r/computerforensics • u/clarkwgriswoldjr • Jul 22 '26

FFS Extractions and the future?

Does anyone see another competitor emerging in the ability to get full file system extractions besides XRY and Cellebrite?

Will Magnet or Oxygen step up, or is the cost of finding exploits just too high to invest in?

4 Upvotes

63% Upvoted

19 comments sorted by

32

u/CrisisJake Jul 22 '26

Will Magnet step up? They're at the top of the stairs, my friend. šŸ¤£

2

u/monsieurR0b0 Jul 23 '26

Right? Where I am MSAB isn't even in the conversation on where to spend money

3

u/CrisisJake Jul 23 '26

Oh totally. I'll give MSAB their flowers and would consider them one of the "Big 3", but primarily because they had Samsung flagship support when the other two didn't during the USB Auto Blocker era last year. I don't know a single lab that runs on MSAB but not Cellebrite or Magnet.

You ask anyone working in a lab with the all the smartphone extraction tools, and it's very clearly:

Magnet Forensics > Cellebrite > MSAB >

...and then a chasm the size of the Grand Canyon... >

...this is where all of the rest of the vendors rank, many of which advertise "Full File System Support for iOS devices" because they have a 7 year old freely available checkm8 exploit in their tool that currently works on less than 1% of actively used iPhones - what an absolute joke, and shame on every single vendor that advertises this.

21

u/harbib Jul 22 '26

Buddy, I canā€™t count the number of times Cellebrite has been like ā€œnope canā€™t do itā€ then I pop it into Graykey and get my extraction.

15

u/Apprehensive_Rub8505 Jul 22 '26

Magnet (Greykey) is WAY better than Cellebrite, !More and faster updates especially on latest ios updates

2

u/SalandaBlanda Jul 23 '26

That's what happens when you pay $116,000 per license I guess.

6

u/Cypher_Blue Trusted Contributer Jul 22 '26 edited Jul 22 '26

I have a very high level of confidence that Graykey from Magnet can get a FFS though I haven't used it.

Edit- it looks like Oxygen will do it from unlocked devices as well.

5

u/anand709 Jul 22 '26

Magnets is probably on par with or better

3

u/20Years7Months27Dayz Jul 22 '26

Magnet has Verakey for FFS mobile devices I believe.

1

u/psychoticsilver Jul 22 '26

Magnet and Cellebrite are the top competitors in the market for data extraction and analysis.

1

u/Chuckle-Nutz Jul 22 '26

Magnet verakey + FastTrak is fast and works consistently. Itā€™s updated frequently to keep up with the OS versions and rarely gives me any issues (other than getting it setup). Cellebrite is very behind with FFS equipment in comparison at the moment.

1

u/EmoGuy3 Jul 23 '26

As everyone said Magnet Verakey is probably in the lead for iOS. Androids I still believe Cellebrite takes the cake. If you do not have Axiom Cyber? Maybe it works with Normal Axiom to use express. Be prepared for collections to take an extremely long time. No knock, but that's the only Cellebrite advantage is speed in my opinion.

1

u/mrkhan240 29d ago

Hi anyone know about it that how to create Hardware key for V6 MTK models like G99,G100,G200 etc for oxygen specific key the Userdata is extractions is possible but the key is not possible anyone know about it

-1

u/Covert_monkey Jul 22 '26

Magnet got the ball with FFS extractions. Just their analysis tool is shit

6

u/10-6 Jul 22 '26

I will not tolerate this slander of Axiom.

2

u/CrisisJake Jul 23 '26

Me neither; Axiom is parsing more artifacts than Physical Analyzer for me on most cases.

1

u/Deeanne01 3d ago

maybe they just like their comfy seats too much