SHARE THIS POST
Recent Posts
FOLLOW IAASTEAM
IAASTEAM POST INFORMATION
Oxygen Forensic Detective v.15.3.1 The Mobile investigative Software 2023 Update
Oxygen Forensics – Mobile forensic software for mobile devices, cloud services, wearables, computer artifacts
Oxygen Forensics: Digital Forensic Solutions
Oxygen Forensic® Detective is a powerful digital forensic tool that can be used to extract, decode, and analyze data from a wide range of devices, including mobile phones, tablets, computers, and cloud storage. With its comprehensive features and easy-to-use interface, Oxygen Forensic® Detective is a valuable tool for law enforcement, corporate investigators, and security professionals.
Here are some of the key features of Oxygen Forensic® Detective:
- Extract data from over 19,500 devices, including Android, iOS, BlackBerry, Windows Phone, and Symbian.
- Import backups and images from iTunes, Android, JTAG, and Chip-Off.
- Parse data from over 430 unique apps and 7,320+ total app versions.
- Recover a wide range of deleted data, including photos, videos, text messages, call logs, and browser history.
- Perform data analysis, including social graph analysis, timeline analysis, and key evidence analysis.
- Search data by criteria, including keywords, dates, and locations.
- Recover passwords to encrypted backups and images.
- Bypass screen lock on popular Android OS devices.
- Acquire locations history and media files from drones.
- Extract data from cloud sources, including iCloud, Google, Microsoft, and Dropbox.
- Import and analyze call data records.
- Visualize route and common location of several users.
- Export data to popular file formats, such as PDF, RTF, XLS, SML, etc.
Oxygen Forensic® Detective is a powerful and versatile tool that can be used to investigate a wide range of cases. It is a valuable asset for law enforcement, corporate investigators, and security professionals.
Here are some of the benefits of using Oxygen Forensic® Detective:
- Comprehensive coverage: Oxygen Forensic® Detective supports a wide range of devices and data sources, making it a valuable tool for investigating a wide range of cases.
- Easy to use: Oxygen Forensic® Detective has a user-friendly interface that makes it easy to use even for those with limited forensic experience.
- Powerful analysis tools: Oxygen Forensic® Detective includes a wide range of analysis tools that can be used to identify and extract evidence from digital devices.
- Up-to-date: Oxygen Forensic® Detective is constantly updated with new features and support for new devices and data sources.
If you are looking for a powerful and versatile digital forensic tool, Oxygen Forensic® Detective is a great option. It is a valuable asset for law enforcement, corporate investigators, and security professionals.
Oxygen Forensic® Detective v.15.3.1
- Analysis of iFlight drone logs
- Huawei Health cloud extraction
- Import and parsing of MD-Next extractions
- Analysis of Windows RAM images
- Extraction of Google Chrome browser via Android Agent
For a full list of updates, refer to the “What’s New” file in the Oxygen Forensic® Detective “Options” menu.
- Brute force for Samsung, Motorola, and Huawei devices based on MTK chipsets
- Enhanced support for Huawei devices based on Qualcomm chipsets
- LastPass cloud extraction
- Import of Tinder archives
- Support for modified WhatsApp versions
For a full list of updates, refer to the “What’s New” file in the Oxygen Forensic® Detective “Options” menu.
Mobile Forensic Updates
Bruteforce for Samsung MTK devices
Users can now extract hardware keys and decrypt data from Samsung devices based on the Mediatek Helio G80 chipset and having TEE TEEGRIS. Our support covers devices running Android OS 10 and higher. Supported models include Samsung Galaxy A22 4G, Samsung Galaxy A32 4G, Samsung Galaxy F22, Samsung Galaxy M22, Samsung Galaxy M32, and others.
Bruteforce for Motorola MTK devices
Now you can extract hardware keys and decrypt physical dumps of Motorola devices based on the MT6765 chipset, having File-Based Encryption and running Android OS 10-12. Our support covers Motorola Moto E7, Motorola Moto E7 Power, Motorola Moto G Pure, Motorola Moto E6s, and Motorola Moto E6 Plus.
Bruteforce for Huawei MTK devices
We’ve also added support for Huawei devices based on the MT6765 chipset, running Android OS 10, and having File-Based Encryption. Our support covers Honor 9A, Honor 9S, Huawei Y5p, and Huawei Y6p.
Enhanced support for Huawei Qualcomm devices
Extraction and decryption of Huawei devices based on the Qualcomm SDM450 chipset has been added. Our support covers Huawei devices running Android OS 10 or higher. Supported models include Huawei Enjoy 9, Huawei Y7 2019, Huawei Y7 Pro 2019, and Huawei Y7 Prime 2019.
Extraction of Firefox artifacts via Android Agent
Now users can extract even more Firefox artifacts via Android Agent: collections, logins and passwords, saved cards, and addresses. While collecting saved credentials and cards, the Android Agent will require that a user password be manually entered to allow the process to start.
Extraction of Telegram groups via Android Agent
Recently, Telegram has introduced the ability to create group chats with enabled topics. With this release this type of chats can be collected via Android Agent from any supported Android devices. Selective topic extraction is available.
Extraction of Google Chrome artifacts via Android Agent
Oxygen Forensic® Detective v.15.4 enables extraction of Google Chrome artifacts via Android Agent from any supported unlocked Android device. Android Agent can be installed on a device via USB, WiFi, or OTG device. Once the acquisition process is finished, the Android Agent extraction can be imported into Oxygen Forensic® Detective for review and analysis. Evidence sets will include account details, saved logins and passwords, credit cards, history, opened tabs, bookmarks, and downloads.
iOS Agent updates
In the recent versions of Oxygen Forensic® Detective, we’ve added two enhancements for iOS Agent method:
- In the minor update of Oxygen Forensic® Detective v.15.3.1 we’ve added the ability to extract the full file system via iOS Agent from iOS devices running versions 15.0 – 15.7.1 and 16.0 – 16.1.2.
