6 Month Checkup At Oxygen Forensics

Hard to believe that half the year is already up! Not only has our company been growing month after month but so has our software! Let’s take a look at the fantastic innovations brought to you in Oxygen Forensic® Detective these last six months.Cloud Forensics

This year alone we have added support for 9 new cloud services. Our supported services exceeds any other forensic tool on the market; increasing the total amount of supported cloud services to 69!

Of note, we enhanced our support for Apple iCloud services by offering the ability to acquire Apple Health and Apple Maps data as well as all the logins, passwords, tokens and other artifacts from the iCloud Keychain. Apple Health and keychain can be also directly acquired from Apple iOS devices via logical extraction while Apple Maps can be retrieved only from jailbroken Apple iOS devices and GrayKey images. Apple Maps extraction from iCloud is a fantastic alternative to direct device acquisition.

We have also added the worlds only current ability to extract account information, contacts, chats and calls from the secure Wickr Me Messenger via password or token that can be extracted by our software both in mobile devices and on Windows computers. Wickr Me extraction from the cloud is a great alternative to direct device data acquisition as the Messenger data on mobile devices is heavily encrypted.

We also extended support for travel apps this year and added data extraction from BlaBlaCar and Booking.com services. Since BlaBlaCar drivers and users have already been victims of crimes including murder, drug trafficking, and many others, data extraction from this app was of great importance to our customers.


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

The full list of newly added cloud services can be found in the Oxygen Forensic® Detective interface by going to: Help> What’s New.

Computer Internet Artifacts and KeyScout

We continue to enhance our Oxygen Forensic® KeyScout utility which is available at no additional charge from the Tools menu of Oxygen Forensic® Detective.

Using KeyScout, investigators now have the ability to extract history, bookmarks, autofill forms and cookies from desktop web browsers including Google Chrome, Mozilla Firefox, and Microsoft Edge.

We added the ability to use several different search modes in KeyScout. Full and Optimal search modes offer the ability to extract passwords and tokens from portable web browser and other program versions and programs with non-default installation paths while Fast search mode checks only the default paths.

To make it even better for mobile forensic investigators, our Oxygen Forensic® KeyScout can now find iTunes backups saved on the PC. Investigators should never dismiss iTunes backups because they are often a great source of evidence. Even if the backup is encrypted, we have investigators covered! Our powerful built-in decryption of not only iTunes backups, but Android and more is included at no additional charge.

Finally, we added even more app credential hunting using KeyScout. We now support My Parrot password, Wickr Me token, Booking.Com password, QR token from the latest WhatsApp and so many others.

Mobile Forensics

Mobile device support continues to be our bread and butter. This year we have continued working on decryption algorithms that allow investigators to decrypt Android physical dumps as well as many “secure” apps.

We introduced the ability to extract hardware bound keys and decrypt physical images of the devices based on MediaTek MT6737 chipset even if Secure Startup is enabled. Moreover, we have added the ability to decrypt physical dumps with the known password for Android devices based on Qualcomm Snapdragon MSM8909 chipset.

What’s more, we’ve added support for new Qualcomm chipsets: MSM8909, MSM8916, MSM8952 and MSM8939. As of June 2019, the total amount of supported mobile devices exceeds 29,200!

We have also improved parsing of the latest Huawei backups v.9.1 and HiSuite backups v.9.1. Do not overlook these backups in your investigation because they contain a phenomenal amount of data that includes the most popular applications and other content from the data/data folder.

This year we again lead in application data parsing with the total amount of supported app versions exceeding 10,100!

Thanks to the world leading ability to decrypt encryption keys from the Android KeyStore we were able to introduce complete support for the secure Signal messenger from Android devices. Moreover, we have implemented decryption of CoverMe and Telegram X Messengers. For the full list of supported apps and artifacts go to Help > Supported applications menu of Oxygen Forensic® Detective.

Drone Forensics

We have been supporting DJI drones for some time, however this year we focused on the second market leader – Parrot drones. Within 6 months we managed to introduce Parrot drone data extraction from all possible sources. First, we have added the ability to analyze and visualize the flight data of Parrot drones from flight logs obtained by physical dumps or produced by the FreeFlight Pro mobile app. Second, we introduced the industry’s only ability to extract detailed flight history from My Parrot Cloud via login/password or token found in Apple iOS and Android devices. Third, the data parsing from Freeflight 6 mobile app has been dramatically updated.

But the most significant UAS improvement – now in Oxygen Forensic® JetEngine you can analyze extended technical information about the drone flight that includes drone acceleration, gyroscope, UAS temperature details and other data available in flight logs. Simply amazing for any investigation.

