In 2024, Oxygen Forensics added several impactful updates to its flagship solution, Oxygen Forensic® Detective. Let’s review the year’s top modules and updates designed to enhance existing features and heighten investigative capabilities.
New Built-In Modules
Malware scan
Oxygen Forensics’ list of new built-in modules in 2024 includes one of its most-requested capabilities. Users can now scan extracted files for more than 13 identifiable malware threats:
- Adspy
- Backdoor
- Constructor
- Dialer
- Dropper
- Exploit
- Heuristic
- Phishing
- Rickware
- Trash
- Trojware
- Virware
- Worm
Once the malware scan options have been configured in the Options section, a malware scan can be initiated in the Malware section of the selected extraction. Users can scan all the files or selected ones. The results will appear on the toolbar, displaying the scanned file status, identified threats, scan start time, and other relevant details.
Malware scan helps users identify extracted systems compromised by malicious software, and indications of potential unauthorized access or security breaches. The inclusion of the malware scan tool at no additional cost aligns with the all-in-one positioning of the company and offers significant benefits to customers.
Speech recognition and transcription
Using speech recognition and transcription can save valuable time for investigations. In Oxygen Forensic® Detective, users can now recognize and transcribe speech from audio and video files. By default, the software uses the Base recognition model, but users can also download more advanced models from the Customer Area. The engine supports speech recognition in over 50 languages. Additionally, users can search through the recognized speech in the Search section and export recognized data to reports.
This feature is crucial for forensic analysis of communication because it allows investigators to transcribe and analyze audio and video evidence, such as voice messages or recorded videos, in text form. It significantly helps in quickly analyzing the content of voice messages and facilitates keyword searches.
Mobile Data Extraction
This year Oxygen Forensics enhanced its screen lock bypass methods for better data extraction, giving investigators greater access to critical evidence from mobile devices.
MTK-based Android support
First, Oxygen has significantly extended its support for MTK-based Android devices, adding many new chipsets: MT6771, МТ6873, MT6781, MT6877, MT6750, MT6855, MT6767, MT6797, and MT6891.
Qualcomm-based Android support
Second, Oxygen Forensics has also enhanced its support for Qualcomm-based Android devices, adding support for SDM845, SDM665, SDM675, SDM730, and SDM855 chipsets.
UNISOC-based Android support
Finally, Oxygen Forensics has significantly accelerated data extraction from UNISOC-based Android devices.
Unlocked Android device support
Oxygen’s Android extraction enhancements provide investigators crucial access to the latest devices. For unlocked Android devices, Oxygen Forensics has introduced the ability to extract user application data and internal memory data from devices running Android OS 9- 14 that have the SPL no later than June 1, 2024. Moreover, users can now extract app data via Android Agent from devices running Android OS 14.
Regarding unlocked iOS devices, Oxygen Forensics has continued adding support for the newer versions to the checkm8 and iOS Agent methods, as well as accelerated data extraction from iOS devices via iOS Agent, iOS SSH and checkm8.
Cloud Data Extraction
Oxygen Forensics celebrated the 10th anniversary of its industry-first Cloud Extractor. Updates now support 107 cloud services, including support to extract evidence, including the account information, chats, posts, notifications, reactions, comments, and subscriptions from two new services:
- Steam
Find More Passcodes to Computer Artifacts
Oxygen Forensics has also enhanced the capability of finding passcodes to decrypt encrypted partitions, files, and applications with KeyDiver. Support has been added for:
- iTunes backups
- Android backups
- Huawei HiSuite backups
- Containers and partitions protected with VeraCrypt
- 7-ZIP archives
- RAR archives
- MS Office files (Word, Excel, PowerPoint)
Now users can create an attack method using a dictionary, a mask, or the user’s personal data from extraction.
Passcode brute force is significant for many types of investigations when the passcode is not known or forgotten. Enhancing the brute force module at no extra cost provides overall value to users
Added Microsoft Office Search Capabilities
Oxygen Forensics has introduced the ability to search Microsoft Office and plain text files by file signature, as well as search by hash sets in KeyScout.
KeyScout is a portable application available in Oxygen Forensic® Detective at no extra cost that searches only for the evidence needed and collects only the evidence required, expediting time to resolution.
KeyScout can also now make bit-by-bit disk copies and save them to RAW or E01 formats, allowing investigators to preserve the entire content of a storage device.
Support for various torrent files has been introduced, as well as the .torrent extension on the Files tab being added to the Search Profiles of KeyScout.
The number of supported users and system artifacts for Windows, macOS, and Linux has been significantly increased.
Additional Data Import Sources
In 2024, Oxygen Forensics added the following new evidence sources to their toolkit:
- Apple Warrant Returns
- Apple Keychain
- X (Twitter) archives
- TikTok account data
- Snapchat My Data backups
- Google Voice data from Google Takeout
- VDI images of Android extractions
- Logical MD-Next extractions
- Huawei backups created with Huawei HiSuite versions 13.0 and 14.0
- vCard files
- ArduPilot drone logs
- DJI drone logs in AWM format
- ULog logs of PX4-based drones
Data Analysis Enhancements
Oxygen Forensics has made several enhancements to the Data Analysis modules:
Facial categorization
Oxygen Forensics added a Facial Categorization Wizard that allows the selection of specific file folders for facial categorization. With customizable file filter criteria encompassing file types, specific folders, and file sizes, this feature significantly speeds up the processing of files through our facial categorization engine.
Geolocation icons
Oxygen Forensics enhanced the visibility of geolocation data by distinctly marking the device owner’s coordinates with a unique icon, making them easily distinguishable from third-party locations in the Timeline section.
Added languages in Translation
Oxygen Forensics added new supported languages to its Translation module to translate messages in the Applications, Messages, and Timeline sections. Translation of more than 30 languages is now supported.
Schedule a demo to learn more about Oxygen Forensic® Detective.
