Forensic Software

Digital Forensics All-In-One

There are no boundaries of digital evidence when you use E3:Universal. You can process file system/hard drive data, smartphone/mobile data, and IoT data.




E3:P2 Commander

A comprehensive file system, email, and internet data support threaded for powerful processing.




Mobile Forensics


Comprehensive Mobile Support

Acquisitions, Analysis, & Cloud

Mobile forensics is the most dynamic of the digital forensic disciplines. Understanding those changes and staying on top of them is one of the hardest parts of the job. Releases that are staying on top of updates, innovations to techniques, and analysis of the data you need to find.



P2 eXplorer Pro

P2X Pro is a forensic image mounting tool designed to help investigators manage and examine the evidence.  With P2X Pro you can mount forensic images as read-only local logical and physical disks. Once mounted, you can explore the contents of the image using Windows Explorer or you can load it into your forensic analysis tool.



E3 Viewer

E3:Viewer is an inclusive case review tool designed for other investigators to be able to review digital evidence from all types of digital devices without having to do the processing of the evidence. E3:Viewer is a great tool for those working in a tiered environment where a lab does the primary process of the digital data and provides it for review by case agents, attorneys, or other third parties.


E3: Internet/Chat


Internet & Chat Examiner is a new combination tool that can help with simple examinations of data associated with internet history and instant messaging. This software can be installed on the system that you want to examine or it can be set up on a forensic workstation to review an acquired image.




EMX has been a force to be reckoned with since 2002 and still provides comprehensive email archive support at a fraction of the price of other tools. E3:EMX allows you to analyze message headers, bodies, and attachments. E3:EMX doesn’t just recover email in the deleted folders; it recovers email deleted from deleted items (deleted/deleted). E3:EMX is the industry-leading email examination tool that is easy enough for anyone to use. Analyze email from head-to-toe, including detailed attachment sorting and analysis. E3:EMX supports all major email types that are stored on local computers for analysis, reporting, and exporting/conversion.



NEMX has been a standard in analyzing network email archives since 2002. Filtering through millions of messages and outputting your results into PST files for review by clients and counsel has become a common task for forensic examiners, eDiscovery experts, and IT security personnel throughout the world. E3:NEMX makes it easy to sift through hundreds of gigabytes of email. Whether you’re investigating Microsoft Exchange, Lotus Notes, or Novell GroupWise, your job just got easier with E3:NEMX.


Password Recovery Bundle

All password recovery tools in a single value pack. Unlock documents, decrypt archives, break into encrypted containers with an all-in-one password recovery bundle.
  • Breaks passwords to several hundred formats
  • Works 20 to 200 times faster with hardware acceleration using conventional video cards for GPU acceleration+
  • Distributed attacks with excellent scalability on up to 10,000 computers
  • Includes all relevant password recovery tools in a single package



Mobile Forensic Bundle

The complete mobile forensic kit in a single pack. Perform physical, logical and over-the-air acquisition of smartphones and tablets, break mobile backup passwords and decrypt encrypted backups, view and analyze information stored in mobile devices
  • Tools for a logical, physical and over-the-air acquisition of mobile devices
  • Over-the-air acquisition of iOS devices, Microsoft and Google accounts
  • iCloud acquisition with or without the password
  • Breaks passwords to mobile backups with GPU acceleration
  • Access to deleted evidence and forensically sound extraction


Distributed Password Recovery

Break complex passwords, recover strong encryption keys and unlock documents in a production environment.
  • Break passwords to more than 300 types of data
  • Heterogeneous GPU acceleration with multiple video cards per computer
  • Works 20 to 200 times faster with hardware acceleration
  • Linear scalability with low bandwidth requirements and zero overhead on up to 10,000 computers
  • Remote deployment and console management

Supports: all versions of Microsoft Office, OpenOffice, ZIP/RAR/RAR5, PDF, BitLocker/PGP/TrueCrypt. Over 500 formats supported.

