Oxygen Forensic Detective 13.1 Offers Enhanced Screen Lock Bypass Methods And App Decryption

Today, Oxygen Forensics announced the release of the latest version of their flagship software, Oxygen Forensic® Detective v.13.1. The new version offers enhanced screen lock bypass methods for MTK and Qualcomm devices, Wire app decryption, a new method of Signal Messenger extraction, cloud access to SecMail, and many other features.

Signal Messenger extraction

Previous versions of Oxygen Forensic® Detective have allowed investigators to extract Signal Messenger from Apple iOS full file system, Android physical dumps and collect Signal data on Windows, macOS, and Linux computers.

However, Oxygen Forensic® Detective 13.1 introduces yet another method of Signal data extraction from Android devices; via our OxyAgent. To run this extraction, investigators simply install our OxyAgent to an unlocked Android device.

Select “Signal”, under the “Extract third-party applications data” option in OxyAgent, to extract existing backups. If there are no existing backups, you can choose to create a backup containing all the current Signal data. In either case, the evidence set will include account details, contacts, calls, and chats. Import the collected Signal data as an OxyAgent extraction to view it in Oxygen Forensic® Detective.

Support for MT6739 and МТ6580 chipsets

We’ve added the ability to bypass screen locks, perform physical acquisition, and decrypt physical dumps of Android devices based on Mediatek MT6739 and МТ6580 chipsets. While extracting a device, Oxygen Forensic® Detective also extracts hardware keys that are used to decrypt the collected binary image. In total, our MTK Android Physical method supports extraction and decryption for three chipsets: МТ6737, MT6739 and МТ6580. It should be noted, the built-in passcode brute force module is available at no additional charge.

Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.

Enhanced support for Qualcomm chipsets

Oxygen Forensic® Detective 13.1 offers an enhanced screen lock bypass method for Android devices based on Qualcomm MSM8917, MSM8937, MSM8940, and MSM8953 chipsets. We have improved the extraction of hardware keys that are used to decrypt the extracted binary images. Supported device models now include Xiaomi A2 Lite, Xiaomi Redmi Go, and Xiaomi Redmi Note 4X.

Acquisition of Android 10 devices

Oxygen Forensic® Detective 13.1 now allows investigators to perform a file system extraction of pre-rooted Android devices including those that run Android OS 10 and have File-based encryption. To extract a device, choose the “Android logical file system” option in Oxygen Forensic® Extractor and follow the instructions. When using this type of extraction users will have access to many parsed applications.

New cloud services

 The updated Oxygen Forensic® Cloud Extractor adds support for 2 new cloud services, SecMail, and Firefox Browser. At 88 unique services, the built-in Cloud Extractor now supports even more services than any company in the industry.

  • SecMail is a secure mail service. Investigators can gain access to the SecMail account via login and password. Extracted evidence will include the account information, contacts, and emails.
  • FireFox Browser. Authorization in a browser can be done via login/password or token found in Apple iOS devices and on Windows computers. Evidence sets will include web history, saved logins, and passwords, bookmarks, opened tabs and installed add-ons.

New computer artifacts

With the updated Oxygen Forensic® KeyScout, investigators can now collect more new artifacts from computers. KeyScout now allows the extraction of all available user data from OneDrive, Slack, and Evernote apps running on Windows and macOS computers.

In addition to applications, KeyScout can now extract several new operating system artifacts to include:

  • Recent Items showing which files have been recently opened on a Windows computer.
  • Files and their detailed information from the Recycle Bin on Windows OS.
  • The history of WinRAR operations on Windows OS.

We’ve also significantly improved the Settings menu interface where investigators can conveniently select applications for extraction, as well as set search criteria for files.

App support

 We’ve updated data parsing from over 800 apps. The total amount of supported app versions exceeds 18,800. Here are some important highlights for this release:

  • Wire App – data can now be fully extracted and decrypted from Apple iOS and Android devices. Apple iOS full file system and Android physical extractions are required
  • Signal Messenger – decryption support for data extracted from Huawei devices running Kirin chipsets
  • WhatsApp – parsing of messages from a new ChatSearchV5f database.
  • Data parsing for three more new apps – Elyments, JioPages, and GroupMe

Smart analytics

We’ve added a Smart Filter button in the Timeline and Messages sections. This developing feature contains some of the most common scenarios that investigators may face in their day to day work. In this release, investigators have several options – to show all contacts or to filter contacts (including members of group chats) that have mentioned a certain word or phrase.

Including Oxygen Forensic Viewer to OFBX backup export

Now, when investigators save extracted data to the internal OFBX format, they can include the Oxygen Forensic® Viewer, which will be saved in the same folder. Choose “Include the Viewer” in the Export window and conveniently share extracted evidence and the corresponding Viewer with colleagues and other authorized personnel.

Export enhancements

With Oxygen Forensic® Detective 13.1 investigators can save their reports as RTF, a newly added file format. In addition, the OCR section now allows investigators to export recognized texts to a variety of external formats, including PDF, XML, XLS, Relativity, and others.

Wish to try Oxygen Forensic Detective? Ask for a fully-featured demo license.

Leave a Comment

Latest Videos

Digital Forensics News Round-Up, June 19 2024 #dfir #digitalforensics

Forensic Focus 19th June 2024 2:46 pm

Digital Forensics News Round-Up, June 19 2024 #dfir #digitalforensics

Forensic Focus 19th June 2024 2:14 pm

Digital Forensics News Round-Up, June 12 2024 #dfir #digitalforensics

Forensic Focus 12th June 2024 5:51 pm

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles