Key Oxygen Forensic® Detective Updates in 2024

In 2024, Oxygen Forensics added several impactful updates to its flagship solution, Oxygen Forensic® Detective. Let's review the year's major modules and updates designed to improve existing features and increase research capabilities.

New integrated modules
Malware scanning
Oxygen Forensics' list of new integrated modules in 2024 includes one of its most requested capabilities. Users can now scan extracted files for over 13 identifiable malware threats:

• Adspy
• Backdoor
• Builder
• Dialer
• Dropper
• Exploit
• Heuristic
• Phishing
• Rickware
• Trash
• Trojware
• Virus
• worm

Once the malware scan options have been configured in the Options section, a malware scan can be started in the Malware section of the selected extraction. Users can scan all or selected files. The results will appear in the toolbar and show the status of the scanned file, identified threats, scan start time, and other relevant details.

Malware analysis helps users identify extracted systems compromised by malicious software and indications of possible unauthorized access or security breaches. The inclusion of the malware scanning tool at no additional cost aligns with the company's all-in-one positioning and offers significant benefits to customers.

Voice recognition and transcription.
Using speech recognition and transcription can save valuable time in investigations. In Oxygen Forensic® Detective, users can now recognize and transcribe speech from audio and video files. By default, the software uses the Base recognition model, but users can also download more advanced models from the Customer Area. The engine supports speech recognition in more than 50 languages. Additionally, users can search the recognized voice in the Search section and export recognized data to reports.

This feature is crucial for communication forensics because it allows investigators to transcribe and analyze audio and video evidence, such as recorded voice messages or videos, into text form. It significantly helps to quickly analyze the content of voice messages and makes it easier to search for keywords.

Mobile data extraction
This year, Oxygen Forensics improved its lock screen bypass methods for better data extraction, giving investigators greater access to critical evidence from mobile devices.

MTK based Android support
First of all, Oxygen has significantly expanded its support for MTK-based Android devices, adding many new chipsets: MT6771, МТ6873, MT6781, MT6877, MT6750, MT6855, MT6767, MT6797 and MT6891.

Support for Qualcomm-based Android
Secondly, Oxygen Forensics has also improved its support for Qualcomm-based Android devices, adding support for the SDM845, SDM665, SDM675, SDM730, and SDM855 chipsets.

UNISOC-based Android support
Finally, Oxygen Forensics has significantly accelerated data extraction from UNISOC-based Android devices.

Support for unlocked Android devices
Oxygen's Android mining improvements give researchers crucial access to the latest devices. For unlocked Android devices, Oxygen Forensics has introduced the ability to extract user app data and internal memory data from devices running Android 9-14 OS that have SPL no later than June 1, 2024. Additionally, users can now extract app data through Android. Agent for devices with Android 14 operating system.

Regarding unlocked iOS devices, Oxygen Forensics has continued to add support for newer versions of the checkm8 and iOS Agent methods, as well as accelerated data extraction from iOS devices via iOS Agent, iOS SSH, and checkm8.

Data extraction in the cloud
Oxygen Forensics celebrated the 10th anniversary of its industry-first Cloud Extractor. The updates now support 107 cloud services, including support for extracting evidence including account information, chats, posts, notifications, reactions, comments, and subscriptions from two new services:

reddit
Steam

Find more passwords for computer devices
Oxygen Forensics has also improved the ability to find passwords to decrypt partitions, files and applications encrypted with KeyDiver. Added support for:

iTunes backups
android backups
Huawei HiSuite Backups
Containers and partitions protected with VeraCrypt
7-ZIP archives
RAR files
MS Office files (Word, Excel, PowerPoint)
Users can now create an attack method using a dictionary, a mask, or the user's personal data obtained from the extraction.

Passcode brute forcing is important for many types of investigations when the passcode is unknown or forgotten. Improving the brute force module at no additional cost provides overall value to users

Added Microsoft Office search capabilities

Oxygen Forensics has introduced the ability to search Microsoft Office and plain text files by file signature, as well as search by hash sets in KeyScout.

KeyScout is a portable application available from Oxygen Forensic® Detective at no additional cost that searches for only the necessary evidence and collects only the required evidence, speeding up resolution time.

KeyScout can now also make bit-by-bit disk copies and save them in RAW or E01 formats, allowing researchers to preserve the entire contents of a storage device.

Support for various torrent files has been introduced, as well as the .torrent extension has been added in the Files tab to KeyScout search profiles.

The number of supported users and system artifacts for Windows, macOS, and Linux has increased significantly.

Additional Data Import Sources
In 2024, Oxygen Forensics added the following new sources of evidence to its toolkit:

Apple warranty returns
apple keychain
X Files (Twitter)
TikTok account details
Snapchat My Data Backups
Google Voice data from Google Takeout
VDI Images of Android Extractions
MD-Next Logical Extracts
Huawei backups created with Huawei HiSuite versions 13.0 and 14.0
vCard files
ArduPilot Drone Logs
DJI drone logs in AWM format
ULog logs of PX4-based drones

Data analysis improvements
Oxygen Forensics has made several improvements to the data analysis modules:

Face categorization
Oxygen Forensics added a facial categorization wizard that allows the selection of specific file folders for facial categorization. With customizable file filtering criteria spanning file types, specific folders, and file sizes, this feature significantly speeds up file processing through our facial categorization engine.

Geolocation icons
Oxygen Forensics improved the visibility of geolocation data by clearly marking the device owner's coordinates with a unique icon, making them easily distinguishable from third-party locations in the Timeline section.

Languages ​​added in translation
Oxygen Forensics added new supported languages ​​to its translation module to translate messages in the Apps, Messages, and Timeline sections. Translation of more than 30 languages ​​is now supported.