Oxygen Forensic Detective 13.4 Extracts Data From Clubhouse, Discord, And TikTok Apps

Oxygen Forensic® Detective v.13.4 is now available! Extract Discord and TikTok data from the cloud, parse data from the Clubhouse app, import AD1 images, and more.

New Method for Discord Extraction

In addition to the direct extraction of Discord app data from Apple iOS and Android devices, there is now one more method available in our software. Oxygen Forensic® Detective v.13.4 will allow Discord data extraction from any unlocked Android device via OxyAgent. To do this, install OxyAgent on a device, choose Discord in the “Extract third-party applications data” menu, and follow the instructions. Once data is collected, import it into Oxygen Forensic® Detective. Investigators can expect the following artifacts: account info, contacts, private chats, group chats, and channels.

Please note, this OxyAgent method is also compatible with WhatsApp, WhatsApp Business, and Signal Messenger, using any unlocked Android device.

Enhanced Support for MTK Devices

Oxygen Forensic® Detective v.13.4 provides enhanced support for Android devices with MTK chipsets. Previously our software offered physical extraction of MTK-based Android devices with T6 and Microtrust versions of TrustZone. In version 13.4, we’ve added support for the RSEE version and improved support for the T6 version. This means investigators can now bypass screen locks and extract evidence from many more Android devices based on MT6739, MT6737 and MT6580 chipsets. To do this, select the “Physical MTK image” method in Oxygen Forensic Extractor.

TikTok and Discord Cloud Data

To access TikTok data from the cloud, investigators need to use either the phone number, login credentials, or Google or Facebook credentials. If 2FA is set, investigators will receive a code at the connected phone number or email address. Evidence sets will include account details, contacts, login history, wallet, notifications, chats, posts, and favorites.


Get The Latest DFIR News!

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

Authorization in Discord is available using login credentials or a  token found on Windows and macOS by Oxygen Forensic® KeyScout. If 2FA is enabled, investigators will be sent an SMS or authenticator code. Discord cloud extractions will include account info, contacts, chats, channels, and other available data.

The new Oxygen Forensic® Cloud Extractor introduces updated authorization algorithms for SecMail and Amazon Alexa services. The total number of supported cloud services is 94.

New Computer Artifacts

The updated Oxygen Forensic® KeyScout can collect a variety of great, new artifacts. Let’s take a look.

  • Import and parsing of AccessData AD1 logical images made from Windows, macOS, and Linux computers.
  • User data collection from GroupMe, Microsoft Mail, and Internet Explorer.
  • New Windows System artifacts include information about logon sessions, system resource usage, and installed updates.
  • New macOS system artifacts include information about installed apps, logon sessions, and terminal history sessions.

New App Support

Oxygen Forensic® Detective v.13.4 brings support for 4 new apps and updates data parsing for 700+ already supported apps. Let’s see what’s new:

  • Clubhouse – A popular social network for drop-in audio conversations. For data extraction, we recommend using checkm8 vulnerability in Oxygen Forensic® Investigators will be able to extract the account info, contacts, channels, events, clubs, logs, cookies, cache, and other available data.
  • Lime and Bird – Scooter and bike-sharing apps. The number of artifacts acquired will depend on the extraction method and the device OS. Extractions may include account info, vehicles, rides, balance history, nearby parking, cache, cookies, and more.
  • Steam – In response to our customers, we’ve added support for this messenger. Evidence sets will consist of account info, contacts, chats, cookies, and cache.
  • Yahoo Mail – We’ve added complete data parsing for Apple iOS devices and updated support for Android devices.

Data Export Enhancements

Oxygen Forensic® Detective v.13.4 now allows investigators to set multiple date and time filters when exporting data to external formats. Additionally, we’ve significantly sped up the overall data export process.

Global Search in SQLite databases

In the Viewer for SQLite databases, investigators can now run a search through all or selected database tables. There are various options for search criteria that can be applied. For example, investigators have the ability to search in text, number, or binary fields.

Supported Devices List

Investigators can now instantly check if a device is supported in Oxygen Forensic® Detective. Go to the Options menu, click “Supported Devices” for the complete list of supported devices and the extraction methods available for each.

Wish to try the new version of Oxygen Forensic® Detective? Ask for a fully-featured demo license.

Leave a Comment

Latest Videos

Magnet Forensics' Matt Suiche on the Rise of e-Crime and Info Stealers

Forensic Focus 12th January 2023 3:00 am

Just like your current holiday shopping for last minute presents a lot of the good stuff has gone off the shelves already. You reach to the back and find the toy nobody really wanted but it’s the thought that counts, you stare down at Si and Desi’s Holiday Special 2022 podcast. 

Please join these two as they lament over the year that was, discuss all the things they didn’t do but promise they will do them next year, query whether putting a NAS in the storage of a roller door is a good idea, and finally arrive at what they’re looking forward to bringing you in the new year.

Show Notes:

Arduino PLC IDE - https://docs.arduino.cc/software/plc-ide
Mycroft Mark II (open source Alexa) - https://www.kickstarter.com/projects/aiforeveryone/mycroft-mark-ii-the-open-voice-assistant
Christa’s new blog - https://christammiller.com/
Si’s holiday reading - https://amzn.to/3iJyGrR
Desi’s holiday reading -  https://inteltechniques.com/
Strange event for the end of the year - https://www.reuters.com/world/europe/25-suspected-members-german-far-right-group-arrested-raids-prosecutors-office-2022-12-07/
Si’s wishful thinking - https://www.youtube.com/watch?v=GXnRgXclLd0
Si’s list to do before the EOY - https://intrepidcamera.co.uk/products/intrepid-4x5-camera
Desi’s list to do before EOY - https://www.wired.com/story/how-to-reset-your-phone-before-you-sell-it/
“Cleaning your office” - https://www.manfrotto.com/uk-en/vintage-collapsible-1-5-x-2-1m-ink-sage-ll-lb5720/
Conference recorder - https://amzn.to/3UBmre5
Desi’s blog - https://www.hardlyadequate.com/

Just like your current holiday shopping for last minute presents a lot of the good stuff has gone off the shelves already. You reach to the back and find the toy nobody really wanted but it’s the thought that counts, you stare down at Si and Desi’s Holiday Special 2022 podcast.

Please join these two as they lament over the year that was, discuss all the things they didn’t do but promise they will do them next year, query whether putting a NAS in the storage of a roller door is a good idea, and finally arrive at what they’re looking forward to bringing you in the new year.

Show Notes:

Arduino PLC IDE - https://docs.arduino.cc/software/plc-ide
Mycroft Mark II (open source Alexa) - https://www.kickstarter.com/projects/aiforeveryone/mycroft-mark-ii-the-open-voice-assistant
Christa’s new blog - https://christammiller.com/
Si’s holiday reading - https://amzn.to/3iJyGrR
Desi’s holiday reading - https://inteltechniques.com/
Strange event for the end of the year - https://www.reuters.com/world/europe/25-suspected-members-german-far-right-group-arrested-raids-prosecutors-office-2022-12-07/
Si’s wishful thinking - https://www.youtube.com/watch?v=GXnRgXclLd0
Si’s list to do before the EOY - https://intrepidcamera.co.uk/products/intrepid-4x5-camera
Desi’s list to do before EOY - https://www.wired.com/story/how-to-reset-your-phone-before-you-sell-it/
“Cleaning your office” - https://www.manfrotto.com/uk-en/vintage-collapsible-1-5-x-2-1m-ink-sage-ll-lb5720/
Conference recorder - https://amzn.to/3UBmre5
Desi’s blog - https://www.hardlyadequate.com/

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_BhrBg5_sAKo

Si and Desi Holiday Special 2022

Forensic Focus 16th December 2022 12:00 am

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles

Share to...