IDC MarketScape: Worldwide Digital Forensics in Public Safety 2022 Vendor Assessment

Alison Brooks, Ph.D.

THIS IDC MARKETSCAPE EXCERPT FEATURES CELLEBRITE

IDC MARKETSCAPE FIGURE

FIGURE 1

IDC MarketScape Worldwide Digital Forensics in Public Safety Vendor Assessment

Source: IDC, 2022

Please see the Appendix for detailed methodology, market definition, and scoring criteria.

IN THIS EXCERPT

The content for this excerpt was taken directly from IDC MarketScape: Digital Forensics in Public Safety 2022 Vendor Assessment (Doc # US48999722). All or parts of the following sections are included in this excerpt: IDC Opinion, IDC MarketScape Vendor Inclusion Criteria, Essential Guidance, Vendor Summary Profile, Appendix and Learn More. Also included is Figure 1.

IDC OPINION

Reining in the digital deluge is a sizable challenge for every organization in 2022, but it is particularly challenging for law enforcement, wrestling with exponential growth in the volume, variety, and velocity of data coming into the investigative organization.

Exponential Growth in the Volume of Data

According to IDC’s Global DataSphere 2021–2025 Forecast, the amount of digital data created over the next five years will be:

  • At least 2.5x the amount of data created over the past 10 years
  • Over 2x the amount of data created since the advent of digital storage

As part of this evaluation, IDC spoke with dozens of organizations using digital forensics solutions in criminal investigations. Among the technology buyers IDC spoke with, we noted a commonality in the challenges they face and a wide range of agency approaches to managing digital forensics solutions. Historically, digital forensics was focused on a singular device (a laptop) or a small number of smartphones. Today, the challenge is managing the information from a large number of devices and an almost limitless number of heterogenous data sources. Each of the vendors in this study was able to conduct forensic analyses of upward of 30,000 different smartphone profiles. Very large data sets coming from call detail records, mobile phones, and laptops, as well as telecom, cloud, and internet service providers, complicate this further. Outpacing traditional resources, workflow, and processes, agencies are looking for efficient solutions that transform time-intensive workflows.

Exponential Growth in the Variety of Data Being Analyzed

The digital universe is rapidly expanding, spurred on by the adoption of a dizzying array of digital assets, smartphones, IoT devices, and large cloud-generated data sets. Net-new data sources are being woven into the investigative process continuously; drone video footage was a rarity five years ago, for example, and algorithmic DNA databases are now regularly searched to generate leads in homicide cases. More recently, agencies are having to incorporate open source intelligence (OSINT), wearables, in-car diagnostics, gaming consoles, routers, Bluetooth data, and a host of geotagged data that needs to be mined from the cloud.

The pressure to quickly extract, process, manage, and analyze these mounting data sources is challenging. Delays in processing evidence lengthen the time to trial, and this in turn is leading to cases being stayed because delays breach a citizen’s rights to a timely trial. At the same time, digital evidence is increasingly relevant to a wider range of investigations; better analytic tools and collaborative capabilities are needed to enable agencies to leverage evidence much faster in many more cases.

IDC MARKETSCAPE VENDOR INCLUSION CRITERIA

This IDC study provides an assessment of vendors offering global, end-to-end digital forensics capabilities in government and public safety. Typically, IDC MarketScape documents analyze popular vendors in a given market; the smaller subset of six vendors in this analysis is attributable to this being a niche area within public safety.

Specifically, vendors were included in this IDC MarketScape if they were an end-to-end solution provider (in contrast with the specialty forensics tool providers) and if they operated in at least three of the following geographies:

  • North America
  • South America
  • Western Europe
  • Central and Eastern Europe
  • The Middle East and Africa
  • Asia/Pacific (including Japan)

ADVICE FOR TECHNOLOGY BUYERS

Given our expectations that the volume, variety, and velocity of data coming into police agencies are likely to continue to increase, technology buyers should be purchasing solutions from vendors focused on the following:

  • Automation. The automation of workflow and processing capabilities will be pivotal to agencies coping with this fast-paced environment.
  • Cloud compute platform power. Cloud compute platforms will grow in importance as a means to enhance processing power and to provide agencies with the ability to scale for volume.
  • Ethics, privacy, and transparency. Solutions that are able to manage technological overreach are growing in importance. Focusing on overreach is important as it addresses privacy and surveillance concerns, but it also indirectly lessens the volume issues associated with forensic extraction.
  • Innovation. Research and development (R&D) expenditures are critical to staying ahead of emerging technological challenges in this space.
  • Value partnerships. There is a renewed focus on trusted value partners as agencies are looking to work with vendors that truly understand the complexities of criminal investigations today.

VENDOR SUMMARY PROFILES

This section briefly explains IDC’s key observations resulting in a vendor’s position in the IDC MarketScape. While every vendor is evaluated against each of the criteria outlined in the Appendix, the description here provides a summary of each vendor’s strengths and challenges.

Cellebrite

Cellebrite is positioned in the Leaders category in this 2022 IDC MarketScape for worldwide digital forensics in public safety.

Founded more than 20 years ago, Cellebrite is a global leader in the digital forensics space, a market it is seeking to redefine more broadly as “digital intelligence” to reflect the challenges inherent in managing the digital deluge and the rising complexity of digital investigations. In August 2021, Cellebrite became a publicly trading company on the Nasdaq (CLBT).

Quick facts about Cellebrite are as follows:

  • Globalization: Headquartered in Israel, with 14 offices in 11 countries
  • Employees: A total of 900 employees globally
  • Deployments: Investigative digital intelligence solutions used in more than 5,000,000 investigations
  • Industries: Majority of business derived from federal, state, and local government; has also had offerings in the enterprise space for the past three years
  • Delivery models supported: On premises, private cloud, and public cloud
  • Product line:
    • Data acquisition: Cellebrite UFED, Cellebrite Physical Analyzer, Cellebrite Premium, Cellebrite Premium ES, Cellebrite OSINT, Cellebrite Frontliner, Cellebrite Digital Collector, Cellebrite Reader, Cellebrite Responder, and Cellebrite Seeker
    • Data analysis: Cellebrite Pathfinder, Cellebrite Inspector, Cellebrite Crypto Tracer, Cellebrite EndPoint Inspector, and Cellebrite OSINT
    • Data Management: Cellebrite Guardian and Cellebrite Commander
  • Key partnerships: Axon, AWS, Chainalysis, CipherTrace, and iNPUT-ACE

Strengths

Cellebrite’s investment in R&D is a sizable component of the company’s total revenue; customer references confirmed the value that this brings to its product suite. According to one customer, “research and development keeps them at the forefront of technological development and therefore offers cutting-edge solutions.” The user interface feels like best-in-class, fresh, next-generation technology; it is intuitive and easy to use, yet also both thorough and speedy. Customer references noted that the scope of the devices supported is unmatched by its competitors. Further, customers feel that Cellebrite singularly provides most of what they need across the spectrum of digital and criminal investigations, whereas other providers partner to achieve similar breadth and that this can feel less “seamless.” Cellebrite understands where workflow automation is the most helpful and/or necessary. Its Guardian solution was developed to manage the full spectrum of digital-first workflows for personnel, something the industry had struggled to address. Cellebrite’s workflow automation efforts are trying to shift the reporting burden so that personnel can focus on analysis and insights rather than compliance (both of which are extremely time intensive). Strategically, Cellebrite is focused on cloud delivery models to buoy flexibility and agility in data processing and AI for workflow automation, specifically in image processing. While this is obviously a focus for all of the vendors analyzed in this study, Cellebrite has some considerable IP in visual analytics. Last, Cellebrite’s large customer base means that the company is able to quickly fix bugs and add new phone releases; customer interviews stressed that customers felt listened to with regard to prioritizing R&D efforts (indeed some stated that they were able to work directly with the R&D team), fixes, and added features. Customers perceive Cellebrite as being more expensive, particularly with its Premium solutions. That said, Premium is also perceived to be one of the most comprehensive products in market.

Cellebrite’s focus on cybercrime and cryptocrime and complicated and emerging crime platforms have led it to partner with a blockchain and cyberanalytics firm, Chainalysis. This is a smart, forward-looking partnership that blends two distinct but adjacent technological capabilities — digital intelligence platforms and blockchain analysis.

Challenges

Customer interviews spoke of a lack of common standards, which, in conjunction with proprietary file formats, means that agencies are having to process using one tool and view in another. Agencies felt that there could be better cross-product integration.

