Oxygen Forensic® Detective v.15.5.1 Is Out

The update to our flagship solution is here, Oxygen Forensic® Detective v.15.5.1.

Support for the MT6833 chipset

Oxygen Forensic® Detective v.15.5.1 offers extraction of hardware keys and decryption of Android devices based on the MT6833 chipset, having File-Based Encryption (FBE) and running Android OS 10-13. Our support covers Samsung, Xiaomi, Oppo, Realme, Vivo, and Motorola devices.

Other Extractor Updates

Our updated Oxygen Forensic® Device Extractor introduces several other enhancements:

  • Added the ability to extract the full file system and keychain via checkm8 from Apple iOS devices with iOS version 15.7.7.
  • Updated extraction via iOS Agent from iPhones running iOS versions 15.0 – 15.4.1.
  • Updated Kik and Discord data extraction via Android Agent from unlocked Android devices.
  • Updated data extraction via Android Agent from Huawei devices running HarmonyOS.

App Support

We’ve added support for the following new apps:

  • AWS Wickr (iOS, Android)
  • Samsung Email (Android)
  • Vivaldi Browser (Android)

The total number of supported app versions now exceeds 39,900.


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.


Import Updates

In Oxygen Forensic® Detective v.15.5.1, we added the ability to import the following images:

  • Physical dumps of Android OS devices based on the MT6833 chipset and having TEE Microtrust and F2FSCrypt.
  • Physical dumps of Android OS devices based on the MT6833 chipset and having TEE TEEGRIS and F2FSCrypt.
  • Physical dumps of Android OS devices based on MT6768 chipset and having F2FSCrypt and hybrid TEE Kinibi + TEEGRIS.
  • Physical dumps of Android OS devices based on the MT6580 chipset and having TEE T6, F2FSCrypt, and metadata encryption.
  • UFED backups of CLBX format.

Cloud Forensic Updates

We updated the ability to authorize in Google services and Twitter.

New and Updated Computer Artifacts

The updated Oxygen Forensic® KeyScout enables users to collect the following new artifacts:

  • The permissions given by macOS applications
  • The background app activity from Windows
  • The history of recently opened files from Linux
  • The secret DPAPI password from Windows accounts linked to Microsoft accounts
  • ICQ data from Windows, macOS, and Linux
  • FileZilla data from Windows, macOS, and Linux
  • Spark data from Windows
  • Discord data from Linux
  • Discord messages and cookies from Windows and macOS

Updated artifact support includes:

  • Data about network interfaces from Windows
  • Spark data from macOS

Data Analysis Updates

In Oxygen Forensic® Detective v.15.5.1 we included several enhancements for our analytical tools:

  • Added the Activity Matrix for geo coordinates. Now you can further analyze the geo location data and determine the peaks of user activity.
  • Added a new smart filter. Now you can quickly filter and view the events that happened before and after the events marked with tags.
  • Added the ability to filter by seconds, minutes, and hours in the time filter.

Interested in trying out Oxygen Forensic® Detective v.15.5.1? Request a free trial.

Leave a Comment