Oxygen Forensic® Detective v.16.0 Introduces Decryption Of VeraCrypt Containers

Key features include:

  • APK Downgrade support for Android OS 12 – 13
  • Decryption and extraction of VeraCrypt containers
  • Passcode brute force for Apple Notes and Briar app
  • Cloud extraction of Clubhouse, Bumble, and Google Messages
  • New categories in the Image Categorization engine

For a full list of updates, refer to the “What’s New” file in the Oxygen Forensic® Detective “Options” menu.

Mobile Forensic Updates

Support for Xiaomi Redmi devices

In Oxygen Forensic® Detective v.16.0, we added the ability to extract hardware keys and decrypt physical dumps of Xiaomi devices based on the Qualcomm SDM439 chipset. Xiaomi Redmi 7A, Xiaomi Redmi 8, and Xiaomi Redmi 8A devices running Android OS 7 or higher are now supported.

Extended support for UNISOC-based devices

We also added support for the devices based on the UNISOC T606, T616, T612, and T310 chipsets and running Android OS 10 – 13. Now you can extract hardware keys to decrypt physical dumps of many HTC, Motorola, Nokia, Realme, ZTE, and other devices based on these chipsets.

Enhanced APK Downgrade method

Our APK Downgrade method allows extraction of popular apps by temporarily downgrading app versions so that they are included in the ADB backup. In Oxygen Forensic® Detective v.16.0, we added support for Android OS versions 12 and 13. Now you can extract data from many more Android devices using this method. With our support for WhatsApp, Instagram, Facebook, Twitter, and 40 other supported apps,  you will have access to much more critical evidence.

Samsung Browser extraction via Android Agent

You can now quickly collect Samsung Browser data from any unlocked Android device using our Android Agent. It can be installed on a device via USB, WiFi, or OTG device. Once the acquisition process is finished, the extraction can be imported into Oxygen Forensic® Detective for review and analysis. The evidence set will include saved logins and passwords, history, bookmarks, downloads, and other available data.

Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.

Enhanced iOS Agent method

We significantly enhanced the ability to extract full file system and keychain via the iOS Agent. Now you can extract them from devices with iOS versions 14.6 – 14.8.1, 15.6 – 15.7.1, and 16.0 – 16.5.

Decryption of Apple Notes and Briar app

We added passcode brute force for encrypted Apple Notes and Briar app.

If an Apple Note is encrypted, you can click the Enter passcode button on the toolbar of the Apple Notes section and brute force the passcode using our various available attacks.

You can now brute force the passcode for Briar app installed on Android devices. This functionality is available in the Full File System extraction method.

New App support

We added support for the following new apps:

  • Threads (Android, iOS)
  • TikTok Lite (Android)
  • TanTan (Android, iOS)
  • 1Password (Android, iOS)

The total number of supported app versions now exceeds 40,000.

Import Updates

In Oxygen Forensic® Detective v.16.0, we added the ability to import the following images:

  • Physical dumps of Xiaomi Redmi 7A/8/8A based on the Qualcomm SDM439 chipset
  • Physical dumps of the UNISOC T606/T616/T612, and T310 chipsets
  • XRY backups of versions 10.3.1 and newer

Additionally, you can now select artifacts to import and analyze from Oxygen Forensic® KeyScout extractions. This is a great time-saving feature as you do not need to import the whole extraction anymore.

Cloud Forensic Updates

Clubhouse data extraction

Launched in 2020, Clubhouse currently has over 10 million weekly active users. The latest Oxygen Forensic® Cloud Extractor enables data extraction from Clubhouse via phone number or token. The extracted data set includes account info, contacts, audio messages and replays, chats, notifications, and information about the houses.

Bumble data extraction

Bumble is another new service added in Oxygen Forensic® Detective v.16.0. Data extraction from this dating app is supported via phone number or token. Extracted evidence will include profile info, contacts, messages, and album photos.

Google Messages extraction

Now you can also extract Google Messages from the cloud. Use a token or scan a QR code with a mobile device to gain access to this cloud service. The evidence set will include information about the account owner, SIM cards, contacts, as well as private and group chats.

With this version, the total number of supported cloud services is now 105.

Computer Artifacts

Deleted files recovery

We added the ability to recover deleted files from FAT16, FAT32, and exFAT file systems. To do so, select the “Recover deleted files” option in the KeyScout Search settings, then select drives and partitions where you want to recover deleted files.

Decryption of VeraCrypt containers

The updated Oxygen Forensic® KeyScout can now extract VeraCrypt encryption keys from Windows RAM. With a found VeraCrypt encryption key drive, partitions and separate file containers can be decrypted.

The key features of this functionality include:

  • Support for standard and hidden containers
  • Detection of drives, partitions, or file containers protected with VeraCrypt
  • Extraction of VeraCrypt encryption keys of any versions
  • Support for all 15 VeraCrypt encryption algorithms

In addition to VeraCrypt encryption keys, drives and partitions can be decrypted with a known password in Oxygen Forensic® KeyScout.

New artifacts

The updated Oxygen Forensic® KeyScout enables users to collect the following new artifacts:

  • Installed Homebrew packages from macOS
  • Shim Cache from Windows
  • The information about permissions that were given to applications on Windows
  • NordVPN from Windows, macOS, and GNU/Linux
  • PureVPN from Windows, macOS, and GNU/Linux
  • VLC Media Player from Windows, macOS, and GNU/Linux
  • A paid version of ViPole from Windows, macOS, and GNU/Linux
  • Telegram stories from macOS

Moreover, weadded decryption of Viber databases from macOS and WhatsApp databases from Windows images.

Data Analysis Updates

We enhanced our analytical sections with two features:

  • New categories are added to the Image Categorization section: medical, meme, offensive gesture, and schematic.
  • A new smart filter now allows showing events before and after those events marked with a particular tag in the Timeline section.

Interested in trying out Oxygen Forensic® Detective v.16.0? Request a free trial.

Leave a Comment

Latest Videos

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles