Digital Intelligence Platforms: 10 Forensics & Investigation Suites Ranked (2026)
By Jan Suski. I go deep on every review, checking every number against its source and digging up details other coverage misses, a habit from six years of SEO and link building for tech companies. Bylines at Surfer, Brand24, and Senuto. How the scoring works.
· Prefer this source on Google
Quick comparison of digital intelligence platforms
Ten digital intelligence platforms in ranked order, with how many of the five buyer tests each one passes, the evidence sources its own pages name, the entry price and the buyer each fits.
| # | Provider | Tests passed (of 5) | Evidence sources named | Entry price | Best fit |
|---|---|---|---|---|---|
| 1 | Magnet Forensics | 5 | Mobile, computer, cloud, vehicle, video | $29,997/yr median* | Labs needing one case view |
| 2 | Cellebrite | 4 | Mobile, computer, 70+ cloud sources, 80+ drones | $16,304/yr median* | Mobile-first agencies |
| 3 | Exterro FTK | 4 | Computer, mobile, 200+ cloud services | $5,175 per 1-year licence | Disk-heavy corporate cases |
| 4 | Belkasoft X | 2 | Computer, mobile, cloud, 13+ drone models | Quote, free Triage | Small labs on a budget |
| 5 | Nuix Neo | 2 | 1,000+ file types | Quote | Fraud and eDiscovery volume |
| 6 | Autopsy | 2 | Disk images | Free, open source | Training and triage |
| 7 | PenLink | 1 | 8 source types incl. dark web | Quote | Open-web and comms analysis |
| 8 | Cognyte | 1 | Network, blockchain, threat data | Quote | National security units |
| 9 | MSAB | 1 | Mobile, cloud | Quote | Kiosk-based mobile triage |
| 10 | OpenText Forensic | 0 | Mobile, computer, cloud apps | Quote | Existing EnCase shops |
Medians marked * are anonymized buyer-reported contract values published by Vendr. Everything else is the price the vendor publishes itself.
Where these figures come from
Test counts apply the five criteria below to each vendor's own pages. Evidence sources are the ones each vendor names on its product pages, and the FTK price is Exterro's own store listing. The two medians marked * are Vendr's anonymized buyer data for Magnet Forensics and Cellebrite. Belkasoft, Nuix, PenLink, Cognyte, MSAB and OpenText publish no price, so their rows read Quote.
Web analytics vendors such as Similarweb and Contentsquare use the same words for traffic and behaviour data. The three meanings are split further down this page, and the ranking covers the forensic one.
A digital intelligence platform pulls data off phones, computers, cloud accounts, drones and the open web, then turns it into digital evidence an investigator can search, map and defend in court. Cellebrite, the largest vendor here by reported revenue, says its technology runs at more than 7,000 agencies and enterprises and supports about 3 million investigations a year.
This page ranks ten digital intelligence systems for police labs, government agencies, corporate security teams chasing insider threats, and the professional services firms that run cases for them.
The search term carries three meanings. Google's first page mixes forensic vendors with Teradata's data intelligence explainer and Group-IB's threat intelligence product, and Similarweb calls web-traffic data "digital data." Forensics and investigations take the lion's share of the results, so that's the sense ranked here.
Buyers looking for traffic and app analytics want our Similarweb review and the website traffic analysis tools ranking. Analysts working public sources only should start with the open source intelligence tools list, and marketers chasing campaign data want the marketing intelligence tools guide.
Evaluation criteria for digital intelligence platforms
Five criteria decide the shortlist, and the ranking below applies them in this order. Each one is a yes or a no a buyer can check on the vendor's own site, or on Vendr, in under ten minutes. A platform scores one point per pass. Ties break in criteria order, and a tie that survives all five goes to the vendor with more public user reviews.
