Top Software Updates from Oxygen Forensics in 2022

As this year comes to a close, we want to review the top advancements we’ve made to our software in 2022.

Mobile Data Extraction

This year we’ve introduced numerous methods and features to allow investigators increased access to evidence from mobile devices and cloud services, even if encrypted. Let’s review our extraction updates of 2022.

  • Android MTK Devices. MTK-based devices have been our priority this year. We’ve added passcode brute force for MTK-based Android devices with File-Based Encryption (FBE). These devices include the popular Xiaomi, Oppo, and Realme models. We’ve also added support for 3 new MTK chipsets: MT6765, MT6768, and MT6785. Our support for MTK-based Android devices with Full-Disk Encryption has also been significantly enhanced. Learn more in this article.
  • Access to the Xiaomi Second Space. Within the MTK Android Dump method, we’ve added the ability to brute force and decrypt Xiaomi Second Space where sensitive data might be located.
  • Brute force for Samsung Exynos (FBE) devices. Now you can brute force passcodes to decrypt data from Samsung Exynos devices with FBE and running Android OS 10-11.
  • Huawei Kirin Devices. We’ve added support for Kirin 985 and 820 chipsets. Now you can decrypt evidence from many more Huawei devices running Android OS 9 and 10. More information on this method is available here.
  • Huawei MainSpace. If several MainSpaces are activated, passcodes to all of them can now be brute forced and applied. Use the Huawei Android Dump method for this.
  • Android Agent Utility. For manual extraction, we’ve added support for the following new apps: Zoom, Wickr Pro, Silent Phone, Kik Messenger, Firefox. Use this method for fast data collection from unlocked Android devices.
  • Android KeyStore Extraction. We’ve enhanced the ability to extract encryption keys from the Android KeyStore to decrypt secure apps, like Signal, Silent Phone, and ProtonMail. Use the Full File System, Huawei Kirin, and Qualcomm methods for this purpose.
  • iOS checkm8 method. We have updated this method with the release of every new iOS version. Currently, it is compatible with all the versions up to, and including, 15.7.
  • iOS Agent. We’ve introduced a new method of iOS data extraction. Currently, this method covers a vast variety of devices including iPhone 11 and iPhone 12. The supported versions are 14.0 – 14.3, 14.4 – 14.5.1, and 15.0 – 15.1.1. Learn more in this article.
  • Mobile App Parsing. We’ve focused on app parsing updates and decryption of secure and vault apps like ProtonMail, Calculator+, Calculator#, FileSafe, and Briar. Currently, the total number of supported app versions exceeds 34,600.

Cloud Data Extraction

This year we focused on enhancing support for our 102 supported cloud services. However, we have also introduced support for multiple new services:

We’ve also added the ability to import and decrypt WhatsApp backups of .crypt 15 type.

Computer Artifacts

With every release, we add a great number of functionality and interface enhancements to Oxygen Forensic® KeyScout, making it a more powerful computer forensics tool.


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

This year we’ve significantly improved the KeyScout interface, making it more user friendly. In addition, we’ve extended a number of supported system and user artifacts that can be collected on macOS, Windows, and Linux computers.

We’ve also added support for new types of computer images:

  • Lx01 images
  • Ex01 images
  • images of virtual machines of VMX and VBOX formats
  • macOS Time Machine backups
  • Windows Volume Shadow Copy snapshots
  • macOS images that contain the APFS file system
  • images and drives that contain the exFAT file system

Data Import

This year we’ve added many new evidence sources to our toolkit:

Data Analytics

Many great analytic enhancements have been incorporated this year:

  • User Searches section. You can now analyze all the extracted user searches in a single view.
  • New analysis tool in Timeline. We’ve added the ability to compare device call and message logs with CDR data.
  • Facial Categorization
    • multi-thread facial categorization using GPU and CPU
    • adding faces from video frames from the File section to face sets that are used in facial search across extracted evidence
    • ability to categorize faces from video frames in the Files section and add them to the Faces section
    • Selective categorization of faces in the Files section
  • Hex Search. We’ve added Hex Lists Manager in the Search section.
  • Locations analysis. Now you can get addresses from geo coordinates using OpenStreetMap and Mapbox services.

Leave a Comment

Latest Videos

In this episode of the Forensic Focus podcast, Desi and Si discuss different online programming courses and what they think about the popular platform, Udemy. They also talk about Flipper, Dev boards, and Raspberry Pi, and delve into the fascinating phenomenon of running the classic game Doom on unlikely devices.

Throughout the episode, Desi and Si share their digital forensics expertise, referencing some of the cases they have been working on and highlighting particular methodologies and technologies that have an impact on cybersecurity.

Show Notes:

100 Days of Code: The Complete Python Pro Bootcamp for 2023 - https://www.udemy.com/course/100-days-of-code/

Domestika - https://www.domestika.org/en

MIT OpenCourseWare - https://www.youtube.com/@mitocw 

MasterClass - https://www.masterclass.com/

Raspberry Pi 400 Complete Kit - https://core-electronics.com.au/raspberry-pi-400-kit.html

Flipper Discord - https://discord.com/invite/flipper

Flipper Zero - https://flipperzero.one/

This Programmer Figured Out How to Play Doom on a Pregnancy Test - https://www.popularmechanics.com/science/a33957256/this-programmer-figured-out-how-to-play-doom-on-a-pregnancy-test/

Here’s a dude playing Doom Eternal on his fridge - https://www.polygon.com/2020/10/13/21514933/doom-eternal-refrigerator-door-samsung-smart-refrigerator-xbox-game-pass-richard-mallard

Doom hacker gets Doom running in Doom - https://www.pcgamer.com/doom-hacker-gets-doom-running-in-doom/

Doom Running On A Calculator Powered By Old Potatoes - https://kotaku.com/doom-running-on-a-calculator-powered-by-old-potatoes-1845374069

GoldenEra - https://www.imdb.com/title/tt11753760/

Racing the Beam - https://en.wikipedia.org/wiki/Racing_the_Beam

High Score (TV series) - https://en.wikipedia.org/wiki/High_Score_(TV_series)

Microcontroller Courses (Udemy) - https://www.udemy.com/topic/microcontroller/

The story of Final Fantasy XIV’s renegade do-good modders - https://www.pcgamesn.com/final-fantasy-xiv/ffxiv-modders-renegade-do-gooders

Logical fallacies - https://yourlogicalfallacyis.com/

In this episode of the Forensic Focus podcast, Desi and Si discuss different online programming courses and what they think about the popular platform, Udemy. They also talk about Flipper, Dev boards, and Raspberry Pi, and delve into the fascinating phenomenon of running the classic game Doom on unlikely devices.

Throughout the episode, Desi and Si share their digital forensics expertise, referencing some of the cases they have been working on and highlighting particular methodologies and technologies that have an impact on cybersecurity.

Show Notes:

100 Days of Code: The Complete Python Pro Bootcamp for 2023 - https://www.udemy.com/course/100-days-of-code/

Domestika - https://www.domestika.org/en

MIT OpenCourseWare - https://www.youtube.com/@mitocw

MasterClass - https://www.masterclass.com/

Raspberry Pi 400 Complete Kit - https://core-electronics.com.au/raspberry-pi-400-kit.html

Flipper Discord - https://discord.com/invite/flipper

Flipper Zero - https://flipperzero.one/

This Programmer Figured Out How to Play Doom on a Pregnancy Test - https://www.popularmechanics.com/science/a33957256/this-programmer-figured-out-how-to-play-doom-on-a-pregnancy-test/

Here’s a dude playing Doom Eternal on his fridge - https://www.polygon.com/2020/10/13/21514933/doom-eternal-refrigerator-door-samsung-smart-refrigerator-xbox-game-pass-richard-mallard

Doom hacker gets Doom running in Doom - https://www.pcgamer.com/doom-hacker-gets-doom-running-in-doom/

Doom Running On A Calculator Powered By Old Potatoes - https://kotaku.com/doom-running-on-a-calculator-powered-by-old-potatoes-1845374069

GoldenEra - https://www.imdb.com/title/tt11753760/

Racing the Beam - https://en.wikipedia.org/wiki/Racing_the_Beam

High Score (TV series) - https://en.wikipedia.org/wiki/High_Score_(TV_series)

Microcontroller Courses (Udemy) - https://www.udemy.com/topic/microcontroller/

The story of Final Fantasy XIV’s renegade do-good modders - https://www.pcgamesn.com/final-fantasy-xiv/ffxiv-modders-renegade-do-gooders

Logical fallacies - https://yourlogicalfallacyis.com/

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_5f72B6DD5wk

Programming Languages, Flipper And Gaming

Forensic Focus 78 views 24th May 2023 11:43 am

Latest Articles

Share to...