iOS Forensic Toolkit

Perform physical and logical acquisition of iPhone, iPad and iPod Touch devices. Image device file system, extract device secrets (passwords, encryption keys and protected data) and decrypt the file system image.
  • Physical acquisition for 32-bit and 64-bit iOS devices via jailbreak
  • Logical acquisition with iTunes-style backup includes decrypted keychain
  • Unlocks iOS devices with pairing records (lockdown files)
  • Decrypts keychain items and extracts device keys
  • Real-time file system acquisition for jailbroken devices
  • Quickly extracts media and shared files, even if backup password is set


Phone Breaker

Perform logical and over-the-air acquisition of devices, break into encrypted backups, obtain and analyze information from Apple iCloud.
  • Break passwords and decrypt iOS backups with GPU acceleration
  • Decrypt BlackBerry 10 backups
  • Acquire data from Microsoft accounts
  • Download iCloud backups and synced data with or without Apple ID password

Supports: local iOS backups (iTunes); iCloud and iCloud Drive backups; iCloud synced data (call logs, photos, browsing history etc.); BlackBerry 10 backups; Microsoft Account (with valid authentication credentials); Windows Phone 8, 8.1, Windows 10 Mobile backups; iCloud authentication tokens.

Phone Viewer

Analyze information extracted with ElcomSoft and third-party acquisition tools with a fast, lightweight viewer. Decrypt and view iOS backups and synced data, analyze iCloud Photo Library, BlackBerry 10 backups and Windows Phone/Windows 10 Mobile data, view passwords and access synchronized data with ease.
  • Lightweight forensic viewer requiring no learning curve
  • Analyze data extracted by ElcomSoft acquisition tools
  • Access iOS notifications and deleted data such as Safari history records
  • View information unavailable in other forensic tools

Supports: local iOS backups (iTunes), iCloud backups, iOS synced data (call logs, browsing history and so on), Windows Phone and Windows 10 Mobile backups, BlackBerry 10 backups.


Cloud eXplorer

Extract everything from your Google Account. Download users’ location history, files and documents, Contacts, Hangouts Messages, Google Keep, Chrome browsing history, search history and page transitions, Calendars, images, and a lot more.
  • Download the complete set of data from Google Account
  • Extract significantly more information than available via Google Takeout
  • Authenticate without a password and bypass Two-Factor Authentication
  • Search, filter and analyze information with built-in viewer
  • Access user passwords, browsing history, contacts, location history, email and much more
  • Obtain files and documents from Google Drive

Supports: Google Account, over-the-air acquisition, two-factor authentication, built-in viewer, Windows and Mac editions


Forensic Disk Decryptor

Instantly access data stored in encrypted BitLocker, FileVault 2, PGP and TrueCrypt containers. The tool decrypts files and folders stored in crypto containers or mount encrypted volumes as new drive letters for an instant, real-time access.
  • Decrypt BitLocker, BitLocker To Go, FileVault 2, PGP and TrueCrypt volumes
  • Extract cryptographic keys from RAM captures hibernation and page files, escrow and Recovery keys
  • Extract and store all available encryption keys
  • Instantly mount encrypted containers as drive letters
  • Capture the content of computer’s volatile memory with kernel-level tool
  • Fast, zero-footprint operation
  • A forensic-grade memory imaging tool is included


Elcomsoft Forensic Disk Decryptor 2.0 now fully supports EnCase Images in the industry– standard.EO1 format, as well as encrypted DMG images. In addition, Elcomsoft Forensic Disk Decryptor can be used to create a portable installation on a user-provided USB flash drive. The portable installation can be used to image computer’s volatile memory and/or mount or decrypt encrypted volumes.

Axiom For Law Enforcement




Axiom’s powerful search capability recovers evidence from hundreds of types of digital forensic artifacts. Find evidence that you didn’t know was there and that can’t be recovered by other tools.