Four or more evidence source families
The vendor's product pages must name at least four of these: mobile devices, computers, cloud accounts, vehicles or drones, video, and open source intelligence from the open and dark web, which threat intelligence feeds also watch. A case today touches several at once, and every extra product a lab bolts on is another licence and another export format.
A published security attestation
FedRAMP, SOC 2 Type 2 or ISO 27001, shown on the vendor's domain. Vendors increasingly host case data in cloud storage, which faces the same threats as any other cloud workload, so the attestation is the documentation a procurement officer keeps on record before any evidence leaves the building. Role-based access control and audit logs fall inside its scope.
A price visible before a sales call
List prices on the vendor's store and header medians on Vendr both qualify. A missing price is a red flag for any lab building next year's budget.
Vendors on this page that sell on quote only, which makes a visible price the test most of them fail.
A published scale figure
Customer counts, country counts and reported revenue on the vendor's own site qualify. A vague claim such as PenLink's "1000s" of analysts doesn't count, because no buyer can check it.
A free way in
Free tools, editions and trials count when a buyer can download them and run them against their own test image. It's the cheapest way to find out how the software handles a 2 TB disk before signing a contract.
The 10 best digital intelligence platforms, ranked
Magnet Forensics
Best fit
Labs that want mobile, computer, cloud and vehicle data in one case with a cloud option federal auditors accept.
Magnet Forensics, co-founded in 2011 by a former police officer, merged with Grayshift in 2023 and reports over 5,000 customers in more than 100 countries. Its flagship, Magnet Axiom, examines "mobile, cloud, computer, and vehicle sources all in one case file," per the product catalogue, and Axiom Cyber covers remote collection for cyber security teams chasing insider threats.
Key features
- Magnet Axiom and Axiom Cyber for case analysis and remote endpoint collection against cyber threats.
- Magnet Graykey and Verakey for lawful access to mobile data, with Fastrak enabling several devices at once.
- Magnet Griffeye and Magnet Verify for image and video triage and media authentication, the forensic cousin of the visual intelligence platforms brands use.
- Magnet Automate for lab automation and workflows, plus Magnet Review for non-technical reviewers.
- 12 free tools, among them RAM Capture and Encrypted Disk Detector.
Pricing
Quote only. Vendr's anonymised buyer data puts the median at $29,997 a year, range $29,997 to $37,391.
Pros
- 16 compliance listings on its trust centre, including FedRAMP High and SOC 2 Type 2.
- One case across five source families.
- The deepest free-tool shelf of the ten.
Cons
- The highest Vendr median here, 1.84 times Cellebrite's.
- Large cases process slowly.
- Training sits on top of the licence.
A forensic expert at a small firm wrote on G2 in April 2026: "Processing times can be long when dealing with massive cases (several terabytes)." Another reviewer the same day said "Magnet stays up to date with current Android and iOS, which is extremely important and helpful."
Why it's ranked #1. Magnet passes all five tests, the only vendor here to do so, and its 12 free tools give it the free way in Cellebrite at #2 lacks. Nobody below matches its 16 published compliance listings.
Cellebrite
Best fit
Agencies whose focus is phones, with caseloads now reaching drones and cloud accounts.
Cellebrite posted $475.7 million in 2025 revenue, up 19%, with 116% net dollar retention. It bought drone specialist SCG Canada on 2 March 2026, adding access to more than 80 common UAVs, and closed the Corellium deal in December 2025, adding $16.1 million in ARR. Those two deals keep it ahead of the curve on drones and iOS research.
Key features
- Inseyets, bundling UFED, Physical Analyzer, Kiosk and Reader for sharing reports.
- Endpoint Inspector for laptops and cloud data from 70+ sources.
- Guardian, enabling prosecutors to review cases without UFED, on a FedRAMP High government cloud since 6 May 2026.
- Pathfinder and Genesis, which Cellebrite says produces source-traceable leads in minutes.
- Corellium virtual devices for mobile security research.
Pricing
Quote only. Vendr's anonymised buyer data shows a median of $16,304 a year, range $9,151 to $20,352.
Pros
- $475.7 million in 2025 revenue, the largest here.
- Drone and phone extraction under one vendor.
- A Vendr median 46% below Magnet's.
Cons
- Testing starts with a sales call and a quote.
- Annual licence renewals strain public budgets.
- Computer collection sits in a separate product, Endpoint Inspector.
An instructor wrote on G2 in July 2023: "The continued licensing fees can be difficult to get reauthorized in agency budgets each year."
Why it's ranked #2. Cellebrite passes four tests and leads FTK on source breadth, with 80+ drone models and 70+ cloud sources. It trails Magnet at #1 on the fifth test, a free way in.
Exterro FTK
Best fit
Corporate teams working insider threats across large disk images and Microsoft 365 data.
Exterro FTK collects from Windows, macOS and Linux endpoints plus 200+ cloud and SaaS services. Exterro earned ISO 27001 certification on 29 January 2026 and also holds FedRAMP Moderate authorization.
Key features
- FTK for processing, AI review, semantic search and anomaly detection.
- FTK Imager, free, and FTK Imager Pro at $499 with encryption detection.
- FTK Connect, bundled for law enforcement with ACE certification eligibility.
- Remote Mobile Discovery for enterprise phone collection.
Pricing
The FTK licence costs $5,175 for a one-year term on a USB dongle that must be plugged in every session, a bitter pill to swallow for examiners who travel. On-demand training adds $3,450.
Pros
- The only full suite here with a store price.
- A free imager, FTK Imager, for acquisition.
- ISO 27001 and FedRAMP Moderate on record.
Cons
- The dongle must be plugged in every session.
- Heavy hardware demands on big cases.
- Support billing has angered some buyers.
"It can parse a Mac DMG (APFS) that even Magnet Forensic AXIOM could not parse at all."
Small-business owner, G2, June 2024
A pharmaceuticals reviewer wrote in January 2024: "The Extero team has attempted to charge me for support of the product."
Why it's ranked #3. FTK ties Cellebrite on four passes and posts the lowest paid suite price here, $5,175, but names three source families against Cellebrite's four. It beats Belkasoft at #4 on attestation, price and scale.
Belkasoft X
Best fit
Small labs and consultancies that need computer, mobile, cloud and drone analysis from one licence.
Belkasoft X is a jack of all trades. It reads EnCase, FTK, X-Ways, AFF4 and DMG images, supports 13+ drone models, and ships BelkaGPT, a generative AI assistant that queries case data. Its G2 page carries 188 reviews at 4.7, the largest review base of the ten.
Key features
- X Forensic, sold to government buyers only.
- X Corporate for company investigations into insider threats.
- Belkasoft Triage, free.
- Belkasoft Remote Acquisition and the BelkaGPT Hub.
Pricing
Quote only, with a free trial and the free Triage edition.
Pros
- Four source families in one product.
- BelkaGPT queries case data in plain English.
- A free Triage edition.
Cons
- Pricing goes through sales.
- Zero security attestations listed on its site.
- Slow on large datasets, per G2 reviewers.
A founder of a small investigations firm wrote on G2 in August 2026: "The cost is pretty steep, but then again, most digital forensic products are." A specialist the same month said "I switched from Magnet Axiom and Oxygen Detective because their AI capabilities are not like those of Belkasoft."
Why it's ranked #4. Belkasoft passes 2 of 5 tests, source breadth and a free way in, and wins the three-way tie at two because source breadth comes first, which Nuix at #5 lacks. FTK at #3 passes four.
Nuix Neo
Best fit
Fraud, anti-money laundering and eDiscovery teams processing terabytes of email and chat.
Nuix Neo indexes 1,000+ file types and processes email and chat efficiently, rated by Nuix at 1.5 TB an hour. Nuix notes that throughput depends on customer hardware, and the devil's in the details there. Nuix reported A$263.2 million in FY26 revenue, up 18.8%.
Nuix Neo customers in FY26, against 75 a year earlier, per the same investor presentation.
Key features
- Investigations, Legal Discovery and Data Privacy products on one platform.
- Semantic search, transcription and facial recognition.
- Linkurious graph analysis, enabling link charts of relationships between people and accounts.
- A trust centre listing ISO 27001:2022, SOC 2 Type 2 and IRAP.
Pricing
Quote only.
Pros
- Throughput figures published.
- Three security attestations.
- Graph analysis built in.
Cons
- Built around email, documents and chat.
- Hardware hungry.
- Testing starts with a demo request.
A forensic IT specialist wrote on Capterra in 2018: "NUIX needs very powerful hardware if you run big cases, with an emphasis on I/O speed."
Why it's ranked #5. Nuix passes two tests, attestation and scale, with A$263.2 million in revenue. Belkasoft at #4 wins the tie on source breadth, and Nuix beats free Autopsy at #6 because attestation comes before price.
Autopsy
Best fit
Students, trainers and labs that want an open source second opinion on a disk image.
Autopsy is the graphical front end to The Sleuth Kit, maintained by Sleuth Kit Labs, and "is free to download and use," per autopsy.com. The same team sells Cyber Triage at $3,500 a year for automated incident response to malware threats.
Key features
- Disk partition views and add-on modules, with a third-party module directory on GitHub.
- Cyber Triage Malware Scanner and Importer modules, enabling malware scans inside Autopsy.
- A Law Enforcement Bundle and a Video Triage module.
- Subscription support and training with CPE credits.
Pricing
$0. Training and support are paid.
Pros
- A $0 licence.
- Open source code a defence expert can inspect.
- Extensible with modules.
Cons
- Thin on mobile.
- Slow on large images.
- Its user figure is a loose "Tens of thousands."
A security analyst wrote on G2 in October 2022: "Sometimes it is damn slow when we have to search or find some data with a huge hard disk image." A security director wrote the same day that "The ability to view various disk partitions and inject additional modules makes it a great addition to any toolset."
Why it's ranked #6. Autopsy passes two tests at a price of $0, the only free full suite here. Nuix at #5 holds the tie on attestation, and PenLink at #7 passes one test.
PenLink
Best fit
Investigators who combine phone records, social media and open-web data in one case.
PenLink calls its product a "Digital Intelligence Platform" and lists eight source types on its platform page, from digital forensics and open source intelligence to communication data, financial records, documents and databases.
The platform integrates internet-based communications with phone extractions, and PenLink says its AI analyzes millions of records a day for actionable insights. It absorbed Cobwebs Technologies in July 2023, bringing the Tangles web intelligence product and its surface, deep and dark web coverage.
Key features
- PLX for live communication data collection.
- Tangles for social media and dark web search, with alerts on threats, the investigator's counterpart to the media monitoring tools brands buy.
- CoAnalyst and CoAnalyst360, its generative AI agents, plus patterns recognition and 3D and courtroom visualization.
- 1,000+ formats, deployable on Azure, AWS, air-gapped networks or on-premises.
Pricing
Quote only.
Pros
- The broadest named source list of the ten.
- Air-gapped deployment.
- Open-web and phone data in one of its investigative workflows.
Cons
- Price, attestations and customer counts all go through sales.
- Its only scale claim is "1000s" of analysts.
- Its Webloc location product drew a Citizen Lab analysis on 9 April 2026.
Why it's ranked #7. PenLink passes 1 of 5 tests, with 8 named source types, and wins the one-point tie because source breadth comes first. Autopsy at #6 passes two, Cognyte at #8 one.
Cognyte
Best fit
National security units tracking threats across network, financial and dark web data.
Cognyte sells investigative analytics, branded "Actionable Intelligence for a Safer World," to roughly 100 countries per its homepage. It reported $400.0 million in fiscal 2026 revenue, up 14.1%.
Share of Cognyte's fiscal 2026 revenue that was recurring, per the same results release.
Key features
- NEXYTE decision intelligence for investigative analytics.
- Network Intelligence, Operational Intelligence and Blockchain Analytics.
- Threat Intelligence Analytics and threat hunting for SOC teams.
- LUMINAR external threat intelligence, monitoring dark web sources for threats against client organizations.
Pricing
Quote only.
Pros
- $400.0 million in reported revenue.
- Threat intelligence and case analytics from one vendor.
- LUMINAR rated 4.8 on Gartner Peer Insights.
Cons
- Analytics-only, so labs pair it with an extraction suite.
- Pricing and trials go through sales.
- Its site lists product lines and leaves data sources unnamed.
A director of IT security and risk management wrote on Gartner Peer Insights in May 2026: "It was very easy to make the initial customization of the solution."
Why it's ranked #8. Cognyte passes one test with $400.0 million in revenue, then beats MSAB at #9 on public reviews, 9 LUMINAR ratings against none. PenLink at #7 holds the tie on source breadth.
MSAB
Best fit
Police forces that push mobile extraction out to station kiosks.
MSAB, founded in Stockholm in 1984, sells XRY to customers in more than 100 countries around the world and reported SEK 461.8 million in 2025 net sales, up 14.1%, at a 14.7% operating margin.
Key features
- XRY Logical, Physical, Pro, Cloud, Photon and Camera extraction.
- XAMN for analysis and XEC for fleet management.
- Kiosk and Tablet platforms.
- Three certification tracks testing examiner knowledge, from specialist to professional.
Pricing
Quote only.
Pros
- Listed on Nasdaq Stockholm, with published annual reports.
- Kiosk-first design.
- Formal training for professionals.
Cons
- Mobile and cloud only.
- Pricing, attestations and trials all go through sales.
- PeerSpot lists XRY with zero user reviews.
Why it's ranked #9. MSAB passes one test, scale, with SEK 461.8 million in sales, and loses the tie to Cognyte at #8 on public reviews. It beats OpenText Forensic at #10, which passes none.
OpenText Forensic
Best fit
Labs with years of EnCase cases and E01 archives.
OpenText renamed EnCase Forensic to OpenText Forensic, which supports 36,000+ device profiles, cloud apps and file systems and writes E01, L01 and AFF4 images "proven in legal proceedings worldwide." OpenText also sells forensic hardware formerly branded Tableau.
Key features
- E01, L01 and AFF4 acquisition.
- EnCase-format images that Belkasoft X also reads.
- The TX2 Imager and TD4 Duplicator.
- Forensic Bridges write blockers.
Pricing
Quote only.
Pros
- Over 20 years of court use, by OpenText's count.
- The E01 format other suites read.
- Hardware from the same vendor.
Cons
- Fails all five tests on its product page.
- Reviewers report slow processing.
- An interface G2 users call dated.
A government reviewer wrote on G2 in July 2022: "Analyzing big raw or e01 files is slow."
Why it's ranked #10. OpenText Forensic passes none of the five tests on its product page, against one each for MSAB at #9. Its 36,000+ device range keeps it on the list.
What a digital intelligence platform does
A digital intelligence platform is software that collects data from digital sources, parses it and gives analysts one place to search it. PenLink names the workflow in six verbs on its platform page: query, collect, analyze, map, visualize and report. Digital intelligence vendors differ on which sources they open and how much of the analysis they hand to machine learning, and on how fast they give analysts an understanding of who did what.
- Collection: phone extraction, disk imaging, cloud pulls, drone logs and open-web capture.
- Parsing: turning raw data into chats, locations, photos and metadata, with each message kept in context.
- Analysis: creating timelines and link charts, keyword search and AI tagging that flags threats and patterns.
