Oxygen Forensic Suite Alternatives for Mobile Forensics

If you searched for Oxygen Forensic Suite, the product you want is now called Oxygen Forensic Detective. Forensic Suite was the older name, and its Forensics Wiki entry lists version 6.5 from September 2014 as its last release. Oxygen Forensics is still active. Detective covers more than 35,000 devices, over 100 cloud services and 50,000+ app versions, plus drones, IoT, SD cards and computer artifacts from Windows, Linux and macOS. Detective v18.1 (December 2025) added chained Android extractions and a cryptocurrency section for wallets and seed phrases.

Detective is sold as a perpetual licence, single-seat or as a network licence on one USB dongle with 5 to 50 concurrent users. There is no public price and no trial on the product page. It runs on 64-bit Windows with at least 12 GB of RAM. Labs look elsewhere when a quote comes back too high, when they need an extraction method Oxygen lacks for a given phone, or when they want a second tool to verify findings. The picks below start with full suites and end with free parsers.

Prices below are as of November 6, 2026. Our method is on How we review tools.

Quick comparison

Cellebrite Inseyets

Most labs that compare Oxygen with something compare it with Cellebrite. Its UFED extraction tool and Physical Analyzer are now sold together under the Inseyets name, along with Kiosk for self-service stations in police stations, Reader for sharing reports, and CFID. Cellebrite also bought Corellium, an Arm virtualization company, in December 2025, and has added an AI assistant called Genesis.

The two vendors pitch different strengths. Cellebrite's site leads with UFED extraction and Corellium virtualization, while Oxygen's product page leads with cloud extraction and parsing of 50,000+ app versions. Running both and cross-checking results is common enough that MSAB's XRY can decode iOS extractions from either. Our Cellebrite alternatives guide covers the tools that compete with it head-on.

Best for: Law enforcement labs that need the widest locked-phone extraction support and can pay enterprise prices.

Pricing:

• No public price; every product page leads to Contact Sales

Watch out for:

• Nothing on the Cellebrite site shows a price, so you cannot compare it with an Oxygen quote until both vendors have answered.
• UFED and Physical Analyzer are bundled into Inseyets, so check which parts of the bundle you actually need before signing.

Official site: Cellebrite Inseyets.

Magnet Axiom

Magnet Axiom puts phones, computers, cloud accounts and vehicle data into one case file, which is the same pitch Oxygen makes with Detective. Axiom Premier licences include Griffeye Advanced for image and video review.

For locked devices, Magnet sells Graykey separately, and Graykey extractions load straight into Axiom. Graykey is only for public agencies in select countries. For corporate investigations, Magnet sells a separate edition called Axiom Cyber.

Best for: Examiners who want one review tool for phone, computer and cloud evidence in the same case.

Pricing:

• No public price; contact sales
• Free trial on request
• Axiom Premier includes Griffeye Advanced

Watch out for:

• There is no public price on the product page, so you cannot budget for it until a quote comes back.
• Locked-phone access means a second product, Graykey, which private companies cannot buy.

Official site: Magnet Axiom.

Belkasoft X

Belkasoft X is the pick closest to Oxygen in licensing: it is also sold as a perpetual licence, and there is a free trial, which Oxygen's product page does not offer. It acquires phones through iTunes backups, an agent, checkm8 on supported iPhones and APK downgrade on Android, and it brute-forces passcodes on a range of iOS and Android models. Computers, drones and car images go into the same case.

Belkasoft also gives away two useful tools: Belkasoft Triage for quick scans on site and Live RAM Capturer for memory dumps. The suite comes in Forensic and Corporate editions, and the edition you can buy depends on who you are.

Best for: Labs that want a perpetual licence and a trial before committing, for phones and computers alike.

Pricing:

• No public price; request a quote
• Perpetual licence, free trial
• Belkasoft Triage and Live RAM Capturer: free

Watch out for:

• X Forensic is for government customers only, per the product page. Private investigators and companies get X Corporate.
• Passcode brute force covers a range of devices, not all of them. Check your target models against Belkasoft's support list before a case depends on it.

Official site: Belkasoft X.

MSAB XRY

MSAB, a Swedish company, sells XRY as separate modules: Logical, Physical, Pro, Cloud, Photon and Camera. That lets a small unit buy logical extraction only and add the expensive Pro module later. XRY Pro handles hard-to-access phones with no cap on lock bypasses and extractions, and the Q1 2026 release added native GPU brute-forcing, GPS device extraction and crypto seed phrases found in RAM.

It also decodes iOS extractions made by Cellebrite Inseyets, Graykey and Oxygen, so a lab can mix tools. Feature phones on MTK, Spreadtrum, CoolSand and Infineon chipsets are supported too, which still matters in some regions.

Best for: Agencies that want to buy extraction in modules and handle older feature phones as well as smartphones.

Pricing:

• No public price; contact MSAB or a local distributor
• Logical, Physical, Pro, Cloud, Photon and Camera sold as modules

Watch out for:

• Locked, secure phones need XRY Pro, the top module, according to the XRY page. Logical or Physical alone will not get you there.
• It runs on Windows, and the licence model is not published, so ask MSAB before you budget.

Official site: MSAB XRY.

MOBILedit Forensic

Compelson's MOBILedit Forensic is the rare tool in this field with prices on its website. A Single Phone Edition costs €99 and covers one device, which suits a private examiner who gets one case a quarter. The Standard Edition is €2,100 one-time with 12 months of updates. It extracts data from phones, smartwatches and cloud services.

PRO and ULTRA editions add deeper extraction and locked-phone access, priced on request. Prices on the store are in euros for Europe, excluding tax, and the page warns regional prices may differ.

Best for: Independent examiners and small firms who need a known price and whose phones usually arrive with the passcode known.

Pricing:

• Single Phone Edition: €99 per phone, 6 months of updates
• Standard Edition: €2,100 one-time, 12 months of updates
• PRO and ULTRA: price on request
• Euro prices, excluding tax

Watch out for:

• Locked phones need ULTRA, which the edition page classes as a dual-use item with regulated export from the EU.
• Updates end after the included period. Renewing for another 12 months usually costs 50% of a new licence.

Official site: MOBILedit Forensic.

Elcomsoft iOS Forensic Toolkit

Elcomsoft iOS Forensic Toolkit does one thing: low-level extraction from Apple devices. On supported models it uses the checkm8 bootloader exploit to pull a full file system extraction. Version 10.12 shipped on October 9, 2026.

It runs on Windows 10 and 11, macOS 11 to 26 and Linux, and the full version is listed at $2,199. It works as an add-on as much as a replacement: iLEAPP, for one, reads tar and zip extractions for analysis.

Best for: Examiners who need deeper iPhone extraction than their main suite gives them.

Pricing:

• Full version: $2,199
• Licence term not published

Watch out for:

• The Windows build is limited. The product page says bootloader extraction and passcode recovery are only on macOS and Linux.
• No Android support, so a mixed caseload still needs a second extraction tool.

Official site: Elcomsoft iOS Forensic Toolkit.

Autopsy and The Sleuth Kit

Autopsy is the free graphical front end to The Sleuth Kit. It is built for disk images more than phones, but it also opens Android images, which helps when another tool made the extraction. Version 4.23.1 is the current download, and 4.23.0 added an MCP server so an AI client can query a case.

Its value next to Oxygen is cost. Because it is free, you can put it on every workstation and review images and laptops without tying up a paid Oxygen seat. Our FTK Imager alternatives guide covers the free imagers that feed it.

Best for: Teams who need free analysis seats for disk and Android images alongside one paid phone suite.

Pricing:

• Free and open source

Watch out for:

• The 4.23.0 release notes warn of big slowdowns when an EDR scans the case folders and images. Exclude them from scanning.
• It does not acquire phones, and Linux and macOS users unpack a ZIP and install dependencies by hand.

Official site: Autopsy and The Sleuth Kit. Our listing: Autopsy and The Sleuth Kit.

iLEAPP and ALEAPP

Alexis Brignoni's iLEAPP and ALEAPP are free Python parsers for iOS and Android extractions. Feed iLEAPP a folder, zip, tar or iTunes and Finder backup, including encrypted ones, and it writes HTML and TSV reports, a timeline and KML maps. ALEAPP does the same for Android, including raw and E01 images on NTFS, ext4, APFS and other file systems.

Both are MIT-licensed and run on Python, so you can read exactly how each artifact is parsed. Running them after an Oxygen or Cellebrite extraction gives you a second opinion from code anyone can check.

Best for: Examiners who want a free, scriptable check on what their commercial tool parsed.

Pricing:

• Free and open source, MIT licence

Watch out for:

• They parse but never acquire. The ALEAPP README describes working on existing extractions, so another tool must get the data off the phone.
• ALEAPP has no prebuilt Windows executable; the README explains how to build one with PyInstaller.

Official site: iLEAPP and ALEAPP.

How to choose

When to stay with Oxygen Forensic Suite

Stay with Oxygen Forensic Detective if cloud extraction and app coverage drive your cases. Its claims of 100+ cloud services and 50,000+ app versions are hard to match, and the perpetual network licence on one dongle lets a team share 5 to 50 seats instead of buying one per examiner. Check the install guide before you upgrade hardware, since it needs 64-bit Windows and 12 GB of RAM.

Frequently asked questions