- Oxygen Forensic® Detective v.15.4 now allows selecting an exploit if several are available for the particular iOS device model.
App support
In Oxygen Forensic® Detective v.15.4, we’ve added support for the following new apps:
- iScanner (Apple iOS, Android)
- Notion (Apple)
- Session (Android)
- Telegram Web (Android)
The total number of supported app versions now exceeds 35,300.
Import Updates
Import of iFlight drone logs
We’ve enhanced our drone support by adding the ability to import and analyze iFlight drone logs that can be found on memory cards of remote controls. Evidence sets will include the following parameters: flight date and time, geo coordinates, battery level, altitude, and ground speed. The flight can be visualized on the built-in map in our software.
Import of iVe backups of vehicles
Now you can import and parse vehicle evidence from Berla iVe backups. To do this, click the “Third-party extractions” option in the Home screen and follow the instructions. The evidence set may include detailed vehicle information, connected mobile devices, calls, vehicle speed info, search and location history, files from the vehicle multimedia system, and other available artifacts.
Import of MD-Next extractions
Oxygen Forensic® Detective v.15.4 can now ingest and parse MD-Next physical extractions of Android devices. Evidence sets will include all data, including apps.
Cloud Forensic Updates
Huawei Health extraction
We are enhancing our support for cloud fitness apps, and with this release, we are incorporating extraction of Huawei Health data via login and password, token, phone number, or QR code. Extracted evidence will include all health data: workouts, medical data, routes, and more.
Telegram updates
We’ve significantly improved support for the latest Telegram features. Now you can extract more data from Telegram cloud:
- recent actions of group chats that are available to the group admins
- group chats with enabled topics
- collectible usernames
We’ve also updated the ability to extract Telegram tokens from Apple iOS devices.
Computer Artifacts
Functionality updates
With the updated Oxygen Forensic® KeyScout, investigators can perform the following:
- extract data from drives and images with Logical Volume Manager partitions.
- analyze Windows RAM images in padded RAW and Crash Dump (DMP) formats while analyzing drives or drive images
- collect and filter files by size.
New and updated artifacts
A number of artifacts were introduced and updated in KeyScout. Users can collect the following new artifacts:
- a web version of WhatsApp from Chromium, Microsoft Edge, Brave, and Vivaldi browsers from Windows, macOS, and Linux
- a web version of Slack from Chromium, Brave, and Vivaldi browsers from Windows, macOS, and Linux
- a web version of Instagram from Chromium, Microsoft Edge, Brave, and Vivaldi browsers from Windows, macOS, and Linux
- AnyDesk data from Windows, macOS, and Linux
- Find My data from macOS
- the list of system user accounts and groups from macOS
- VPN connection settings from Windows
Updated artifact support includes:
- Amazon Photos from Windows and macOS
- the information about Bluetooth devices from macOS
iOS support updates
In Oxygen Forensic® Detective v.15.3 we’ve added two enhancements for iOS device support:
- We’ve added the ability to extract the full file system and keychain via iOS Agent from iOS devices running iOS versions 15.0 – 15.4.1. For these supported iOS versions, there is no need to authenticate an Apple ID account and obtain a certificate for signing iOS Agent.
- Users can now extract the full file system and keychain via checkm8 from Apple iOS devices based on the A10 chipset and running iOS 14 and 15 without disabling the screen lock.
App support
In Oxygen Forensic® Detective v.15.3 we’ve added support for the following new apps:
- BOTIM (Apple, Android)
- GB WhatsApp (Android)
- OB WhatsApp (Android)
- FM WhatsApp (Android)
- Microsoft Bing (Android)
- BeReal (Apple)
- Moj (Apple)
- Tiki (Apple)
The total number of supported app versions now exceeds 34,800.
Import Updates
Import of Tinder archives
In this release, users can import and parse evidence from Tinder archives. Click the Tinder archive option under the Downloaded accounts data on the Home software screen to import Tinder data. Evidence set will contain media files, messages, used apps, campaigns, purchases, Spotify artifacts, and other supported artifacts.
Learn more about Tinder archives.
Cloud Forensic Updates
LastPass data extraction
Oxygen Forensic® Detective v.15.3 allows cloud extraction from LastPass, one of the most popular password managers. Extraction is possible via login and password or token. Evidence set will include passwords, documents, notes, and bank card details.
Learn more about LastPass data extraction.
Other updates
Authorization and extraction algorithms for already supported cloud services was updated – Google Home, Google Chrome, Google My Activity, MiFit, Android Cloud Data, and Huawei.
Computer Artifacts
Functionality updates
A number of functional and interface updates to KeyScout were introduced:
- Added extended analysis of live RAM that now includes memory pages from pagefiles
- More detailed information about data search progress
- Redesigned and simplified the work with search profiles
Learn more about search profiles.
New and updated artifacts
With the updated Oxygen Forensic® KeyScout, users can collect the following new artifacts:
- Background Intelligent Transfer Service (BITS) on Windows
- Diagnostic data from Windows
- Information about running processes on macOS and Linux during live system extraction
- ARP cache on macOS and Linux during live system extraction
- Dock elements from macOS
- History of commands entered in the terminal on Linux
- History of app usage on Linux
- History of Vim usage on Linux
- Brave data from Windows, macOS, and Linux
Updated artifact support includes:
- Microsoft Teams data on Windows
- Microsoft Exchange Server data on Windows
- Viber data on Windows, macOS, and Linux
- Apple Messages data on macOS