- Review and reports: sharing digital evidence with prosecutors who don't run the software.
Finding one deleted chat in a 2 TB extraction is a needle in a haystack without the analysis layer. A report a defence expert can't reproduce is a report a judge can exclude.
Who buys digital intelligence systems
Four groups of organizations buy digital intelligence software at police labs and companies around the world, and each weighs the five tests differently.
- Police and government agencies: phone and computer data extraction for criminal cases, creating digital evidence for prosecutors. Cellebrite counts 7,000+ agencies and enterprises among its users.
- Corporate security teams: insider and external threats, IP theft and fraud, often run by cyber security and HR together. Exterro's about page says "50% Of Fortune 100 trust Exterro."
- Law firms and professional services firms: eDiscovery, breach reviews and expert witness work.
- Intelligence and national security units: fusing communication records and open source intelligence with threat intelligence feeds to follow threats across borders.
The value each group gets depends on context. A police lab needs operational speed on seized phones. A corporate team needs remote collection from laptops it already controls. Buying technology for either is easier said than done, because professionals who move between sectors carry their knowledge of one suite with them and push for it at renewal.
Digital intelligence, data intelligence and threat intelligence
Three industries use nearly the same words. Data intelligence platforms catalogue a company's own databases. Teradata defines one as software that "collects and organizes metadata about your data estate," tracks lineage, which gives every table its context, centralizes access policies and runs automated monitors for freshness and schema drift.
Its machine learning layer classifies data, for example by detecting PII, and Teradata pitches the concept to organizations that need to trust their data and get insight from it faster.
Our data intelligence tools ranking covers that market, and decision intelligence platforms add the decision execution Gartner lists as a mandatory feature. Web analytics technology vendors use "digital intelligence" for traffic and behaviour data. Similarweb analyzes 100M+ websites and 4M+ apps with 10 years of history, and session replay, funnel analysis and behavioural analytics belong to that sense too.
Contentsquare, in the same camp, sends AI alerts for site errors and ties them to bounce rate, conversions and revenue.
Threat intelligence is the third meaning, and the one that overlaps forensics most. A threat intelligence platform watches for threats before an incident. A forensic suite reconstructs what happened after one. Group-IB, ranking on page one, sells a threat intelligence platform that tracks threats with 12 AI agents, cites a Forrester-calculated 339% ROI, and says it doesn't charge per user, integration or API call.
- Insider threats: FTK, Axiom Cyber and Cellebrite Endpoint Inspector collect from employee laptops.
- External threats: Group-IB and LUMINAR run real-time monitoring of the dark web and send alerts on threats against brands and staff. Open-web brand chatter belongs to social listening tools.
- Drone threats: Cellebrite's SCG unit extracts flight data from 80+ UAV models.
- Threats to children: Magnet Outrider triages computers for CSAM, and Nuix sells a CSAM investigations product.
- Financial threats: Cognyte Blockchain Analytics and Nuix's anti-money laundering product follow the money.
Indicators of compromise found on a seized laptop feed back into threat intelligence, and fresh threats from the feed tell examiners which artifacts to search first in their forensic workflows.
Cyber threat intelligence also gives organizations an understanding of adversary behaviour, and insight into who is targeting them, that a disk image alone can't supply. Ask any threat intelligence vendor which forensic suites it can integrate with before signing. Teams buying external threat intelligence should also read the third-party risk management tools ranking.
Certifications, court admissibility and evidence handling
Court admissibility of digital evidence rests on the image format and the chain of custody, and a buyer can check both. E01 and AFF4 images carry hashes that prove the copy matches the source, so the examiner can present the same hash in court. Write blockers, sold by OpenText as Forensic Bridges and by Digital Intelligence in Wisconsin, keep control of the original drive during evidence collection, and the chain of custody puts each item in context for the court.
