF metadata embedded in image files. EXIF metadata captures device GPS coordinates, camera model, capture timestamps and editing history. For forensic photography evidence (where the chain of custody requires proof that a photo is unmodified from the moment of capture), the per-photo SHA-256 hash in the Sherlock acquisition surface establishes the chain of custody from device to exhibit.

App Data, SIM Card and System Categories

Additional data categories include installed app inventory (package names, install dates, signing certificates), SIM card data (ICCID, IMSI, stored contacts), Wi-Fi saved networks, browser history and bookmarks, calendar events and device accounts. Each category is toggle-able independently so the examiner can scope the acquisition to the legally-authorized data set.

The rooted device question is one of the most common buyer concerns in android forensics. Rooting an Android device grants superuser access to the full file system, which unlocks data categories that non-rooted android acquisition cannot reach. But rooting modifies the device, which can break chain of custody if not performed before the forensic acquisition begins under documented protocol.

The honest forensic answer: for most cases (custody disputes, employment investigations, civil litigation involving Android evidence) the non-rooted android acquisition surface covers the data the case needs. Sherlock Forensics Android Acquirer is designed for the non-rooted path because that preserves chain of custody. If the case requires data only available on a rooted device, the examiner should consult counsel about whether to root and document the procedure under a forensic protocol. Rooting an Android device voids the manufacturer warranty in most cases; that consideration is separate from the forensic admissibility question.

Android evidence in legal proceedings has to satisfy the same chain-of-custody requirements as any other digital evidence. Sherlock Forensics Android Acquirer captures the android chain of custody trail from the moment the forensic acquisition begins through the production of the court-ready PDF report.

The android chain of custody log records device serial number, manufacturer and model, Android OS version, bootloader status, acquisition timestamp, examiner identity (configurable), data categories acquired, per-artifact SHA-256 hashes and final report SHA-256. The log writes to a signed JSON sidecar alongside the acquired data so the chain-of-custody record travels with the evidence into the production set.

The android court-ready PDF report includes the cover page with case metadata, device identification, acquisition method (logical via ADB), data category inventory, per-artifact SHA-256 verification table, examiner attestation block and chain-of-custody footer on every page. The android court-ready format matches what e-discovery review platforms expect to ingest and what trial courts expect to see attached to a declaration.

The android evidence applications cover family law (custody disputes, divorce proceedings, allegations of digital harassment), civil litigation (employment, IP theft, breach-of-contract cases involving Android-stored communications), criminal defense (Android device evidence presented by the defense to challenge prosecution narratives) and corporate internal investigations (HR investigations, fraud, policy violations involving company-issued Android devices). For each scenario, the android chain of custody + court-ready PDF + SHA-256 verification trail establishes the android evidence admissibility under Federal Rule of Evidence 901 (or the jurisdictional equivalent).

For the parallel desktop-forensics evidence workflow, see the PST Viewer for email evidence. For the broader Cellebrite vs Magnet AXIOM comparison see the Cellebrite vs Magnet AXIOM 2026 comparison. For the HR-investigation use case specifically see Android evidence collection for HR investigations. For the tool-comparison context see Android forensics tool comparison 2026 and Android logical acquisition without Cellebrite.