What Arsenal Recon does

Arsenal Recon (legal entity: Arsenal Consulting, Inc.) is a privately held digital forensics software and consulting firm founded in 2010 and headquartered on the Chelsea, Massachusetts waterfront near Boston Logan International Airport. The company develops and sells specialized Windows-system forensics tools and operates a boutique consultancy performing casework for law firms, corporations, and government agencies. Its core products — Arsenal Image Mounter, Hibernation Recon, and Registry Recon — exploit technical gaps in competing disk-mounting and Registry-parsing tools; Arsenal Image Mounter is the only open source solution to mount disk images as complete (physical/real) disks in Windows via a proprietary Storport miniport driver, enabling virtual-machine launching with Windows authentication bypass, DPAPI bypass, S Mode bypass, and BitLocker handling. Hibernation Recon reconstructs active memory from Windows XP through 11 hibernation files and extracts multiple types and levels of hibernation slack space; Registry Recon rebuilds historical Registry states and recovers deleted Registry data from unallocated space and Volume Shadow Copies. Supporting CLI tools include HiveRecon, HbinRecon, ODC Recon, Gmail URL Decoder, and AIM Remote Agent.

Arsenal Recon operates a hybrid software-plus-consulting model. Software revenue is generated by annual and multi-year subscriptions — $907 (1-year), $2,448 (3-year, ~9% discount), and $3,840 (5-year, ~14% discount) per license — with each subscription covering the entire toolset including future releases during the active period. A free tier (Arsenal Image Mounter Free Mode, Hibernation Recon Free Mode) is available for download to drive adoption, alongside a free Arsenal Educational Program providing licenses to professors, students, law enforcement, and military training programs. Distribution is direct-to-customer via the company website; enterprise evaluations and custom licensing are handled through email sales. The marketing mix emphasizes a technical Insights blog, an email newsletter, industry conference participation, open-source community presence on GitHub, and product demonstration video content.

The customer base spans US and international law enforcement (US Department of Defense, US Army CID, US Department of Labor, Danish National Police NC3, Kingston Police, Metropolitan Police Cybercrime Unit, Oro Valley Police Department, Federal Law Enforcement Canada, UK National Trading Standards eCrime Team), education (SANS Institute, Bunker Hill Community College), and forensic services firms (Level Legal, Forentech SAS, Reality NET System Solutions, DTI Forensic West). Arsenal is led by founder Mark Spencer as President, with casework experience testified in US v. Tsarnaev (Boston Marathon bombing) and US v. Mehanna. The firm holds 1–10 employees, is privately held with no disclosed external investors, and operates as a global user base across multiple continents with active product development continuing into late 2025.

Name

Arsenal Recon

Legal name

Arsenal Consulting, Inc.

Website

https://arsenalrecon.com/

Company type

Private

Founded year

2010

Operating status

Operating

Headcount range

1–10 employees

Short description

Arsenal Recon (Arsenal Consulting, Inc.) is a privately held digital forensics software and consulting firm, founded 2010 and headquartered in Chelsea, Massachusetts, that builds specialized Windows-system forensics tools (Arsenal Image Mounter, Hibernation Recon, Registry Recon) for law enforcement, military, government, educational, and forensic-services customers worldwide under a multi-tier subscription model.

Ownership category

akta.pro rank

Product category

Digital Forensics Software

akta.pro primary industry

Backup, Archiving & Ransomware-Resilient Data Protection (HDADAFAL)

Keywords

• Digital forensics software
• Disk image mounting
• Windows registry analysis
• Hibernation file forensics
• Memory forensics tools

Headquarters

HQ city

Chelsea

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Software Subscription: Annual/multi-year subscription model providing access to all Arsenal tools. Subscription includes all current tools and future releases during the subscription period. No maintenance fees during active subscription. Pricing tiers based on subscription length with increasing discounts for longer commitments.

Pricing tiers

Go-to-market motion2 records

Distribution channels2 records

Marketing channels5 records

Core offering

Arsenal Recon (d/b/a Arsenal Consulting, Inc.) develops and sells specialized digital forensics software for Windows-based electronic-evidence extraction. Its flagship offerings include Arsenal Image Mounter for mounting forensic disk images and bypassing Windows authentication, Hibernation Recon for reconstructing in-memory artifacts from Windows hibernation files, and Registry Recon for rebuilding historical Windows Registry activity. The portfolio is rounded out by command-line utilities (HiveRecon, HbinRecon, ODC Recon, AIM Remote Agent), the Gmail URL Decoder Python tool, and ancillary consulting services.

Product overview

Arsenal Recon offers a suite of specialized digital forensics tools focused on deep artifact extraction from Windows systems. The core products include Arsenal Image Mounter (disk imaging and VM launching with authentication bypasses), Hibernation Recon (hibernation file memory reconstruction and slack space extraction), and Registry Recon (historical Windows Registry rebuilding and analysis). Supporting CLI tools include HiveRecon and HbinRecon for Registry hive extraction and parsing, ODC Recon for Office Document Cache forensics, and Gmail URL Decoder for email artifact extraction. All tools are delivered via subscription licensing with the same license covering the full Arsenal toolset.

Differentiator

Problem solved

Functional benefit

Products and services

• Arsenal Image Mounter (AIM) A Windows-based forensic image-mounting utility that uses Arsenal Recon's proprietary Storport miniport driver to mount disk images, launch virtual machines from images, and bypass Windows authentication for forensic access. Marketed as fast and easy to use with full cross-toolchain compatibility. Audience: digital forensic examiners, incident responders, and forensic investigators.
• Hibernation Recon Forensic tool that reconstructs memory contents and extracts artifacts from Windows hibernation files using proprietary Hibernation File Decompression, recovering slack and unallocated space from hibernation. Audience: forensic examiners handling hibernated Windows machines that cannot be analyzed live.
• Registry Recon A Windows Registry forensic tool that reconstructs historical user and system activity from Registry hive data, supporting deep historical artifact analysis beyond live-system state. Audience: forensic examiners, incident responders, and investigators needing registry-history analysis.
• HiveRecon Command-line utility for extracting and carving Windows Registry hive files from raw forensic sources such as memory dumps and unallocated disk space. Audience: forensic practitioners running scripted or remote triage workflows.
• HbinRecon Command-line parser for Windows Registry hive bin files, used in forensic workflows where Registry hive structure must be analyzed outside the GUI suite. Audience: forensic practitioners and tool integrators.
• ODC Recon Forensic tool for analyzing Office Document Cache (ODC) files to recover prior Office document activity, opened files, and metadata from Windows systems. Audience: forensic examiners and investigators analyzing Microsoft Office user activity.
• AIM Remote Agent Command-line remote agent used for distributed forensic triage and remote evidence collection via the Arsenal Image Mounter ecosystem. Audience: remote incident-response teams and distributed forensic investigations.
• Gmail URL Decoder A Python utility for decoding Gmail URLs encountered in forensic artifacts, supporting examiner workflows where Gmail activity must be traced through encoded URLs. Audience: forensic examiners and investigators.

Quantifiable outcome

• VSC launched into VMs enables comparison of document versions over time for jury-friendly presentations
• +1 more outcomes

Named customers15 records

Segments5 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature7 records

Scale indicators1 record

Recent moves6 records

Expansion highlights5 records

Direct peers

• Exterro: Exterro owns the FTK (Forensic Toolkit) product line via its acquisition of AccessData, providing a comprehensive digital forensics platform used by law enforcement and corporate investigators. It is a direct competitor in the same Windows-focused forensics market as Arsenal Recon.
• Magnet Forensics: Magnet Forensics is a leading digital forensics software vendor serving law enforcement, government, and enterprises with products such as Magnet AXIOM and Magnet GrayKey. It is a direct competitor to Arsenal Recon in the Windows/computer forensics space and targets the same customer segments (DoD, police forces, federal agencies).
• MSAB: MSAB (Micro Systemation) is a publicly traded Swedish company that provides mobile and digital forensics software (XRY, XAMN) to law enforcement and government agencies. It serves the same customer segments as Arsenal Recon and competes for investigative-tooling budgets.
• Cellebrite: Cellebrite is a public company (CLBT) providing digital intelligence and forensics software, historically strong in mobile but expanding into computer forensics. It serves the same law enforcement, military, and enterprise customers as Arsenal Recon and competes for investigative-tooling budget.
• Oxygen Forensics: Oxygen Forensics provides a suite of digital forensics tools (Oxygen Forensic Detective) covering mobile, computer, and cloud forensics. It directly competes with Arsenal Recon in the law enforcement and enterprise forensic investigations market, though with a broader multi-platform product set.
• X-Ways Software: X-Ways Forensics is a long-established Windows-focused computer forensics tool widely used by law enforcement and forensic practitioners. It competes head-to-head with Arsenal Image Mounter, Registry Recon, and Hibernation Recon for the same investigative workflows.

Emerging players

• Belkasoft: Belkasoft sells Belkasoft Evidence Center, a digital forensics product used by law enforcement, corporate, and academic investigators for computer, mobile, and cloud artifact extraction. It competes with Arsenal Recon's suite on Windows artifact recovery and registry analysis.
• ADF Solutions: ADF Solutions provides digital forensics and triage tools (Digital Evidence Investigator, Triage-Investigator) used by law enforcement, military, and enterprise investigators for rapid on-scene and lab-based examinations. It is a smaller, niche competitor with overlapping use cases to Arsenal's computer forensics products.
• Autopsy: Autopsy is an open source digital forensics platform built on The Sleuth Kit, maintained by Basis Technology, and widely used by law enforcement, military, and academic institutions. It overlaps with Arsenal Recon's Windows forensics focus and represents a free/lower-cost alternative in similar investigations.

Broad incumbents

• OpenText (EnCase): OpenText acquired Guidance Software and the EnCase digital forensics product line, which is one of the most established computer forensics platforms used by law enforcement and enterprises. EnCase competes directly with Arsenal's Arsenal Image Mounter, Registry Recon, and Hibernation Recon for Windows forensic investigations.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• GitHubgithub.com/ArsenalRecon
• Xx.com/ArsenalRecon
• Facebookfacebook.com/ArsenalRecon

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Arsenal Recon