Cloud technology adds a second layer. Cellebrite's government cloud reached FedRAMP High on 6 May 2026, authorized by the U.S. Department of Justice. Magnet lists FedRAMP High, GovRAMP, IRAP and GDPR. Exterro holds FedRAMP Moderate. A lab storing case data in a vendor cloud without one of these is skating on thin ice with its auditors, and the public sector guide covers the procurement side.
What digital intelligence software costs
Four of the ten have a number a buyer can see before a sales call. Autopsy is free, FTK runs $5,175 a year, and Vendr's medians put Cellebrite at $16,304 and Magnet at $29,997. Quote-only pricing is par for the course for the other six. Hardware, training and professional services sit on top, and they add up fast.
- FTK on-demand training: $3,450.
- FTK Imager Pro: $499.
- Cyber Triage Standard Pro: $3,500 a year.
- Forensic workstations and write blockers: quoted by Digital Intelligence and OpenText.
Multi-year public-sector contracts and per-seat add-ons make quoted prices hard to compare. Get the year-two renewal figure in writing and read between the lines of any auto-renewal clause.
Cellebrite's 2025 net dollar retention, which means existing accounts spent 16% more in 2025 than a year earlier. Its G2 reviewer flagged those renewals as the budget problem.
How to run a digital forensics platform trial
Real-world test data beats a vendor's technology demo. Run every shortlisted product against the same test image and the same phone extraction, time each one, and leave no stone unturned on export. Log each run on our vendor evaluation scorecard.
- Start by creating a 500 GB test image and one phone extraction with known artifacts.
- Process both in each product and record hours to completion.
- Count recovered chats, locations and deleted items against the known list to measure parsing depth.
- Export E01 images and PDF case summaries, then reopen both in another product.
- Ask who gets access to hosted case data, which products integrate with your case management system, and what the renewal terms are.
The value of a free tool is a cheap test.
Smaller organizations can try Magnet's free tools, FTK Imager, Belkasoft Triage and Autopsy at no cost, for example on a retired office laptop. Everyone else needs a sales call before step two.
Digital intelligence FAQ
What is a digital intelligence platform?
Software and hardware technology that extracts, parses and analyzes data from phones, computers, cloud accounts and online sources for investigations into crimes and security threats. Cellebrite and PenLink both use the term for their products.
What does digital intelligence do?
It turns raw data from devices and online sources into actionable insights, such as who contacted whom, where a phone was and which files left a laptop. For security teams it also means spotting threats early through alerts and monitoring.
Which companies are the best for digital forensics?
On the five tests above, Magnet Forensics, Cellebrite and Exterro lead, passing five, four and four. Belkasoft is the strongest of the quote-only vendors on source breadth.
What software is commonly used in digital forensics?
Magnet Axiom, Cellebrite UFED and Physical Analyzer, FTK, Belkasoft X, OpenText Forensic, MSAB XRY and the free Autopsy. Most labs run two or three so one product can check another.
What is a digital intelligence service?
Professional services for professionals without their own lab, covering extraction, expert testimony, knowledge transfer and training. Digital Intelligence, the Wisconsin hardware maker, has sold hardware, training and professional services since 1999.
What are the top threat intelligence tools?
Group-IB's Threat Intelligence Platform, Cognyte LUMINAR and Recorded Future, which appears in our OSINT tools ranking. They watch for threats. The forensic suites above examine seized devices after an incident.
Bottom line
Magnet Forensics is the pick for labs that want one case for every source, a free way to test it and a FedRAMP High cloud. Cellebrite suits mobile-first agencies and costs less at the median. FTK is the budget suite with a public price, at $5,175 a year.
Belkasoft and Autopsy serve small labs and training rooms. PenLink and Cognyte belong to investigators whose cases start with online threats or network data, and MSAB and OpenText suit forces already committed to XRY kiosks or EnCase archives. Teams that need threat intelligence before an incident should start with Group-IB or LUMINAR. Analysts who only need open source intelligence belong in the OSINT ranking.