Oxygen Forensic Sui...
 
Notifications
Clear all

Oxygen Forensic Suite 2

25 Posts
9 Users
0 Reactions
3,042 Views
(@daver)
Active Member
Joined: 16 years ago
Posts: 11
 

Has anyone come across a problem with Oxygen Forensic Suite2 regarding its failure to extract images and life blog details from mobiles?

I have been having constant problems with a Nokia N95 8GB phone in that on two occassions Oxygen has recovered the images and has allowed the life blog to locate the positions of the images and messages etc but on many other occassions it has not allowed either the images to be extracted or the life blog to run.
Images are greyed out and life blog does not exist.
The same problems occur less frequently on other phones i.e the images are all greyed out. Any ideas? I have 16GB of drive space left and I'm running XP Pro SP3 and 512 RAM.


   
ReplyQuote
(@oxygen_software)
Trusted Member
Joined: 17 years ago
Posts: 53
 

Has anyone come across a problem with Oxygen Forensic Suite2 regarding its failure to extract images and life blog details from mobiles?

I have been having constant problems with a Nokia N95 8GB phone in that on two occassions Oxygen has recovered the images and has allowed the life blog to locate the positions of the images and messages etc but on many other occassions it has not allowed either the images to be extracted or the life blog to run.
Images are greyed out and life blog does not exist.
The same problems occur less frequently on other phones i.e the images are all greyed out. Any ideas? I have 16GB of drive space left and I'm running XP Pro SP3 and 512 RAM.

Dave, I'm sure your issue is related to a hardware. We sent you problem determination instructions several times, but still have no feedback from you. If you haven't got them yet, here they are

=============================
We see the several possible reasons of the problem
1. Incorrect or broken phone database (e.g. caused by interrupted installation).
2. Hardware problems with USB connection (for example we highly do not recommend to connect phones via USB hubs, since they might not provide the device with sufficient power).
3. There might be a locked database in the device itself (it happens rarely, but anyway it could be a reason).

So to sum it up what we would ask the customer to do to eliminate all the reasons described above
1. Keep the current OxyForensic.key license file in a safe place (just to avoid the license resending).
2. Uninstall Oxygen Forensic Suite 2 completely and manually remove the phone database files (stored in \Documents and settings\<UserName>\Application Data\OxyForensic\Phones directory).
3. Reinstall Oxygen Forensic Suite 2 and put the OxyForensic.key license file into the same directory.
4. Install the latest device drivers (e.g. for N95 8GB) you always can find the latest driver at http//europe.nokia.com/get-support-and-software/download-software/cable-drivers/driver-for-nokia-dke-2-dku-2-ca-42-ca-53-ca-70-ca-101
5. Check that you have one free USB 2.0 port in your PC (not in a hub).
6. Turn the phone off and then on (if possible). This operation will drop the device database locking if there was any.
7. Connect the device to the PC with appropriate USB cable and wait until the drivers installation will be finalized.
8. Check that the system drive has at least 10Gb free space (to examine N95 8GB device).
9. Run OxyForensic.exe with a "-log" parameter (without quotes) to log all communication errors if there will be any.
10. Run the usual connection and extraction process.
11. If the extraction is failed again, please send us a log file (named "Oxy3Log.dat"). It's stored in the same directory where Oxygen Forensic Suite 2 installed. Having this file we can determine the problem with more than 80% precision.
==============================

I will appreciate if you have time to perform the steps above and send us the log file.


   
ReplyQuote
(@daver)
Active Member
Joined: 16 years ago
Posts: 11
 

Hi. i did as you requested with no success until I uninstalled all previous mobile drivers from my hard drive. Since then I have had success in retrieving data from the Nokia N95 (which was causing the most problems) but only after 2 or 3 attempts at retrieval.
What I have now is the problem of the geo position in version 2.3 whereby either it declares a fault with obtaining the geo positioning or else in displays completely the wrong coordinates.
An image that I know was taken in West Wales is shown to be taken in Birmingham and an sms sent from Abu Dhabi in the UAE declares itself to have been sent from Cardiff, UK.
Yes, I know that you have added a clause stating that the geo positioning may not always work, but I have had this problem at all times of the day over the last 5 or 6 days since I downloaded the update.
Had I been working on a real case I would either have failed to complete the work or sent the client a report saying that various sms messages were sent and several images were taken in completely different position to the actual place of creation.


   
ReplyQuote
(@daver)
Active Member
Joined: 16 years ago
Posts: 11
 

One last point. I have sent you several Oxy3log.dat files and have had little feedback from you other than to say that the problem is with my hardware, so on your advice I have installed Oxygen on 3 seperate computers, all running Windows but with varying softwares, drivers and security applications installed. They produced no differing reports to each other.


   
ReplyQuote
(@oxygen_software)
Trusted Member
Joined: 17 years ago
Posts: 53
 

Hi Dave,

1. The 1st problem is our communication. I wrote to you several messages (directly and replying to Andy), but I never received any feedback from you (except this forum). For some reason you prefer to address your replies to my colleagues (Tanya or Max). Besides that Tanya just reported to me that she wrote you several times during last 2 weeks and got no replies at all.
In a result nobody (including you, btw) has full and structured information about the issues you have. Of course it's impossible for us to provide you with qualified support in this situation.
Therefore starting from this moment I would ask you to communicate only with me (at adm@oxygensoftware.com), so we could summarize and determine the reasons of this very unusual OFS2 behaviour.

2. Driver problems. Replying to your first message (that was forwarded to me by Andy) I specified the two most likely reasons
- Hardware malfunction;
- Problems with drivers.
These problems are most common (especially the 2nd one) and behind our responsibility. The only thing we can do is recommend to always use the latest drivers from cell phone manufacturers instead of driver packs supplied by other forensic software (e.g. XRY or Paraben).

3. Log files. Up to this moment we received only one log file (for Samsung) from you. Unfortunately it wasn't give us much information, therefore we are making several additional tests with Samsungs right now. Since we haven't stumbled on any reading errors yet (your log file indicates that there was a file read error), we probably will ask you about some additional details.
BTW the correct drivers, like with Nokia N95, may be the clue in this case too.

4. Geo positioning. When we have GPS coordinates (for example taken from camera snapshots), we use them directly to display the map.
When we only have Cell coordinates (MCC, MNC, LAC and CellID),
we use special Google databases (which have nothing common with Google Maps, btw) to recalculate Cell coordinates into GPS ones. Filling and updating the database of Cell-to-GPS coordinates correspondence is a really huge (and continuous) task. It can be done for example by Google or Yahoo but not by our small company -)
So we completely rely on Google in this question. I just checked my LifeBlog with FS v2.3 - it really displays wrong places on the map. Some of them shifted for hundreds of meters, some - for kilometers. We'll double-check if this is our bug or incorrect information received from Google servers. I'll let you know about the results.

By the way, sometimes these databases are not accessible (it seems they limit a number of queries from the same IP during the specified time). In this case you'll see the message "Place not found or no response from server".
But you always should remember that the map position received from Cell coordinates is approximate.

With best regards, Oleg Fedorov.


   
ReplyQuote
(@oxygen_software)
Trusted Member
Joined: 17 years ago
Posts: 53
 

Small addition about Geo positioning in LifeBlog I tried this feature again 2 minutes ago and noticed that now it shows correct places on the map. So it seems there was an update to Google database.


   
ReplyQuote
(@daver)
Active Member
Joined: 16 years ago
Posts: 11
 

I beg to disagree with you regarding 'Besides that Tanya just reported to me that she wrote you several times during last 2 weeks and got no replies at all'.
I have emailed Tanya on many occasions -
tpankova@opm-2.com on 10th, 11th (twice), 12th, 13th and 14th (several times), 17th and the 20th August.
support@oxygensoftware.com on 11th, 12th, 13th,
I sent emails to Tanya, not anyone else because this is what in seemed I was asked to do in an email on 14th August –
“Hello Dave!
Thank you for contacting us.

Could you please forward this report directly to me? Then we will analyze it more quickly.

If you have any further questions, do not hesitate to contact us.

Best regards, Tanya Pankova”

If you wish, I will send you copies of all the communication I have had with Tanya and/or your support team, a total of 50 emails in 2 weeks with my last email being sent on 20th August.

My first few emails were with Data Duplication (from the 7th up to 10th of August) as it was from them that I bought the software. It was they who advised me to contact you when I received an email from Tanya on the 10th.
You said, "BTW the correct drivers, like with Nokia N95, may be the clue in this case too."
I downloaded all drivers from your web site which proved to be older than those already installed.
I hope we do resolve these problems as, when it works, the software provides useful data and is easy to work with. I will wait and see if these issues are sorted.


   
ReplyQuote
(@oxygen_software)
Trusted Member
Joined: 17 years ago
Posts: 53
 

Hi Dave,

Tanya sent several requests to you about the issues you have, but hasn't received any feedback since 17th August (2 weeks exactly).
Anyway, let's communicate directly starting from this point. But not in this forum please. I beleive our conversation is not so interesting for other readers )
Or let's go to PM.

Could you please send me all the messages you wrote to us after 17th August?

About drivers - we certainly try to update our site with the most recent drivers, but as you understand we cannot guarantee that we'll always have the newest (or newer wink ) drivers from phone manufacturers. Actually we never issued this challenge. We put drivers at our site just to help our customers in finding them.


   
ReplyQuote
(@bravo1800)
Active Member
Joined: 17 years ago
Posts: 11
 

I use Oxygen Forensic as a secondary tool. Its very useful especially on Symbian handsets. They also have support for the Iphone and support for the Android handset is coming soon. The GUI takes a while getting used to but it is a great tool to have in your forensic tool box…


   
ReplyQuote
(@daver)
Active Member
Joined: 16 years ago
Posts: 11
 

My last email was on 17 August because I received an email from you which contained the message, "Your Bug Reports are being analyzed and the work has not been finished yet. I will wrire you a detailed e-mail as soon as I have some information on them."
I decided then to run periodic tests on the geo positioning status which I have emailed you.
The latest drivers I obtained from you when I downloaded version 2.3.
Please, don't misunderstand me, it's not that I don't like the Oxygen software package, I do. It's easy to work with, covers a wide range of mobiles and produces professional reporting in a PDF format. I just wish that the geo functioning worked accurately because as it is it cannot be used as evidence of location in a case.
Not being able to produce images on one phone type (Samsung SGH-D500) is annoying but this can be overcome using other software I have. Its just easier if everything is provided in the one report rather than two seperate ones.

Thanks bravo1800 for your thoughts on the application. Does geo positioning work in your part of the UK? Maybe its the servers that I connect through that is causing so many problems.


   
ReplyQuote
Page 2 / 3
Share: