Forensic tools directory
Independent profiles of the software and hardware used in digital investigations. Each one says what the tool is for, what it can do, where it stops and what you need to know before you use it on a case.

- Mobile forensicsTransitioningCellebrite UFEDCellebrite
UFED is the name most examiners know for Cellebrite's phone extraction tool. Today it continues as the access and extraction part of the Inseyets suite.
- Mobile forensicsCurrentCellebrite InseyetsCellebrite
Inseyets is Cellebrite's current flagship for mobile evidence. It puts the extraction side (Inseyets.UFED) and the decoding side (Inseyets.PA) under one name and one licence.
- Mobile forensicsTransitioningCellebrite Physical AnalyzerCellebrite
Physical Analyzer is the decoding and analysis side of Cellebrite's mobile workflow. PA 7 is being discontinued and the database-backed PA Ultra has become Inseyets.PA 10.x.
- Mobile forensicsTransitioningCellebrite PremiumCellebrite
Premium is Cellebrite's advanced access capability for locked and encrypted handsets. Cellebrite has said the Premium name is going away as its capabilities are folded into Inseyets.
- Mobile forensicsTransitioningCellebrite UFED CloudCellebrite
UFED Cloud is Cellebrite's component for collecting data from cloud services tied to a device, using tokens found on the phone or credentials provided under legal authority. Cellebrite now ships this inside Inseyets.PA.
- Mobile forensicsCurrentCellebrite ReaderCellebrite
Cellebrite Reader is a free, portable viewer for UFDR files, the report format produced by Physical Analyzer and Inseyets. It lets people outside the lab review the evidence without a licence.
- Mobile forensicsCurrentCellebrite PathfinderCellebrite
Pathfinder is Cellebrite's analytics layer. It takes the output of many extractions and other data sources and lets a case team search, link and visualise them together, on a server the agency controls or in a cloud environment.
- Mobile forensicsCurrentMSAB XRYMSAB
XRY is MSAB's mobile data extraction software, sold as a family of modules and delivered on office, field, kiosk and tablet platforms. Its output is analysed in XAMN and managed through XEC.
- Mobile forensicsCurrentMSAB XRY ProMSAB
XRY Pro is the advanced tier of the XRY family, aimed at locked and encrypted devices that standard modules cannot reach. MSAB restricts it to practitioners who hold a current XRY certification.
- Mobile forensicsCurrentMSAB XAMNMSAB
XAMN is where an XRY extraction becomes readable evidence. MSAB sells XAMN Pro for analysis and gives away XAMN Viewer so that others in the case team can open the same files.
- Mobile forensicsCurrentMSAB XECMSAB
XEC is MSAB's Manage line. XEC Director connects every XRY installation in an organisation into one network for oversight and updates, while XEC Export batch-exports XRY files.
- Mobile forensicsUnverifiedOxygen Forensic DetectiveOxygen Forensics
Oxygen Forensic Detective is an all-in-one extraction and analysis tool for phones, cloud accounts, drones and other connected devices. On 2 November 2026 the maker's website could not be checked, so this profile is marked unverified.
- Mobile forensicsCurrentMOBILedit ForensicCompelson
Compelson now sells its phone forensics tool as MOBILedit Forensic. The Forensic Express name survives only in old web addresses. The product comes in editions, from a single-phone licence to the ULTRA edition that the maker classes as a dual-use item.
- Mobile forensicsCurrentMagnet GraykeyMagnet Forensics
Graykey is Magnet Forensics' device access product for locked iOS and Android handsets. Magnet sells it only to public safety agencies in selected countries and vets every enquiry through an agency email address.
- Mobile forensicsLegacyMagnet ACQUIREMagnet Forensics
Magnet ACQUIRE was Magnet Forensics' free acquisition tool for Android and iOS devices, later extended to computers. It no longer appears on Magnet's product or free tools pages. Its acquisition engine now lives inside Magnet Axiom.
How to read a profile
Every profile was written from the maker’s own documentation and checked on the date shown. Where a page did not state something, such as the operating system or a licence term, the field is left empty rather than guessed. Product status matters: tool families change names, and a page that calls a product current, legacy or transitioning saves you learning something that is already being replaced.
The profiles are educational. They do not say that one product is better than another and they do not promise results. A tool only does what the examiner understands, so each profile lists the knowledge you need first and the DFRTI courses that teach it.
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.