JetEngine and fast data analysis

Last December we introduced our built-in Oxygen Forensic® JetEngine, a 64-bit forensic powerhouse that allows investigators to quickly parse volumes of data and leverage advanced analytical tools to quickly pinpoint evidence. Within the last 6 months it has grown into an unbelievably powerful tool with an enormous amount of useful functions. Among some notable additions include: the ability to view Files and Social Graph Sections for a case, import and parse numerous backups and images including UAS, enhanced Maps with the unique ability to play an animated route showing the direction of travel of the extracted geo coordinates and some amazing new analytical diagrams of collected data.

To help investigators quickly locate data in mobile device extractions we added a new OS Artifacts section where investigators can find the following additional artifacts from Apple iOS jailbroken devices: applications activity, process activity, battery usage, lock state history, Siri activity, etc.

We have also made the integration between Oxygen Forensic® Detective and Oxygen Forensic® JetEngine much smoother. You can now export any Detective extraction to JetEngine just right clicking in the device tree and choosing the Export option.

WHAT TO EXPECT IN THE SECOND PART OF THE YEAR? Many more great features to include our facial recognition and more. Remember, all these great features and additions are available at no additional charge! Stay tuned!

Leave a Comment

Latest Videos

Si and Desi interview Emi Polito from Amped about how to become an Amped FIVE Certified Examiner (AFCE). They discuss the exam requirements, format, timeline for certification, and Amped’s future plans. Emi explains that the certification is aimed at demonstrating competency with the Amped FIVE video analysis software after completing training. The exam consists of multiple choice questions on theory and practical exercises using the software. Emi talks about the online exam format and process for passing or failing.

Emi also discusses the broader challenges many organizations face with validation and accreditation. He emphasizes Amped's commitment to developing tools that facilitate that process. The hosts reflect on the confusing accreditation landscape and Amped’s passion for improving training and certification in forensics. This episode provides an overview of Amped's new certification and perspective on challenges in the field of video forensics.

Show Notes:

Introducing The AFCE Certification (Amped FIVE Certified Examiner) - https://www.forensicfocus.com/news/introducing-the-afce-certification-amped-five-certified-examiner/

Video Evidence Principles With Amped Software - https://www.forensicfocus.com/podcast/video-evidence-principles-with-amped-software/

Digital Image Authenticity And Integrity With Amped Authenticate - https://www.forensicfocus.com/podcast/digital-image-authenticity-and-integrity-with-amped-authenticate/

File Analysis And DVR Conversion Training From Amped Software - https://www.forensicfocus.com/reviews/file-analysis-and-dvr-conversion-training-from-amped-software/

Amped FIVE Speed Estimation 2d Filter And Training From Amped Software - https://www.forensicfocus.com/reviews/amped-five-speed-estimation-2d-filter-and-training-from-amped-software/

Amped Software’s Martino Jerian on Key Challenges and Opportunities for Video Evidence - https://www.forensicfocus.com/podcast/amped-softwares-martino-jerian-on-key-challenges-and-opportunities-for-video-evidence/

LEVA 2023 Training Symposium - https://www.leva.org/

Forensic Collision Investigation & Reconstruction Ltd - https://www.fcir.co.uk/

Amped FIVE Certified Examiner - https://ampedsoftware.com/afce-certification 

Introducing the Amped FIVE Certification Program - https://blog.ampedsoftware.com/2023/10/04/introducing-the-amped-five-certification-program

Amped Software YouTube - https://www.youtube.com/ampedsoftware
How to Use the Validation Tool in Amped FIVE - https://blog.ampedsoftware.com/2023/03/29/how-to-use-the-validation-tool-in-amped-five

Si and Desi interview Emi Polito from Amped about how to become an Amped FIVE Certified Examiner (AFCE). They discuss the exam requirements, format, timeline for certification, and Amped’s future plans. Emi explains that the certification is aimed at demonstrating competency with the Amped FIVE video analysis software after completing training. The exam consists of multiple choice questions on theory and practical exercises using the software. Emi talks about the online exam format and process for passing or failing.

Emi also discusses the broader challenges many organizations face with validation and accreditation. He emphasizes Amped's commitment to developing tools that facilitate that process. The hosts reflect on the confusing accreditation landscape and Amped’s passion for improving training and certification in forensics. This episode provides an overview of Amped's new certification and perspective on challenges in the field of video forensics.

