BlackLight quickly analyzes computer volumes and mobile devices. It sheds light on user actions and now even includes analysis of memory images. BlackLight allows for easy searching, filtering and otherwise sifting through large data sets. It can logically acquire Android and iPhone/iPad devices, runs on Windows and Mac OS X, and can analyze data from all four major platforms within one interface. It’s simply the best option available for smart, comprehensive analysis.

Add to Cart Request Trial
Request a Quote Renew
  Features    Latest Release    Device Compatibility    System Requirements    Pricing  


Actionable Intel

Easily Uncover User Actions

BlackLight’s Actionable Intel view allows examiners to view various data points that can be attributed to a user's actions. Traces of potentially important user activity from many disparate locations are organized for practical, efficient examination. Elements include:

  • Windows Registry artifacts - recently executed files and programs, link files, jumplists, Prefetch and Superfetch data
  • Device connection data for all devices previously connected to the system, including USB device connection dates/times and the associated user account
  • iOS device backups
  • Recent file downloads
  • Trash (for Mac OS X volumes) and Recycle Bin (for Windows volumes)
  • Current and deleted user account info


Analyze Windows Memory Files

  • Analyzes several types of memory files, including raw dumps, Hibernation files (Windows Vista to Windows 10), pagefile.sys, and crash dumps (full, from Windows Vista or 7)
  • Performs file carving and bulk extraction content searches (for numerous items such as URLs, addresses, phone numbers, etc.)
  • Features a Memory subview for analyzing processes, libraries, sockets, handles, and drivers
  • Processes memory files many times faster than traditional open-source forensic tools

File Filter View

Efficiently Sift Through Large Data Sets

BlackLight's signature File Filter view includes examiner-defined filter options to quickly pinpoint relevant data within large data sets. Filter criteria include:

  • File name, kind, size, or extension
  • Date created, modified, or accessed
  • Picture metadata attributes, including GPS coordinates and camera (iPhone/iPad device) type
  • Positive and negative hash set filtering

Examiners may apply any number of filters or inverse filters to quickly isolate important data from system files or base application files. BlackLight comes with several pre-set file filters, including those that filter by file type, file attribute, geolocation coordinates, and source device type.


Find the Picture and Video Evidence You Need

BlackLight's Media view has built-in support for all commonly used picture and video file types, and it includes several helpful and examiner-oriented analysis features, such as:

  • Built-in GPS Mapping:
    • All media files containing GPS data will be identified with a placemark badge
    • Examiners can view media geolocation data on a Mercator map (offline) or using Google Maps (online) directly from the built-in GPS view
  • Proprietary Skin Tone Analysis Algorithm:
    • Sort picture and video files by the skin tone percentage contained in the file
  • Video Frame Analysis:
    • BlackLight initially displays video files as 4x4 frame sequences, allowing examiners to quickly triage multiple video files in order to locate potential evidence


Recover Every Message from the Most Common Source

The Communication view in BlackLight allows examiners to see a full log of calls, voicemail, social media activity, and more. Most importantly, examiners can view messaging threads in list view or in their native format, with support for data from:

  • Text Services (SMS/MMS, iMessage)
  • Messaging Apps (Skype, Kik, TextPlus, TextFree, Tango)
  • Social Media (Facebook, Twitter, LinkedIn, Foursquare/Swarm)


Customize Your Report

BlackLight is designed to make reporting incredibly flexible. Examiners may export large data sets in an easily readable format, and can export reports in a variety of formats to enable easy information sharing with all interested third parties. With BlackLight's Report view, you can:

  • Easily tag evidence and include any and all relevant metadata in the examiner report
  • Export your report in your choice of formats, including .pdf, .html, .docx, and .txt
  • Export eDiscovery data to a generic Concordance load file that is compatible with all major review platforms
  • Mask (blur) sensitive data contained within examiner reports that may be shared with non-authorized third parties

Our latest release, BlackLight 2019 R1, includes:

  • Built-in Image Categorization using Image Analyzer
  • Smart Indexing - Initial Release
  • Logical Evidence Files (EnCase© .L01 format) export option
  • New Investigative Notes option
  • Add AFF4 evidence from MacQuisition 2019 R1 to support latest Apple systems with the T2 chip or APFS Fusion
  • Time Capsule and Time Machine improved support
  • Photo DNA and Project Vic updated support
  • Windows 10 and Apple Mojave system artifacts improvements
  • Added GoPRO LRV filetype support

Recent feature highlights from BlackLight 2018 R4, includes:

  • Apple’s latest picture and video formats (HEIC/HEVC) support
  • Tagging Improvements
  • iPhone XS, XR, and iPad Pro device support
  • Improved support for Android MMS on Samsung devices
  • Parsing “Recent Items” on macOS 10.13
  • Easier license management of BlackBag dongles
  • BlackLight is now exclusively a 64-bit application

Earlier in the 2018, BlackLight 2018 R3 was released which included:

  • Comprehensive Report options
  • APFS Snapshots
  • Streamlined support for all GrayKey image formats
  • iOS Hidden Photos
  • Enhanced Windows 10 Memory Support

Other BlackLight highlights from 2018 include full APFS support - when combined with MacQuisition 2018 R1, it is the world's first complete end-to-end acquisition, decryption, and analysis solution the latest Apple File System. In addition, it includes support for latest versions of the following mobile applications:

  • WeChat
  • Facebook Messenger
  • Line
  • WhatsApp

Feature highlights from 2017, include the following:

  • Export media to LACE, C4ALL, and Project VIC formats for further analysis
  • Support for EML formatted email files, included on the easy Communication view
  • Identify ‘Recent’ documents and applications from Mac OS 10.11 and 10.12
  • Latest phones and operating systems, including iPhone 8, iOS 11 and Android 8.0 (Oreo)
  • Ingest Mac sparse images directly into BlackLight
  • Full collections from iOS 11 including from iTunes Backups
  • Users are now prompted for passwords for iOS 11 Encrypted backups to complete the collection
  • Generate reports in CSV format to allow examiners to review data in external programs
  • Ability to export case data as XML for import into various analytic tools
  • New ‘Reset’ button when filtering the current view or searching to easily start a new filter or search of items, for example messages and media filters
  • Updated hash set support to include identifying ‘Known’ and ‘Trusted’ items from, for the latest Mac and Windows Operating Systems
  • BETA support for parsing ExFAT, ISO9660, EXT 2, EXT 3, EXT 4, UFS, and YAFFS2 file systems
  • Updated Parsing for FSevent Files
  • Windows 10 Fall Creators Update
  • EWMounter Additional Drive Support
  • Improved Volume Shadow Copy (VSC) Display

To learn about all the new features, improvements, and fixes view the release notes for BlackLight 2018 R2.


  • iPhone 3G and newer with iOS 4.0 to 12.1
  • All iPads with iOS 4.0 to 12.1
  • iPod Touch 2G and newer with iOS 4.0 to 12.1


  • Devices running Android 4.0.4 to 8.1
  • Devices manufactured by: Samsung, Motorola, HTC, LG, Google Nexus
    • Note*: Additional devices running Android 4.0 or later may function properly if the appropriate USB driver for Windows OS is installed

Additional Information

Operating System Specification Mac OS X El Capitan (10.11.4) or higher / Windows 7 or higher
Compatibility BlackLight runs on Intel® based systems only
BlackLight requires the following additional software:
• iTunes 12.6 or higher
• QuickTime 7.6.9 or higher for Mac, and Windows Media Player 12 for Windows
Minimum Requirements • Mac OS X El Capitan (10.11.4) or newer
• Windows 7 or newer
• Windows Server 2016 or newer
• 2.7 GHz Intel Core i7
• 16 GB DDR3
• 1024 x 768 or higher screen resolution
• 5GB of Disk Space (installation only) and 25 GB (Temp Space)
Optimum Requirements • macOS Sierra (10.12.5) or Windows 10
• 3.1 GHz 6-Core Intel Xeon E5 or better
• 32 GB DDR3 or higher
• 1680 x 1050 or higher screen resolution
• 5GB of Disk Space (installation only) and 25 GB (Temp Space)

*Note: For Windows systems, BlackLight uses whatever the default app may be for playing media files. Windows Media Player 12 is recommended. If Windows examiners do not have QuickTime installed and they wish to play certain file types such as .AMR files (voicemail, etc.) they will need to install some non-default codecs, following the instructions found here:

Each new BlackLight® license purchase includes one-year Software Maintenance Support (SMS). Customers current on SMS receive all BlackLight software updates and technical support. Customers may purchase an extension of SMS each year to continue receiving SMS benefits. Customers will still be able to use the BlackLight updates released during their support period when their license expires.