Cellebrite’s legacy is in the mobile forensics world, and the company was so successful in that space that it struggled to gain recognition with other digital artifacts. It is important that agencies understand the company’s broader solution capabilities — hence the need to distance itself from mobile capabilities to focus more broadly on digital intelligence.

Last, being a publicly traded company creates different financial realities for Cellebrite, and the company will need to work diligently to maintain its commitment to the public safety mission.

Consider Cellebrite When

Consider Cellebrite when your agency is a high-volume, large, or well-funded organization, or a multitool environment needing specific capabilities, or when the agency needs multiple tools to confirm findings. Consider Cellebrite when you’re looking for a vendor that understands the nuanced ways in which criminal activity is morphing toward more stealth and encrypted platforms. Last, consider Cellebrite when cutting-edge R&D paired with a focus on end-to-end workflow innovation is of critical importance to your agency’s investigative needs.

APPENDIX

Reading an IDC MarketScape Graph

For the purposes of this analysis, IDC divided potential key measures for success into two primary categories: capabilities and strategies.

Positioning on the y-axis reflects the vendor’s current capabilities and menu of services and how well aligned the vendor is to customer needs. The capabilities category focuses on the capabilities of the company and product today, here and now. Under this category, IDC analysts will look at how well a vendor is building/delivering capabilities that enable it to execute its chosen strategy in the market.

Positioning on the x-axis, or strategies axis, indicates how well the vendor’s future strategy aligns with what customers will require in three to five years. The strategies category focuses on high-level decisions and underlying assumptions about offerings, customer segments, and business and go-to- market plans for the next three to five years.

The size of the individual vendor markers in the IDC MarketScape represents the market share of each individual vendor within the specific market segment being assessed.

IDC MarketScape Methodology

IDC MarketScape criteria selection, weightings, and vendor scores represent well-researched IDC judgment about the market and specific vendors. IDC analysts tailor the range of standard characteristics by which vendors are measured through structured discussions, surveys, and interviews with market leaders, participants, and end users. Market weightings are based on user interviews, buyer surveys, and the input of IDC experts in each market. IDC analysts base individual vendor scores, and ultimately vendor positions on the IDC MarketScape, on detailed surveys and interviews with the vendors, publicly available information, and end-user experiences in an effort to provide an accurate and consistent assessment of each vendor’s characteristics, behavior, and capability.

Market Definition

Digital forensics is a division of forensic science encompassing the recovery, investigation, validation, and analysis of evidence found in digital devices such as laptops or smartphones and on digital databases, networks, and platforms including social media platforms and cloud-hosted data repositories. Digital forensics can occur in multiple locations (on scene, in the field, at a special- purpose location, and in the lab). Digital evidence can be forensically triaged, with some analysis occurring on scene, with a more comprehensive analysis following in the lab. Digital forensics solutions help investigators collect, analyze, and preserve digital evidence.

LEARN MORE

Related Research

  • The Biggest Investigation in U.S. History: The January 6, 2021, Capitol Riot (IDC #US47903421, June 2021)
  • Increasing Interest in Surveillance Regulation Requires Vendor Involvement (IDC #lcUS47701621, May 2021)
  • How Can Data-Driven Policing Transform Operations? (IDC #US47583421, April 2021)
  • IDC Market Glance: Data-Driven Policing, 1Q21 (IDC #US45994621, February 2021)
  • IDC MarketScape: Worldwide Digital Evidence Management Solutions for Law Enforcement 2020 Vendor Assessment (IDC #US44848219, November 2020)

Synopsis

This IDC study provides an assessment of vendors offering global, end-to-end digital forensics capabilities in government and public safety. Law enforcement agencies today struggle with managing data and information coming from a large number of devices and an almost limitless number of heterogenous data sources. Very large data sets coming from call detail records, mobile phones, and laptops, as well as telecom, cloud, and internet service providers, complicate this further. Outpacing traditional resources, workflow, and processes, agencies are looking for efficient solutions that transform time-intensive workflows.

“Digital forensics solution providers are pivotal to the modernization of criminal investigations. They provide federal, state, and local law enforcement agencies with the tools and processes to meet their mission, an increasing challenge given the data deluge agencies are currently addressing,” said Alison Brooks, research vice president, Worldwide Public Safety, IDC.

Share this post