Show Notes:

Introducing The AFCE Certification (Amped FIVE Certified Examiner) - https://www.forensicfocus.com/news/introducing-the-afce-certification-amped-five-certified-examiner/

Video Evidence Principles With Amped Software - https://www.forensicfocus.com/podcast/video-evidence-principles-with-amped-software/

Digital Image Authenticity And Integrity With Amped Authenticate - https://www.forensicfocus.com/podcast/digital-image-authenticity-and-integrity-with-amped-authenticate/

File Analysis And DVR Conversion Training From Amped Software - https://www.forensicfocus.com/reviews/file-analysis-and-dvr-conversion-training-from-amped-software/

Amped FIVE Speed Estimation 2d Filter And Training From Amped Software - https://www.forensicfocus.com/reviews/amped-five-speed-estimation-2d-filter-and-training-from-amped-software/

Amped Software’s Martino Jerian on Key Challenges and Opportunities for Video Evidence - https://www.forensicfocus.com/podcast/amped-softwares-martino-jerian-on-key-challenges-and-opportunities-for-video-evidence/

LEVA 2023 Training Symposium - https://www.leva.org/

Forensic Collision Investigation & Reconstruction Ltd - https://www.fcir.co.uk/

Amped FIVE Certified Examiner - https://ampedsoftware.com/afce-certification

Introducing the Amped FIVE Certification Program - https://blog.ampedsoftware.com/2023/10/04/introducing-the-amped-five-certification-program

Amped Software YouTube - https://www.youtube.com/ampedsoftware
How to Use the Validation Tool in Amped FIVE - https://blog.ampedsoftware.com/2023/03/29/how-to-use-the-validation-tool-in-amped-five

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_VKk-mhlae1c

Becoming An Amped FIVE Certified Examiner (AFCE)

Forensic Focus 1st December 2023 4:25 pm

Subscribe to the Forensic Focus Podcast: https://www.forensicfocus.com/podcast/

Si and Desi are joined by Brittany and Ailsa from digital forensics software company ADF Solutions. They discuss how ADF is addressing key challenges for digital forensics practitioners, including handling the massive volumes of data from mobile devices and the cloud.

The guests outline ADF's focus on developing their software as an easy-to-use onsite triage tool that can help quickly identify pertinent evidence. Key features include advanced handling of video files, AI-assisted classification of images, and new screen recording capabilities for mobile devices that allow suspects to safely share relevant data. 

The hosts and guests also explore ADF's ongoing research into areas like facial recognition, handling new device types like games consoles and smart watches, and identifying deepfake media.

00:00 – Introduction to Ailsa and Brittany
03:00 – The challenge of vast amounts of data
05:50 – Recovering data from Chromebooks
08:50 – Triaging using ADF tools
12:30 – Benefits of using ADF Solutions’ tools
15:50 – Limitations in types of apps
17:20 – Keeping up with technological advancements
19:15 – ADF customer base
21:00 - Artificial intelligence in classifying images
30:00 – ADF Solutions’ triaging kit
37:00 – Training with ADF
40:00 – Target user
44:50 – Roadmap of future devices to examine
51:30 – Main focus for ADF Solutions going forwards

Show Notes:
AI-generated CSAM article on Sky News - https://news.sky.com/story/thousands-of-ai-generated-child-abuse-images-being-shared-online-research-finds-12991727

Subscribe to the Forensic Focus Podcast: https://www.forensicfocus.com/podcast/

Si and Desi are joined by Brittany and Ailsa from digital forensics software company ADF Solutions. They discuss how ADF is addressing key challenges for digital forensics practitioners, including handling the massive volumes of data from mobile devices and the cloud.

The guests outline ADF's focus on developing their software as an easy-to-use onsite triage tool that can help quickly identify pertinent evidence. Key features include advanced handling of video files, AI-assisted classification of images, and new screen recording capabilities for mobile devices that allow suspects to safely share relevant data.

The hosts and guests also explore ADF's ongoing research into areas like facial recognition, handling new device types like games consoles and smart watches, and identifying deepfake media.

00:00 – Introduction to Ailsa and Brittany
03:00 – The challenge of vast amounts of data
05:50 – Recovering data from Chromebooks
08:50 – Triaging using ADF tools
12:30 – Benefits of using ADF Solutions’ tools
15:50 – Limitations in types of apps
17:20 – Keeping up with technological advancements
19:15 – ADF customer base
21:00 - Artificial intelligence in classifying images
30:00 – ADF Solutions’ triaging kit
37:00 – Training with ADF
40:00 – Target user
44:50 – Roadmap of future devices to examine
51:30 – Main focus for ADF Solutions going forwards

Show Notes:
AI-generated CSAM article on Sky News - https://news.sky.com/story/thousands-of-ai-generated-child-abuse-images-being-shared-online-research-finds-12991727

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_4z-EgH54KZk

The Power Of Digital Forensics: How ADF Solutions Is Revolutionizing The Digital Forensics Industry

Forensic Focus 30th November 2023 2:57 pm

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles