Alexandria, VA, USA - November 3, 2022 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and enterprise clients, announced today the release of the latest version of the all-in-one digital forensic solution, Oxygen Forensic® Detective v.15.1 This version offers multiple advancements to increase access to mobile data, as well improvements to the popular analytic feature, Facial Categorization.

Oxygen Forensic® Detective v.15.1 expands brute force capabilities for Android devices by enhancing support for two MTK chipsets. Investigators will be able to bypass passcodes and access more data from MTK-based Android devices. Furthermore, to improve extraction support for Kirin-based Huawei devices, Oxygen Forensics has added the ability to brute force passcodes for multiple Huawei MainSpaces, exponentially increasing the amount of data users can extract to help support their investigations.

Additionally, Oxygen Forensics advances decryption capabilities and increases support for Android Keystore extraction for Qualcomm-based devices. With Oxygen Forensic® Detective v.15.1, investigators will be able to extract encryption keys for four Qualcomm chipsets.

Version 15.1 introduces the ability to import, parse, and analyze downloaded Snapchat My Data files. Used in accordance with Snapchat’s “Download My Data” function, investigators will be able to download account information, chats, search history, and more, and then analyze this data using the wide selection of comprehensive analytic tools offered in Oxygen Forensic® Detective.

Once again, Oxygen Forensics enhances their popular and powerful Facial Categorization feature. With version 15.1, investigators will have the ability to detect faces within videos. This will minimize the need to scan video frames and manually take screenshots, ultimately improving workflow and saving investigators valuable time.

Oxygen Forensic® Detective v.15.1 offers multiple enhancements in mobile extraction support that grant investigators access to more mobile data from over 30,000 mobile devices. When asked about what drove the decision to focus on decryption and brute forcing, CEO Lee Reiber stated, “Our goal is to give our users industry-leading extraction support with each consecutive release. The way we do this is by listening to our customers’ feedback, innovating, and building state-of-the-art tools that are compatible with the latest mobile devices and artifacts.”

With expanded brute force and decryption capabilities, and an improved Facial Categorization tool, Oxygen Forensic® Detective v.15.1 is another groundbreaking release that will surely exceed customers’ expectations.

For a full list of 15.1 updates, click here

read more



Alexandria, VA, USA - September 13, 2022 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and corporate clients, announced today the release of the latest version of the all-in-one digital forensic solution, Oxygen Forensic® Detective v.15.0. This version significantly expands extraction support, grants access to more cloud data, and introduces a new analytic feature for call and message logs.

Oxygen Forensic® Detective v.15.0 increases its screen lock bypass capabilities for Xiaomi devices to support two new chipsets. Investigators can now extract hardware keys and decrypt more digital evidence. For certain Qualcomm-based Huawei devices, this new release gives users access to encryption keys from the Android Keystore, granting investigators access to encrypted data from various new mobile apps to assist in their investigations.

To improve extraction functionality, Oxygen Forensics enhances their popular iOS Selective Extraction feature to now support any installed app. Investigators will no longer be limited to the 30 most popular apps. Additionally, new apps have been added to Oxygen Forensic® Detective’s catalog of supported applications, such as Temp Mail, Huawei Notes, and Bigo Live, bringing its total number of supported app versions to over 33,800.

In cloud data forensics, this release introduces a completely redesigned extraction method for the popular file-sharing app, Box, allowing investigators to extract even more data. With this upgrade, users will be able to acquire contacts, collections, notes, and more. This data can be critical in establishing key elements of a case.

Date import capabilities have also been expanded in this release. Investigators can now import Semantic Location History from Google Takeout. Once imported, this location data will be automatically parsed to give investigators insight into the account owner’s whereabouts through their visited locations and trips.

Oxygen Forensics introduces a new tool to its analytic suite. This feature will allow investigators to compare extracted call and message logs with Call Data Records from mobile service providers directly in Oxygen Forensic® Detective. In the event that a device user manually deletes calls or messages, this tool will enable investigators to identify inconsistencies and bridge the gaps to see the complete scope of a case.

Oxygen Forensic® Detective v.15.0 enhances capabilities in several areas with advancements in extraction support, cloud support, and the introduction of a new analytic feature. When asked about what drove the new analysis tool, CEO Lee Reiber stated, “A common setback for digital forensic investigators is deleted data. We strive to find innovative ways to not only recover that data but make it usable. The new feature to compare call and message logs will assist investigators by automatically parsing and comparing these call and message records.”

Oxygen Forensic® Detective v.15.0 marks another monumental release for Oxygen Forensics. Committed to meeting the needs of their users, Oxygen Forensics delivers another comprehensive and industry-leading update.

For a full list of 15.0 updates, click here.

read more



Alexandria, VA, USA - July 21, 2022 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and corporate clients, announced today the release of the latest version of the all-in-one digital forensic solution, Oxygen Forensic® Detective v.14.6. This version adds support for multiple new backups, continues to improve the iOS Agent extractor, and introduces a new analytic feature.

Oxygen Forensic® Detective v.14.6 improves its versatility as a full-featured digital forensic tool by expanding import capabilities for third-party extractions. With this upgrade, investigators will be able to import entire extractions from WonderShare MobileGo and Mobile Trans, and then analyze them using the built-in suite of analytic tools. In addition, brute-force decryption has been implemented for imports from MTK-based Android devices having FBE (File-Based Encryption).

With this release, investigators will have access to the latest iOS versions via an updated iOS Agent and will now have the ability to extract data from Apple devices running iOS versions 15.0 - 15.1.1. Oxygen Forensics also gives investigators access to more data through the introduction of several new mobile apps, like Skout and Google Meet. With these advancements, investigators will be able to extract varying datasets to help them gain valuable insights into the device user.

Oxygen Forensic® Detective v.14.6 introduces a powerful new feature - User Searches. Sure to provide critical background for investigators, this feature automatically compiles a user’s searches from all extracted apps, like browsers and social networks, into a single list. The list provides additional data, including the date and the application the data was extracted from. Using this powerful feature, investigators will have the potential to identify the user’s interests as well as develop a chronological log of their searches.

Oxygen Forensics makes several significant advancements with this new release, but among the most notable are the enhancements in import capabilities. When asked about the importance of improving import functionality, CEO, Lee Reiber stated, “Oxygen Forensics recognizes that an effective digital investigator is one who uses the toolbox approach to digital forensics. Understanding this, we regularly add support for different backups and expand import capabilities to ensure that our solution allows for a seamless integration into any existing digital forensic workflow.”

Oxygen Forensics continues to take critical steps to maintain its position as a user-focused digital forensic tool. With forward-thinking features and compatibility, they lead the industry as the most comprehensive and innovative digital forensic tool on the market.

For a full list of 14.6 updates, click here.

read more



Alexandria, VA, USA - June 2, 2022 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and corporate clients, announced today the release of the latest version of the all-in-one digital forensic solution, Oxygen Forensic® Detective v.14.5. This version dramatically enhances mobile data extraction with several new features, implements support for additional computer artifacts, and introduces a way to acquire addresses from geo coordinates.

Oxygen Forensic® Detective v.14.5 adds a new extraction method to its mobile forensic tool belt. With the new iOS Agent utility, investigators will be able to extract more evidence than previously accessible with other iOS extraction methods, allowing them to build a more robust case. Additionally, this new method has a capacity to support more device models than other extraction methods.

Oxygen Forensics continues its innovation by introducing a new feature for Android devices, Selective Chat Extraction. Starting with Viber and Telegram, investigators will be granted the option to extract specific private or group chats, significantly reducing extraction time in circumstances when full app extractions are not necessary and maximizing productivity in the investigative process. With several newly supported mobile applications, Oxygen Forensics leads the industry with a total number of supported app versions now exceeding 30,800.

In computer forensics, Oxygen Forensics expands artifact support in their popular KeyScout tool. Investigators will now have the ability to import and parse several new types of computer images, allowing them to gather more digital evidence faster and more efficiently. It is also now possible to extract OneDrive data on Windows and macOS, granting investigators access to private and deleted data, thus contributing to bringing more visibility to digital evidence.

Leveraging innovative built-in AI technology, Oxygen Forensic® Detective v.14.5 introduces a feature that conveniently allows investigators to acquire physical point addresses from geo coordinates. Investigators can save time by pinpointing addresses directly on our solution and deliver actionable intelligence in a case.

With a new method of mobile extraction, access to more computer images, and enhanced support for geo coordinates, Oxygen Forensic® Detective v.14.5 places heavy emphasis on innovation and agility in the introduction of new features. We spoke with CEO, Lee Reiber, on Oxygen Forensics’ push to exceed expectations with every release. He stated, “It’s no secret how quickly criminals and technology advance and adapt in this industry. If we don’t do everything we can to give our customers state-of-the-art solutions, we aren’t doing our part.” With one industry-leading release after another, investigators can look to Oxygen Forensics to deliver the latest, most relevant, and efficient tools in digital forensics and incident response.

For a full list of 14.5 updates, click here.

read more



Alexandria, VA, USA - April 14, 2022 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and corporate clients, announced today the release of the latest version of the all-in-one digital forensic solution, Oxygen Forensic® Detective v.14.4. This version solidifies Oxygen’s leadership in cloud forensics, expands support for Huawei devices, and implements access to several new computer artifacts on both macOS and Windows devices.

Oxygen Forensics maintains its position as the industry’s leading supporter for cloud forensics with the addition of RunKeeper, a popular GPS fitness-tracking app. Investigators will now have the ability to extract, decrypt, analyze, and report extractions from over 100 supported cloud services. Oxygen Forensics doesn’t stop there. With improvements to extraction support for existing cloud services like Mi Fit, MEGA, and others, Oxygen Forensic® Detective v.14.4 demonstrates its dedication to providing users with the most up-to-date cloud extraction capabilities possible.

In mobile forensics, Oxygen Forensic® Detective v.14.4 offers various updates to increase and improve support for mobile data extractions. Most notably, a new Kirin 820 chipset has been added, giving investigators access to more screen-locked Huawei devices. Next, using the enhanced OxyAgent tool, investigators now have the ability to extract large datasets from Wickr Pro. With access to contacts, private chats, rooms, and calls, these datasets will allow investigators to develop comprehensive insights into the device user’s communications.

Oxygen Forensic® Detective v.14.4 also presents significant advancements in the import and analysis of computer artifacts by introducing support for macOS Time Machine backups and Windows Volume Shadow Copy. With this release, investigators will be able to peak backward in time into what was on the computer, even if the user has since erased it. Furthermore, the extracted computer backups can be imported into Oxygen Forensic® Detective for decryption and analysis.

While speaking with Oxygen Forensics CEO, Lee Reiber, we asked about Oxygen’s milestone of 100 supported cloud services, making them the first and only digital forensic solution provider to support over 100 cloud services. He stated, “The days of relying on a single source of digital data have passed. By allowing access to critical computer artifacts our customers see the entire digital picture when multiple digital sources are collected and analyzed.” Oxygen Forensics once again exceeded expectations with the release of their latest update and with advancements in the extraction and analysis of mobile devices, cloud, and computer artifacts.

For a full list of 14.4 updates, click here.

read more



Alexandria, VA, USA - February 17, 2022 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and corporate clients, announced today the release of the latest version to the all-in-one digital forensic solution, Oxygen Forensic® Detective v.14.3. This version presents significant improvements to extraction support, advanced searching options, and sets an industry record for most supported cloud services.

Oxygen Forensic® Detective v.14.3 now supports devices using Kirin 985 chipsets. This includes various Huawei devices, such as Honor 30, Huawei nova 7 5G, Huawei nova 7 Pro 5G, and others. Using the Huawei extraction method, users will have the ability to bypass screen locks, extract data, and decrypt it for further investigation in the Oxygen Forensic Detective® analytic suite.

To further expand extraction support, version 14.3 implements increased full file system support for both Apple and Android devices. For Apple devices, investigators will now be able to use the checkm8 method to extract the full file system from devices running iOS 15. For Android, version 14.3 adds a new method, which permits extraction of the full file system from devices based on several Qualcomm chipsets.

Oxygen Forensic® Detective v.14.3 introduces a new, more robust method for investigators to search for critical data - Hex lists. Building on the current hexadecimal search, investigators can now build a list that contains multiple hex sequences that can be used for live searches or even during pre-processing of images during import. This powerful search method will allow investigators to search for and identify unique files often not parsed by standard tools. With this addition, investigators will have six avenues to discover data: keywords, keyword list, regular expression, hash value, facial recognition, hex and hex lists.

Version 14.3 breaks new barriers in cloud forensics. With the addition of Mi Fit, Oxygen Forensics has surpassed 100 supported cloud services. This sustains their dominant position as the leading supporter of cloud services in the industry. Investigators will now have the ability to extract vast amounts of unique cloud data from 100 services. Additionally, this update implements support the WhatsApp QR multi-device feature, which will allow users to extract chats, contacts, and missed calls with a simple scan of a QR code.

Oxygen Forensic® Detective v.14.3 marks the first release of 2022 for Oxygen Forensics. We spoke with COO, Lee Reiber, regarding the importance of this release. He stated, “Continuously increasing extraction support is a requirement in this industry, but other critical needs are often overlooked. Digital forensic investigators not only need to have access to as many devices as possible, but advanced methods to search for and recover unique evidence types. That’s why, with every release, we not only increase our number of supported devices but bring unrivaled innovation and capabilities to uncovering the needle in the digital haystack.”

Oxygen Forensics starts the year strong with the release of this new update. With improved extraction capabilities, an advanced search function, and a place as the industry leader in cloud support, Oxygen Forensic® Detective v.14.3 sets a lasting precedent for 2022.

For a full list of 14.3 updates, click here.

read more



Alexandria, VA - December 14, 2021 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and corporate clients, announced today the release of Oxygen Forensic® Detective v.14.2, the latest update to the all-in-one digital forensic solution. This version presents several improvements to extraction capabilities, increases support for popular VPN applications, and adds a new analytic feature.

Oxygen Forensic® Detective v.14.2 expands support for Huawei devices by now allowing data extraction for the latest Huawei Kirin devices running Android OS 9 and 10. With new enhancements in the extraction process, investigators will now be able to recover passwords while Oxygen Forensic® Detective extracts hardware keys, providing them the opportunity to brute force the device when it was previously unavailable.

Version 14.2 also simplifies the iTunes backup method utilized for logical data extractions of unlocked Apple iOS devices. With Oxygen Forensic® Detective v.14.2, investigators can use any version of iTunes to perform logical extractions, whether it's downloaded from the official website or the Microsoft store. Furthermore, given the vast amounts of data found in today's devices, Oxygen Forensics has given investigators the ability to select where to store extractions, in turn ensuring success while saving large datasets.

In this update, Oxygen Forensics focuses on adding support for popular VPN applications, often used by criminals to secure privacy during unlawful activity. Oxygen Forensic® Detective v.14.2 implements support for apps like CyberGhost VPN, ZenMate VPN, Express VPN, NordVPN, and RusVPN, as well as apps like Clubhouse, AnonChat, and others. With this release, Oxygen Forensic® Detective exceeds 25,800 supported apps.

This version introduces Selective Data Analysis, the latest time-saving feature from Oxygen Forensic® Detective. Selective Data Analysis gives investigators the ability to import only the data they wish to parse and analyze, eliminating the need to import data unrelated to a specific investigation, while also limiting the scope of an investigation. To minimize extraction time, investigators can pair this tool with Oxygen Forensic® Detective's Selective Data Extraction feature, allowing users to extract data from only specific apps, instead of an entire device.

With the year coming to a close, we spoke with COO, Lee Reiber, regarding the significance of this release and what allows Oxygen Forensics to continue the exponential growth we've witnessed throughout the past decade. He stated, "Without continual updates, forward-thinking, and tremendous team members, a company in this space will not last. Oxygen has been delivering products and services to our customers with unmatched consistency and innovation for over 20 years. Our 14.2 release is just a reflection of that hard work and dedication to the industry."

Oxygen Forensics continues to reach new heights and set precedents in the industry. With a clear plan on what it takes to keep moving forward, it seems that this is just the start for Oxygen Forensics.

For a full list of 14.2 updates, click here.

read more



Alexandria, VA - October 26, 2021 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and corporate clients, announced today the release of the latest version to their all-in-one forensic solution, Oxygen Forensic® Detective. With new screen lock bypass methods, support for new apps, and upgrades to multiple existing tools, this release ultimately grants investigators more access to secured data.

Oxygen Forensic® Detective v.14.1 now allows investigators to bypass screen locks on multiple supported LG devices based on Qualcomm chipsets. Investigators will no longer need a PIN or password to access device data. With this update and use of LG Advanced Flash mode, users will be able to create physical dumps, extract hardware keys, and decrypt evidence from various locked LG devices.

In app support, a wide selection of secure apps have been added to the Oxygen Forensics catalog, which now spans to 659 supported unique apps. Oxygen Forensic® Detective v.14.1 introduces support for Crypto Wallet, Brave Private Browser, Private Photo Vault Pro, ProtonMail, and more. Many of the apps included in this release are designed for encrypted messaging and data storage - often used by individuals looking to hide or conceal evidence. With version 14.1, investigators will have direct access to acquire data individuals do not want them to find.

Additionally, Oxygen Forensic® Detective v.14.1 improves support for private messenger, Wickr Me, and user-controlled end-to-end encrypted cloud storage app, Mega. Using the enhanced OxyAgent tool in Oxygen Forensic® Detective v.14.1, investigators can extract contacts, private chats, group chats, attachments, and calls from Wickr Me. For the encrypted cloud storage app, MEGA, users now have the ability to acquire evidence using our Oxygen Forensic® Cloud Extractor, giving investigators access to cloud data.

In this release, Oxygen Forensics focused their efforts on increasing support for encrypted apps and services, often used to conceal and store incriminating information. We spoke with Oxygen Forensics COO, Lee Reiber, on this decision. He stated, “Staying one step ahead of the bad guys is hard enough for today's digital experts. We strive to produce solutions to bridge the gap and even the DFIR playing field for our customers.”

It is clear that the direction of innovation at Oxygen Forensics is led strongly by experience, research, and our customers. With new extraction methods, apps, and upgraded tools, Oxygen Forensic® Detective v.14.1 is another impressive release.

For a full list of 14.1 updates, click here.

read more



Alexandria, VA - September 14, 2021 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and corporate clients, announced today the release of the latest version to their all-inclusive digital forensic solution, Oxygen Forensic® Detective v.14.0. This update offers several major enhancements, improves data access, allows custom password dictionaries, adds new extraction methods, and introduces a new feature to improve data analysis among multiple extractions.

Oxygen Forensic® Detective v.14.0 has introduced a new, but familiar, extraction method. The APK downgrade method gives investigators increased access to app data on unlocked Android devices running Android versions 5-11. As a result, investigators will be able to acquire Android OS backups containing the data from downgraded apps, as well as import them into Oxygen Forensic® Detective for further analysis. This method supports over 45 popular apps, including WhatsApp, Tinder, Instagram, and Facebook.

Investigators also now have the option to create and import custom password dictionaries to use in brute-force attacks with a new module, Passwords Manager. These dictionaries can serve as a supplement to the existing password dictionaries, increasing the chances of success in a brute-force attack.

There is never a shortage of roadblocks when attempting to acquire data from an app or device. Whether it’s unknown login credentials, a compatibility issue, or network limitations, it’s always beneficial to have alternative methods of acquisition. With this update, Oxygen Forensics enhances Telegram extractions by adding another way to acquire data. By utilizing OxyAgent logical extractions, investigators can now access Telegram data like contacts, chats, channels, calls, and more.

Oxygen Forensic® Detective v.14.0 also presents a major breakthrough in data analysis. Investigators can now merge multiple extractions using the “Merge Extractions” tool. This is often necessary when evidence is extracted using several different extraction methods. Whether case evidence is acquired from a SIM card, a backup, a mobile device, a cloud service, or via OxyAgent, it can now be merged and analyzed together.

This update stands out relative to other releases earlier this year with some of the most significant enhancements in terms of extraction capabilities, app support, and data access. We spoke with Oxygen Forensics COO, Lee Reiber, regarding the importance of this release, and he stated “With our continued focus on bringing the most comprehensive and powerful digital solution to the DFIR community to help make this world safer, we again show how Oxygen continues to excel with the most robust feature set in the industry.” Oxygen Forensics continues to reach new heights. With the improvements and new features presented in this update, we only have to look forward to what Oxygen Forensics will do next.

For a full list of 14.0 updates, click here.

read more



Alexandria, VA - July 29, 2021 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and corporate clients, announced today the release of the latest version to their all-inclusive, flagship software, Oxygen Forensic® Detective v.13.7. This update presents significant improvements to the Oxygen Forensic® Cloud Extractor and KeyScout, an additional Device and Case Description field, and new extraction methods for multiple apps.

Oxygen Forensic® Detective v.13.7 brings various enhancements to some of Oxygen Forensics’ most utilized tools, the Oxygen Forensic® Cloud Extractor and KeyScout. Most notable for the powerful Cloud Extractor is the added ability to extract Discord data by simply scanning a QR code with the subject of interest’s phone, making it the fastest and easiest way to acquire app data.

In regards to KeyScout, Oxygen Forensics enhanced this cutting-edge tool to support the Deflate64 format, which enables investigators to import images created by the KAPE utility. Additional KeyScout improvements include updated support for Telegram Desktop, improved parsing of Jump Lists and extraction of LNK files, added ability to extract passwords saved in Microsoft Edge and more.

With the new option to create and add descriptions to cases and devices, investigators can easily make their investigations more informative and organized by adding custom fields. Currently, users have the option to add the following fields to case descriptions - case date, case location, case number, case type, examiner, investigator, organization, and now, they may create their own.

Oftentimes, messengers are where investigators find the most critical evidence. To ensure investigators have access to Viber data, Oxygen Forensics adds OxyAgent logical extractions to their Oxygen Forensic® Detective extraction catalog. Impressively, Viber has accrued about 260 million active monthly users, most of which reside in Eastern Europe, Russia, Middle East, and Asia. This update allows investigators to acquire Viber data from any unlocked Android device by using the Oxygen Forensic® OxyAgent. Investigators will be able to acquire account information, contacts, calls, private chats, and group chats.

Oxygen Forensic Detective v.13.7 provides investigators the opportunity to take their investigations to the next level. With enhancements to app support, extraction, parsing, and export capabilities, the digital forensic leader delivers yet another versatile software update.

For a full list of 13.7 updates, click here.

read more



Alexandria, VA - June 3, 2021 - Oxygen Forensics, a global leader in digital forensic solutions, kicks off the 3rd quarter with yet another release of their all-inclusive forensic platform, Oxygen Forensic® Detective. The update introduces support for several new apps and services such as Ring, Mega, and GroupMe Cloud. Improvements were also made to existing features like passcode brute force and Huawei support.

Oxygen Forensic® Detective v.13.6 grants investigators complete access to data from the popular home security service, Ring LLC. Ring’s top product is currently the Ring Video Doorbell, a motion-activated smart device capable of capturing audio and video. Ring video data can be viewed live or played back in the Ring mobile app. With this update, investigators can extract Ring data from mobile devices, computers, and the cloud. Datasets include video recordings, snapshots, account information, location details, connected devices, event history, and much more. Other newly supported applications include Google Admin, Marco Polo, Huawei Browser, Mi Browser, Samsung Notes, and Mega.

For years, Oxygen Forensics has supported more cloud services than any other digital forensic solution in the industry. That continues to hold true with this release, as they present support for GroupMe Cloud, a popular messaging app with almost 11 million registered users. Investigators will now have the ability to extract evidence from a GroupMe account using credentials from GroupMe, Microsoft, Google, or Facebook as well as a token extracted from a mobile device. Investigators will have access to account details, contacts, events, private chats, group chats, and more.

Given that Oxygen’s specialty is mobile forensics, the release of a new update wouldn’t be complete without enhancing support for Huawei/Honor devices. Oxygen Forensic® Detective v.13.6 provides full support for Huawei/Honor devices, allowing them to bypass screen locks for devices using File-Based Encryption and based on the following Qualcomm chipsets: MSM8917, MSM8937, MSM8940, and MSM8953. Supported models include Honor 7A (AUM-L29), Huawei Y6 (2018), Mediapad M3 Lite 8, and others.

Oxygen Forensics continues to push themselves to acquire new apps and services that are timely and relevant to investigators in the industry, oftentimes implementing tools investigators don’t realize they need yet. In an interview, we asked Oxygen Forensics COO, Lee Reiber, to speak on this. He stated, ”Being proactive and staying ahead of the curve is no longer a goal but an expectation for us. Our job is to provide investigators with the tools they need to get their job done right, and providing innovative tools doesn’t do much good, if they’re not there when they need them.” Overall, Oxygen Forensic Detective v.13.6 is another significant step for Oxygen Forensics.

The full list of 13.6 updates can be found here.

read more


Oxygen Forensics Emphasizes Strengths in Mobile Forensics with New Release

Alexandria, VA - April 29, 2021 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and corporate clients, announced today the release of the latest version to their all-in-one forensic solution, Oxygen Forensic® Detective. Oxygen Forensics is recognized in the industry for their focus and specialty in mobile forensics. Their new update, Oxygen Forensic® Detective v.13.5, presents mobile enhancements that allow acquisition from new devices, access to more secure data and improve the rate and functionality of deleted record recovery.

With the latest update, Oxygen Forensics expands their catalogue by adding full file-system extraction capabilities for Samsung Exynos devices running Android OS v.9 and 10. In total, this method will now permit investigators to perform full-file system extractions for Samsung Exynos devices running Android OS versions 7 through 10. Furthermore, investigators will have access to the Samsung Secure Folder and all included data. The Samsung Secure Folder is a secure location within a Samsung device that enables users to store private data.

In addition to Samsung Secure Folder, Oxygen Forensics has also implemented support for Huawei Private Space, a hidden storage space within the device that can only be accessed using a fingerprint or password. However, Oxygen Forensic® Detective v.13.5 now grants investigators the ability to acquire and decrypt data from this secure location. Given Huawei PrivateSpace’s security, it is likely to contain valuable and sensitive evidence.

Deleted Record Recovery has been part of Oxygen’s arsenal for years now, however, the improvements included in this new release are worth noting. A new SQLite data recovery framework has been implemented. The new framework was developed bearing in mind all the weaknesses of previous SQLite Viewer data recovery architecture. With Oxygen Forensic® Detective v.13.5, Deleted Record Recovery is up to ten times faster and utilizes less RAM memory and CPU resources. Investigators will now be able to continue working within Oxygen Forensic® Detective while the data recovery takes place, a small but significant feat.

Oxygen Forensics continues to roll out advancements that are timely and relevant to their users. We asked COO, Lee Reiber, about how their development team navigates the direction of innovation. He explained that, “Our continual focus is on our customer and how to bring a positive change to their investigative experience. From allowing access to the newest mobile devices, cloud services and computer artifacts to parsing and decoding valuable evidence, we continue to lead the way. On top of that, our release cycle and feature enhancements are unprecedented in this competitive industry.” With regular releases and frequent software updates, Oxygen Forensics continues to demonstrate that there is no replacement, no shortcut, for genuine innovation and product development.

The full list of 13.5 updates can be found here.

read more


Oxygen Forensics continues momentum with new release

Alexandria, VA - March 23, 2021 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and corporate clients, announced today the release of the latest version to their all-in-one forensic solution, Oxygen Forensic® Detective. With long-awaited features, improved user functionality, increased customization in exports, Oxygen Forensics continues the momentum they’ve been building since the tail end of last year.

Oxygen Forensic® Detective v.13.4 marks the return of the long-awaited hashing capability for image imports. Discontinued during a previous software update, this tool is now back with an extra feature. All hash values will be automatically saved under the notes section of the software after hashing is complete. We asked COO, Lee Reiber, about the importance of hash files in investigations. “Conducting an investigation that can be reproduced is a foundational requirement in today’s digital forensic landscape. Having and maintaining a digital fingerprint of the original piece of evidence should be an essential part of any investigation.” said COO, Lee Reiber, when asked about the importance of hashes. When called upon, an investigator can demonstrate case integrity with the display of the computed hash values of each piece of evidence as well as each hashed file contained in the case. Furthermore, investigators can now export to .txt or .csv from the built-in hash sets manager to share the sets with other investigators.

When it comes time to export, investigators will now have the ability to customize their reports even more than before. This update allows users to set time intervals for data exports. Previous versions of Oxygen Forensic® Detective gave investigators the ability to specify one or more date ranges for exports. With this update, reports can be filtered to include data that fits into the specified date and time settings. Reports will denote which date and time intervals the exported data is from. Building on the export capabilities and large data sets, the ability to now process files concurrently revolutionizes the creation and compilation of large reports.

After 21 years in the industry, Oxygen Forensic® Detective has accrued support for over 30,000 devices. All are now listed and can be searched using various filters, including vendor, SoC, OS, or name within the robust interface. Now the newly added devices supporting Samsung Exynos and Huawei Kirin can easily be located using filters and even a search bar. With the addition of Discord, TikTok, Lime, and Bird to the app parsing section, their leadership in today’s forensic market is clearly shown.

The full list of 13.4 updates can be found here.

read more


Oxygen Forensics Wastes No Time Introducing Cutting-Edge Features in Latest Release

Alexandria, VA - February 9, 2021 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal agencies, and corporate clients, announced today the release of the latest version to their all-in-one forensic solution, Oxygen Forensic® Detective. With new extraction methods, access to geodata from millions of networks worldwide, and added Face Search capabilities, Oxygen Forensics wastes no time introducing cutting-edge new features with this release.

Oxygen Forensic® Detective v.13.3 takes significant steps in expanding extraction support by implementing two new extraction methods. Through password brute force and data extraction, the new “Sony MTK Dump” extraction method enables investigators to bypass screen locks and create full physical dumps of Sony devices based on MTK chipsets. This update also offers a new physical extraction method for Android devices based on Qualcomm chipsets. Investigators will now be able to apply a built-in exploit to gain root rights and perform a physical acquisition, only if the device is unlocked and with the appropriate Security Patch Level.

To further equip investigators, Oxygen Forensics added support for WiGLE, a database used to compile geodata from wireless networks all around the world. With access to 43 million networks worldwide, investigators will now have the ability to acquire critical geolocation information, such as point coordinates, channels, access point name, last updated time, addresses, and more. Considering the importance of geodata in investigations, the inclusion of this feature will surely aid many investigators.

Oxygen Forensic® Detective v.13.3 continues to take the previously introduced Facial Categorization engine to the next level by adding Face Search capabilities. This will allow investigators to search and locate images of specific faces by uploading their own unique set of reference photos. Once the search is complete, Oxygen Forensic® Detective will display a description listing percent similarity, age, sex, race, emotion, and source file.

With a historic year behind them, Oxygen Forensics appears to have continued its momentum into the new year. When asked what the digital forensics community could expect in the upcoming year, COO Lee Reiber said, “We are focusing on the needs of our customers and the rapidly changing digital landscape. We will continue to bring innovative features that assist today’s investigators in the only all-in-one solution on the market. From mobile devices to wearables and computer artifacts to cloud services, we have you covered.”

It is clear that Oxygen Forensics is working hard to exceed the expectation of its customers. With multiple groundbreaking releases under their belt, the upcoming year is looking promising for Oxygen Forensics, Inc.

The full list of 13.3 updates can be found here.

read more


Oxygen Forensics Saves the Best for Last as They Roll Out their Final Release of 2020

Alexandria, VA - December 17, 2020 - The year is coming to a close, and just when you thought Oxygen Forensics was finished, they release yet another cutting-edge update for their all-in-one forensic solution, Oxygen Forensic® Detective. With an enhanced Facial and Image Categorization engine, increased support for Samsung backups, and an improved OxyAgent utility, it’s no wonder Oxygen Forensics couldn’t wait to release this update.

Oxygen Forensic® Detective v.13.2 introduces some of the most notable advancements Oxygen Forensics has made this year. To start, the enhanced capabilities of their Facial Categorization to identify faces wearing not only sunglasses and hats, but masks, was critical, considering that over 90% of Americans claim to wear masks today when leaving the house, according to a poll conducted by National Geographic in early October. In addition, Oxygen Forensics implemented two new categories to their Image Categorization feature – Maps and QR/Barcodes. With alcohol, weapons, vehicles, drugs, nudity, extremism, chats, and others, this brings the total number of image categories to 16.

To further increase user access to Samsung data, Oxygen Forensics added import capabilities for Samsung’s own Smart Switch backups. Oxygen Forensic® Detective v.13.2 gives investigators the ability to import, decrypt, and parse data from this utility, often used to transfer content between Samsung Galaxy devices. This will give investigators access to even more data than the standard ADB backup. Smart Switch backups will include call logs, contacts, SMS/MMS, Samsung Web Browser data, Wi-Fi connections, and app data. The addition of Samsung Smart Switch backups considerably expands Oxygen’s catalog of supported Samsung devices. With this update, Oxygen Forensic® Detective will now support screen lock bypass for Samsung Exynos devices, as well as cloud extraction of Samsung backups, Samsung Secure Folder, and Samsung Cloud data.

To add even more functional support, Oxygen made two key improvements to their OxyAgent utility. First, they gave investigators the ability to extract all apk files. This data is great for gaining quick insights into what apps were installed on an Android device while also identifying possible malware. Second, investigators can now extract essential information regarding the device’s file system, such as file name, creation and modification date, size, and path. For devices with root rights, OxyAgent will extract information about the file’s access, making it even easier for investigators to locate suspicious files by hash sets.

Considering the significant advancements made in Oxygen Forensic® Detective v.13.2 and the timing of this release, it’s clear Oxygen Forensics wished to leave nothing on the table as they rounded off their second decade in the industry.

This past year has truly demonstrated the resilience and dedication Oxygen Forensics has to providing their customers with the cutting-edge tools and world class service they’ve come to expect, no matter the circumstance. When asked what kept his team motivated during a time of change and uncertainty, COO Lee Reiber responded, “We understand that the creation of a product for the digital forensic community is not to simply sell licenses. It is to provide solutions that can save lives, make investigations clearer, faster, and more efficient; while also delivering unique training instruction worldwide, both online and in person. Success at this level is what keeps our great team working at full steam all year.”

As they close this quarter with an impressive year behind them, it’s looking like Oxygen Forensics is eagerly waiting to hit the ground running in 2021.

The full list of 13.2 updates can be found here.

read more


With the release of Oxygen Forensic® Detective 13.1, Oxygen show no signs of slowing innovation

Alexandria, VA - November 10, 2020 – As Oxygen Forensics nears the end of their 20th year in the industry, the digital forensic leader displays no signs of slowing innovation. Their active focus on providing law enforcement, federal, and corporate clients all around the globe with the most innovative mobile forensic toolset has allowed them to not only sustain their growth but establish trust and credibility within the digital forensic, incident response community.

Today, Oxygen Forensics announced the release of the latest version of their flagship software, powered by JetEngine, Oxygen Forensic® Detective v.13.1. Oxygen Forensics is recognized for continuously expanding their product line with every release. Oxygen Forensic Detective v.13.1 continues this trend by introducing several new features and enhancing functionality for multiple existing features.

To further enhance its mobile support, Oxygen Forensics has updated data parsing for several applications, including WhatsApp, Elyments, JioBrowser, Zalo and GroupMe. Oxygen Forensic Detective v.13.1 also achieves full support for Signal Messenger by introducing an additional method of extraction for the encrypted messaging app. Previous versions of the software allowed users to extract Signal data from an Apple iOS full file system, Android physical dumps, as well as Windows, macOS, and Linux computers. Now, with the use of the updated and enhanced OxyAgent, investigators will have the ability to extract account details, contacts, calls, and chats from Android devices.

With this release, the number of unique cloud services supported by the built-in Oxygen Forensic Cloud Extractor reaches 88, making it the industry’s leading solution for cloud data extraction. This release introduces two new services to the software, SecMail and Firefox Browser. With SecMail, investigators will have access to datasets including account information, contacts, and emails. With FireFox Browser, investigators can acquire evidence involving web history, saved login credentials, bookmarks, opened tabs, and installed addons.

As if that weren’t enough, Oxygen Forensics uses the opportunity of this release to improve their Oxygen Forensic KeyScout. Investigators will now have the ability to collect more computer artifacts than ever before. The upgraded KeyScout will allow extraction of all available user data from OneDrive, Slack, and Evernote apps running on Windows and macOS computers to support investigators’ mobile and cloud examinations. Additionally, users can now extract several new operating system artifacts, including Recent Items, detailed information regarding files and folders in the Recycle Bin, and, lastly, the history of WinRAR operations on Windows OS.

The release of Oxygen Forensic Detective v.13.1 proves something significant for the digital forensic provider and that is the reliability and consistency of their innovation. When asked about the secret behind Oxygen Forensics’ steady growth, COO Lee Reiber said, “With a clear vision of the road ahead, transparency, and support for our customers, along with innovative technological advances, Oxygen will continue to rise as the premiere investigative tool for mobile, cloud, and IoT devices. We are just getting warmed up”. In this industry, security is everything, and this type of assurance is affirming.

In a time when many organizations have seen decelerated progress or have even experienced diminishing returns, Oxygen Forensics once again proves themselves as a leader in the digital forensics, incident response community and shows no signs of slowing.

The full list of 13.1 updates can be found here.

read more


Oxygen Forensics Continues to Prove Themself as the Industry's Go To Forensic Solution

Alexandria, VA - September 22, 2020 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal, and corporate clients, announced today the release of Oxygen Forensic® Detective v.13.0, powered by JetEngine, the company’s flagship software. The release introduces features that increase efficiency by implementing innovative solutions for law enforcement and investigators in the digital forensic, incident response community.

This release introduces full physical extraction capabilities for many of the most popular Samsung smartphone devices. With years of prominence and a global market share of over 19%, Samsung has been a significant player in the smartphone industry for decades. Thus, support for these devices was a necessity. Oxygen Forensic Detective 13.0 gives investigators the ability to bypass screen locks, perform physical acquisitions, and decrypt data from Samsung devices based on Exynos chipsets. Oxygen Forensics COO, Lee Reiber, says,” Having the ability to access the data within today’s most popular devices was a must. Our R&D team has been working overtime to bring this support to our valuable customers across the world with the goal of making the world a safer place.” Oxygen Forensics proves just that with this release.

The new extraction functionality is available for Samsung devices running Android OS 7, 8, and 9 and supports 76 device models. If that was not enough, Oxygen Forensics added the ability to allow users to request support for any unsupported Samsung model, continuing the advancement of its physical bypass capabilities and furthering support for its customers. With this release, Oxygen Forensics’ screen lock bypass support extends to 5 chipsets, including Kirin, MediaTEK, Qualcomm, Spreadtrum, and Exynos.

Version 13.0 also presents significant developments in data analytics, all with the purpose of optimizing the user’s investigative workload. The included Optical Character Recognition, or OCR, feature relieves investigators of the burden of manually transcribing text found in photos or screenshots by automatically identifying words within an image and converting them into machine-encoded text. All image files containing text information will automatically be sent to the OCR section for easier access. In addition, the user can select any image in the Files section and send it to the OCR for further analysis. This powerful addition will now allow investigators to conduct keyword searches across all processed imagery to find text evidence that can often be overlooked.

For Oxygen Forensics, a consistent output of innovative features, along with support for new devices, are the keys to their continued progression as the industry’s all-in-one digital forensic solution. The company’s close relationship with the digital forensic community and the first-rate support for their customers is what separates them from the growing list of forensic providers.

When asked about Oxygen Forensics’ relationship with its customers, Lee Reiber stated, “By listening to our customers on a daily basis we understand the critical dynamic of today’s digital forensic investigative cycle and continually deliver a product that supports that mission.” Each release recurrently grows and expands their product line, and Oxygen Forensic Detective v.13.0 is no exception. With additional cloud service support, advanced searching, and innovative reporting capabilities, Oxygen Forensics is in a league of their own.

A full list of updated for the 13.0 software can be found here.

read more


Oxygen Forensics Adds Time Saving Features in New Release

Alexandria, VA - June 9, 2020Oxygen Forensics, a global leader in digital forensics for law enforcement, federal, and corporate clients, announced today the release of Oxygen Forensic® Detective v.12.5, Powered by JetEngine, the company’s flagship software. This release introduces features that will increase efficiency by implementing alternative solutions for law enforcement and licensed investigators, allowing them to save valuable time during extractions, imports, and searches.

Oxygen Forensic® Detective v.12.5 provides users with an extraction method which allows them to extract data from only the applications they choose. Users no longer have to wait for a full file system extraction to access a specific set of data. If an investigator knows the data he’s searching for is hidden in Twitter or Discord, the data can be extracted from just those applications. The new Selective Extraction method in Oxygen Forensic® Detective 12.5 provides a list of 15 of the most popular apps today, including WhatsApp Messenger, Telegram, and TikTok. Research has shown that phone users spend 89% of their screen time on the limited number of apps. We have compiled these apps into a list which gives users the opportunity to conduct a faster, more focused extraction. Users can select up to 15 applications from the list, and if you’re in the position where you don’t know where to start your search, this might be a good launching point. This list will be constantly growing.

With this update, Oxygen Forensics has taken the opportunity to improve OxyAgent utility for their users. Oxygen Forensic® Detective offers a variety of extraction methods for Android devices, including screen lock bypass, device rooting, and, of course, logical acquisitions via OxyAgent. OxyAgent gives investigators the ability to recover basic evidence sets from every supported Android device, and Oxygen Forensic® Detective 12.5 has notably enhanced these capabilities. Users can now conduct extractions via Wi-Fi network, allowing them to avoid setbacks caused by faulty connection or USB ports. Users can also select data categories for extractions, as well as create screenshots of Android device data using OxyAgent.

“Oxygen Forensics is committed to delivering industry-leading capabilities and functionality for law enforcement and other licensed investigators,” said Lee Reiber, COO of Oxygen Forensics. “Technology is constantly evolving, and it’s important that we give our customers the tools they need to keep pace with that rapid evolution.”

In addition, Oxygen Forensic® Detective has added search capabilities during backup imports. Oxygen Forensic Detective supports more than 30 devices and backup images. With the new version of Oxygen Forensic Detective, investigators can configure the data search criteria in the Import Wizard while importing a backup. The search criteria include text, keywords, hash sets, regular expressions, file names, and lastly, file content. Once the import is complete, users can view the search results within the Search section.

The Oxygen Forensic Detective suite of tools is available to previously vetted and appropriately licensed law enforcement organizations. The tool is also available to private customers for investigations and corporate in-house analysis. A full list of updated for the 12.5 software can be found  here.

read more


Oxygen Forensics Delivers Enhanced Functionality, Streamlined Design with New Release

Alexandria, VA - May 6, 2020Oxygen Forensics, a global leader in digital forensics for law enforcement, federal, and corporate clients, has announced the release of Oxygen Forensic® Detective (12.4), Powered by JetEngine, the company’s flagship software. The latest release includes several new features and introduces a simplified user interface and enhanced functionality for many of the software’s most essential tools. In total, the new release extends device support to over 36,000 unique devices, including 500 new Android devices. This version also provides app support for more than 500 new app versions across both Android and Apple iOS, ensuring that users have everything they need to contend with an ever-shifting technological landscape.

Oxygen Forensic® Detective 12.4 delivers several new features, including MTK Android device rooting, a new method of physical extraction that serves as a useful alternative to the already available MTK Android dump method. Where the MTK Android dump method allows users to bypass both screen lock and disk encryption (either software or hardware) to extract a complete and decrypted physical dump, the new method enhances support for Android devices based on Mediatek chipset by enabling physical extraction via rooting. MTK Android device rooting is compatible with over 80% of Android devices that are based on Mediatek arm64 chipset and have a security patch level of March 1, 2020 or older.

Other new features include an updated Oxygen Forensic® Cloud Extractor, an all-new Statistics section, and a newly designed File Viewer for SQLite database analysis. The updated Oxygen Forensic® Cloud Extractor now enables users to perform data extraction from Skype, with authorization supported via Skype credentials, phone number, Microsoft credentials, or Microsoft token extracted from Apple iOS and Android devices. Meanwhile, the new Statistics section represents a significant expansion of Oxygen Forensic® Detective’s analytical toolset, providing a comprehensive analysis of user activity with helpful statistical data organized into a variety of easy-to-use widgets. The newly designed File Viewer makes the process of working with SQLite databases even more convenient, delivering versatile functionality and impressive processing power that is several times faster than the built-in Oxygen Forensic® SQLite Viewer.

In addition to new features, the Oxygen Forensic® Detective 12.4 release also brings a streamlined and efficient new design to well-established software components like the Import Wizard and augments other established components with new capabilities. Updates to the Import Wizard present users with a new, simplified interface for backup import that enables users to configure data import much more thoroughly and precisely. The revamped Oxygen Forensic® KeyScout can now collect and automatically decrypt data from the secure Signal Messenger on Windows, macOS, and Linux computers—expanding upon preexisting support for Apple iOS and Android devices.

“Looking at the breadth and depth of the additions we’ve made to Oxygen Forensic® Detective with this latest release, it’s easy to see why our software is still the most powerful and robust digital forensics solution on the market,” said Lee Reiber, COO of Oxygen Forensics. “We’ve always been committed to ensuring that our users have everything they need to get the job done under any circumstances, and it shows. The fact is that no other digital forensics software offers anywhere near the same variety in terms of technical capability, device compatibility, or—thanks to JetEngine—sheer power.”

Oxygen Forensic® Detective 12.4 also allows users to import and parse Snapchat Warrant Returns, provides updated support for Google Mail service in the wake of the recent Google communication protocol change, and an enhanced ability to extract contacts, device list, email addresses, and more from Huawei Cloud. The Oxygen Forensic Detective suite of tools is available to previously vetted and appropriately licensed law enforcement organizations.

A full list of updates for the 12.4 software can be found here.

read more


Oxygen Forensics Adds Exclusive Huawei Device Capabilities with New Release

Alexandria, VA - April 1, 2020Oxygen Forensics, a global leader in digital forensics for law enforcement, federal, and corporate clients, today announced the release of Oxygen Forensic Detective (12.3), Powered by JetEngine, the company’s flagship software. In addition to providing customers with a number of powerful new features, the release also makes Oxygen Forensic® Detective the first and only digital forensics platform to offer physical bypass support for Huawei devices running Android OS 10.

Oxygen Forensic® Detective 12.3 provides users with the ability to bypass screen lock, perform a physical acquisition, and decrypt data from Huawei devices running Android OS 9 and 10. Support for physical bypass of Huawei devices running Android OS 10 is exclusive to Oxygen Forensics, with no other forensics software currently offering the state-of-the-art functionality. The new capability extends to more than 50 of the latest Huawei devices, including the Huawei Honor 20, the Huawei Honor Magic 2 3D, the Huawei Honor 10 Premium (GT), and the Huawei Honor Note 10.

"Oxygen Forensics is committed to delivering industry-leading capabilities and functionality for law enforcement and other licensed investigators," said Lee Reiber, COO of Oxygen Forensics. "Technology is constantly evolving, and it's important that we give our customers the tools they need to keep pace with that rapid evolution. With this latest update, we're proud to offer a slew of exciting new features, and to stake our claim as the very first digital forensics software provider to deliver physical bypass functionality for Huawei devices running Android OS 10."

In addition to its industry exclusive Huawei device functionality, the Oxygen Forensic® Detective 12.3 update also includes secure chats decryption in several Apple iOS messenger apps, including Signal, Wickr Me, Facebook and ChatSecure. Updates to the Oxygen Forensic® Detective enables investigators to collect a host of new artifacts on macOS, including Apple Messages (comprising contacts, Apple Photos, SMS/MMS, iMessages, and their attachments), Apple Notes and Apple Reminders. The updated Oxygen Forensic® KeyScout can also detect and decrypt passwords saved in Google Chrome v.80 and Mozilla Firefox v.75 web browsers, which can be immediately put to use for cloud data extraction.

Oxygen Forensic® Detective 12.3 also enhances the built-in Oxygen Forensic® Cloud Extractor with extraction capabilities for Slack, enabling investigators to collect evidence from the popular productivity and messaging app. Additional updates to Oxygen Forensic® Cloud Extractor include substantial advancements to algorithms designed for WhatsApp extraction and decryption.

The new updates represent significant steps forward in the ongoing evolution of the Oxygen Forensic® Detective platform, and reflect the company's commitment to continual innovation and improvement of its product offerings. The Oxygen Forensic Detective suite of tools is available to previously vetted and appropriately licensed law enforcement organizations.

A full list of updates for the 12.3 software can be found here.

read more


Oxygen Forensics Introduces Partnership with Latent Wireless and announces Oxygen Forensics Detective 12.2 update

Alexandria, VA - February 18, 2020 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal, and corporate clients, today announced versions 12.2 updates to Oxygen Forensics Detective, Powered by JetEngine, the company’s flagship software. This release offers new features that increase functionality for law enforcement and other licensed investigators, assisting them in their mission to make the world safer and protect those who need help.

With this update, Oxygen Forensics introduces a partnership with Latent Wireless, the only software tool available that enables law enforcement to leverage Wi-Fi device signatures as evidence. Available exclusively to law enforcement, Latent Wireless provides investigators with additional avenues to collect evidence through the identification of physical locations of Wi-Fi networks, seamlessly integrated with Oxygen Forensics Detective to generate even deeper granularity when tracking the movements of potential suspects or stolen property.

“I’ve been a law enforcement officer for over twenty years, and this was a tool I wish I had, but wasn’t developed—so at Latent Wireless, we built it. I want to get law enforcement the tools and information they need to efficiently conduct investigations and solve crimes,” said David Schwindt, CEO of Latent Wireless. “By connecting our product with Oxygen Forensics Detective, understanding the physical location of Wi-Fi networks that relevant devices have been connected to happens behind the scenes, seamlessly and easily. It’s a perfect partnership.

Version 12.2 also adds integration with information stemming from warrants from social media companies like Facebook and Instagram, while providing critical enhancements to full file system extractions.

Investigators will now be able to import warrant returned data from both Instagram and Facebook to parse and decode the data, giving investigators a complete view of the case—including any relevant mobile and cloud information—in Oxygen Forensic Detective, Oxygen Forensics’ all-in-one solution.

“We are consistently adding new functionalities and engaging in new partnerships to give our customers the absolute best, all-in-one digital forensics solution, bar none,” said Lee Reiber, COO at Oxygen Forensics. “Every day, the Oxygen Forensics team comes to work with a real sense of responsibility: to help good people make the world a safer place. When we can add new features to our software, we know we are equipping investigators with the tools they need to do just that.

”Additional functionality includes allowing investigators to extract a full file system (iOS) and valuable keychain information from Apple devices without knowing the password. This is done using Oxygen Forensic Detective’s unparalleled ability to quickly parse and decode the vast amounts of data necessary to ensure the viability of such an extraction. 12.2 also builds on Oxygen Forensics Detective’s physical Android OS extraction capabilities, with its ability to obtain root privileges on Android devices running version 7 and newer. With data from apps, cloud services, and the device itself, Oxygen Forensics Detective remains the cutting-edge, leading product for digital and mobile forensics, making our world safer.The Oxygen Forensic Detective suite of tools is available to previously vetted and appropriately licensed law enforcement organizations. The tool is also available to private customers for investigations and corporate in-house analysis. A full list of updates for the 12.2 software can be found here.

read more


Oxygen Forensics Releases Cutting-Edge Integration to Categorize Images and Unveils TamTam Messenger Cloud Extraction

Alexandria, VA - December 5, 2019 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal, and corporate clients, today announced their flagship software, Oxygen Forensic Detective 12.1, Powered by JetEngine, will bring image categorization and grouping, allowing investigators to use AI to sort and categorize images into twelve categories, including drugs, weapons, alcohol, and nudity, to more quickly find pertinent images to an investigation. The latest update also includes TamTam Messenger extraction capabilities, following the breaking news that as of early December 2019, it is suspected TamTam is the new, preferred communication service for ISIS supporters. Now Oxygen Forensic Detective 12.1, Powered by JetEngine, will allow investigators to extract chats,calls, contacts, and other information from the TamTam cloud.
The image categorization innovative implementation further bolsters Oxygen Forensics with a best-in-class object recognition software, and comes on the heels of incorporating facial recognition technology earlier this year. TamTam data extraction, along with object and facial recognition and many other robust features are included in Oxygen Forensic Detective12.1, Powered by JetEngine with no fees or add-on costs, continuing the software’s reputation as the number one, all-in-one digital forensic solution. The newly added TamTam data extraction gives investigators combatting terrorismthe ability to obtain data from ISIS’s newly preferred communication platform, ensuring national and international law enforcement entities have all the tools they need. This quick and robust addition to the full, digital forensics suite demonstrates Oxygen Forensics’ unparalleled speed and efficacy in adding new features investigators of all kinds need.
“Imagine law enforcement officers on scene, having eye witness reports of a red van in a robbery. Now, with the image categorization integration, investigators can seamlessly and quickly sort through thousands of images to find the red van. It doesn’t stop there—guns, nudity, drug paraphernalia—investigators can easily sort images to get what they need for all types of investigations,” said Lee Reiber, COO of Oxygen Forensics. “We also added TamTam data extraction almost immediately after we found out that’s the preferred platform for ISIS supporters. Our goal every day is to bring law enforcement and corporate investigators the single most comprehensive digital forensics tool out there, with no additional costs, and sometimes that means a fast turnaround to add new features so investigators can stay ahead of criminals and terrorists. I’m confident Oxygen Forensics Detective continues to be second to none.”
The twelve, base categories of images also include extremism, graphic violence, and more, drastically speeding up criminal investigations and internal corporate audits while reducing case backlog. The average person has over 600 photos on their phone and there areover 230 million smartphones in the United States alone, meaning the amount of digital data in an average criminal or corporate investigation is staggering and speed remains one of the most crucial factors for success. Oxygen Forensic Detective12.1, Powered by JetEngine remains the undisputed digital forensics software.
The Oxygen Forensic Detective Suite is available to previously vetted and appropriately licensed law enforcement organizations. The suite is also available to private customers for investigations and corporate in-house analysis.

read more


Oxygen Forensics Launches Oxygen Forensic Detective 12.0 - Powered by JetEngine

Alexandria, VA - October 8, 2019 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal, and corporate clients, today announced the release of Oxygen Forensic Detective 12.0, Powered by JetEngine. The new release completely overhauls the program’s interface, giving Oxygen Forensics’ flagship software a new look and feel—including a multi-tab interface to seamlessly handle multiple extractions—while retaining full functionality and ease of use. The redesign is coupled with several back-end improvements that will increase the speed of Oxygen Forensic Detective’s data processing and decoding capabilities threefold.

With this latest update, Oxygen Forensics becomes the first mobile forensic company to allow full utilization of system resources (RAM, processors) to parse and decode data. Oxygen Forensic Detective 12.0 now gives investigators the ability to view files taken from multiple devices simultaneously, allowing for deeper analysis. It also greatly expands device and cloud storage system compatibility, enabling users to extract data from all new sources, including the vast majority of popular cloud services available on the market today.

Thanks to first-in-industry partnerships with organizations like RankOne and their continued partnership with Passware and others, Oxygen Forensic Detective 12.0 gives users enhanced image and video processing, categorization, and analysis capabilities—including best-in-class facial recognition and clustering software. With these advances, the software takes its place as the most powerful, all-in-one, turnkey mobile forensics platform on the market, no add-ons required.

“At Oxygen Forensics, we pride ourselves on providing our customers with the tools, resources, and support they need to extract data from hundreds of devices and thousands of applications. Now they will be able to do things faster than ever—more than three times as fast as our previous edition—with a new, easy-to-use interface,” said Lee Reiber, COO of Oxygen Forensics. “We’ve expanded our capabilities to include a bevy of new devices, apps, and cloud providers that are becoming increasingly popular, and which will soon dominate the world of digital data storage. And all of this is included: No add-ons, no extra fees, no packages. Oxygen Forensic Detective 12.0 is the undisputed all-in-one digital forensics software on the market.

”Oxygen Forensic Detective 12.0 now allows for the extraction of data from dozens of new devices, providing detailed, built-in analytics for them all. Users will be able to extract password tokens, images, contacts, geolocational data, attachments, calendars, phone call logs, device activity, and other data from LinkedIn (over 500 million users), Reliance JioPhone and JioCloud (serving over 320 million subscribers), Viber Cloud (over one billion registered users), KaiOS (operating on 100 million devices in 100 countries), and more.

The Oxygen Forensic Detective Suite is available to previously vetted and appropriately licensed law enforcement organizations. The suite is also available to private customers for investigations and corporate in-house analysis.

read more


Oxygen Forensics Announces Partnership with Rank One Computing

Myrtle Beach, SC - June 4, 2019 - Today, Oxygen Forensics, a leading global provider of digital forensic investigation software to law enforcement, government, and enterprise organizations, announced its strategic partnership with Rank One Computing, a leading provider of facial recognition and biometrics technology.

Rank One’s facial recognition technology will be integrated into the Oxygen Forensics Detective solution as an included component for users to capture and analyze image and video data. Just as mobile devices, apps, and cloud services have already proven invaluable in modern criminal investigations, so too will facial recognition capabilities. Rank One is unique in its speed and accuracy thanks to a proprietary algorithm, and its software is already used by some of the country’s largest police departments.

 “Rank One is a perfect complement to our product, which can interact with and extract vital data from over 27,000 unique devices, most of which are equipped with cameras and produce copious visual data”, says Lee Reiber, COO of Oxygen Forensics. “The potential forinvestigators will be endless. They’ll spend less time looking throughthousands of photos or videos on a single device and be better equipped toanalyze the aggregated visual data from hundreds of devices, which is sometimes necessary during large-scale incidents to identify suspects.”

 “Oxygen Forensics’ platform is everything we’re looking for in a turnkey product partnership, because of the high computational workload required by their application, and the propensity to produce facial analysis insights that are meaningful and improve their user’s workflow. Our efficient and accurate face recognition engine coupled with their legacy of success in digital forensics makes for a highly compelling investigative tool,” says Brendan Klare, CEO of Rank One Computing.

 Rank One’s facial recognition component will be integrated into Oxygen Forensic Detective software and updated regularly at no additional cost to customers.

About Oxygen Forensics, Inc.:

Oxygen Forensics, Inc., is a leading global provider of software for digital forensic investigations involving mobile devices, drones, and cloud data. The company’s flagship software, Oxygen Forensic® Detective, enables law enforcement, and enterprise organizations around the world to extract and examine data from thousands of device types and applications to build thorough digital evidence cases for legal and forensic proceedings.



Ian Martorana

read more


Oxygen Forensics Launches New Version of Detective with Improvements to Cloud Extractor, KeyScout, and JetEngine

Alexandria, VA - May 28, 2019 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal, and corporate clients, today announces the release of Oxygen Forensic® Detective 11.4, with improvements to its Cloud Extractor, KeyScout, and JetEngine utilities, including the ability to extract web browser data from Windows PCs.

Oxygen Forensic KeyScout adds the new ability to extract complete web browser data from Windows PCs. When launched on the target computer, KeyScout will collect complete browsing history, saved bookmarks, autofill data, and cookies. 

The collected data can be imported,  parsed, and analyzed within Oxygen Forensic® JetEngine. This innovative feature will help investigators with PC internet artifact discovery in addition to mobile, to round out the digital forensics ecosystem.

“Oxygen Forensics is committed to constantly updating and improving the solutions our customers need to keep the world safe,” Lee Reiber, COO of Oxygen Forensics, said. “The Oxygen Forensic® Detective 11.4 version adds capabilities and functionality that are unmatched in the digital forensics industry, and now, our customers will be able to extract complete browsing history and more from browsers including Google Chrome, Mozilla Firefox, and Microsoft Edge running on Windows computers.”

Oxygen Forensic® Detective 11.4 offers the ability within Cloud Extractor to obtain account information, trusted devices, logins, passwords, tokens and other data from iCloud Keychain, as well as the ability to extract account information, contacts, chats and calls from Wickr Me via password or token. Wickr Me is one of the many instant messaging apps that allows users to exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file attachments and place end-to-end encrypted video conference calls.

Also, with this new version, Oxygen Forensic® JetEngine adds the ability to import and parse Parrot drone flight logs and Parrot physical dumps, which is a continuation of Oxygen Forensics’ effort to address today’s most unrealized threat—unmanned aircraft systems.

Oxygen Forensics regularly innovates and improves its offering because investigators need every valuable artifact from every available source in today’s criminal and corporate investigations.

read more


Oxygen Forensics Announces New Director of Training Hire

Alexandria, VA - April 16, 2019 - Today, Oxygen Forensics, a leading global provider of digital forensic investigation software to law enforcement, government and enterprise organizations, announced the hire of digital forensics expert, Keith Lockhart as its Director of Training.

 Lockhart previously served as Vice President of Strategic Programs for AccessData Group for 15 years, leading digital forensics training solutions for Local, State, Federal and International Law Enforcement agencies as well as worldwide corporate entities and law-firms involved in the prevention, investigation, and prosecution of high-technology crime.

 “We are thrilled to welcome Keith, a former law enforcement officer and expert in the digital forensics industry to Oxygen Forensics as our new Director of Training,” says Lee Reiber, COO of Oxygen Forensics. “Keith is a world-renowned trainer, bringing two decades of experience in digital forensics, e-Discovery, decryption, incident response, mobile device collection, and analysis to the company. His stellar background in training and bold ideas for the future will ensure that Oxygen Forensics clients have the best curriculum and resources in the industry for years to come.”

 Lockhart is a member of the High Technology Crime Investigation Association (HTCIA) and has served as the Director of Training and President for the International Association of Computer Investigative Specialists (IACIS) – from which he obtained Certification as a Forensic Computer Examiner. He has instructed at the FBI National Academy, the United States Secret Service, the Dutch National Police Academy, the National Center for Police Excellence in the United Kingdom, the London Metropolitan Police Anti-Terrorist Branch, the Canadian Police College, Australian Federal Police Headquarters and presents regularly for numerous law enforcement agencies and public / private sector organizations around the world.

 “I am proud to join Oxygen Forensics as it continues keeping the world safe by providing law enforcement, federal and corporate clients’ with cutting edge solutions to their toughest digital forensics needs,” says Keith Lockhart, Oxygen Forensics’ incoming Director of Training “As a former law enforcement officer, I know first hand the value add that Oxygen Forensics products bring to law enforcement officers across the country. This company is at the forefront of the mobile data forensics industry and it is my honor to join it as we transition to the next phase of mobile and data innovation.”

 As Oxygen Forensics Director of Training, Lockhart will be responsible for building a forward-looking training program for the company’s wide array of law enforcement, federal and corporate clients. He will be tasked with ensuring the company's training infrastructure remains ahead of technologies and trends in the market. 

read more


Oxygen Forensics Launches Industry Exclusive Drone Update

Alexandria, VA - April 2, 2019 - Oxygen Forensics, a global leader in digital forensics for law enforcement, federal, and corporate clients, today becomes the sole company in the industry to offer complete flight history extraction from my MyParrot cloud with the release of Oxygen Forensic Detective (11.3).

“Oxygen Forensics continues to ensure our customers have the solutions they need to keep the world safe,” Lee Reiber, COO of Oxygen Forensics, said. “Oxygen Forensic Detective 11.3 update will set the tone for the industry by offering full data access to the world’s second-leading drone, Parrot. As recreational drones grow in popularity, so will the need for our customers to access critical data on those devices. While our previous update (11.2) allowed users to import and parse Parrot’s flight logs extracted from an installed mobile app or a drone physical dump, 11.3 brings an industry exclusive ability to extract complete flight history from MyParrot cloud.”

Drone use presents unprecedented threats to national security, citizen privacy, and public safety. Evidence extracted from MyParrot cloud is extensive and includes information about the account, general information about the flight, and detailed flight history with metadata like speed, altitude, battery level, and more. Currently, this cloud method provides drone forensics experts with the most comprehensive flight history from Parrot drones on the market.

Oxygen Forensic Detective 11.3 offers access to MyParrot cloud via login/password or token entered in Oxygen Forensic Cloud Extractor. Oxygen Forensics’ KeyScout utility can detect a login and password if they were entered in a web browser on a computer. Oxygen Forensic Detective also automatically finds a token to MyParrot cloud in the installed FreeFlight Pro app in Apple iOS and Android devices.

Oxygen Forensic Detective now parses all available drone data from FreeFlight 6 mobile app from Apple iOS and Android devices.

read more


Oxygen Forensics introduces advanced support for Parrot drones and exclusively uncovers BlaBlaCar trips

Alexandria, VA – Feb. 13, 2019 – Oxygen Forensics, a leading global provider of digital forensic investigation software for government, law enforcement, and enterprise organizations, has released an update to its flagship product, Oxygen Forensic® Detective, introducing advanced features to support Parrot drone flight logs extracted from either an installed mobile app and even a physical dump along with the exclusive ability to extract and parse BlaBlaCar and CoverMe data.

The new release offers extraction of Apple Health data from the cloud account via login/password  or token and the ability to collectively analyze file systems from several extractions in a single view within Oxygen Forensics’ JetEngine.


“Keeping the world safe should be the subtitle of this release” says Lee Reiber, COO of Oxygen Forensics.  “With our continued innovation and support of the newest technologies being encountered by our customers daily we have risen to the challenge once again.  In 11.2 we released the first support for BlaBlaCar, a world-wide ridesharing program, as well as CoverMe, and app used to conceal data, often for nefarious reasons, along with unique support for Parrot drones and health apps.”  “Listening to our customers, and their operational needs, will continue to be a priority for us.  This commitment is what sets us apart in a growing industry”

Headlines around the world during the recent months have highlighted the growing danger caused by recreational drones. The Gatwick drone issue that grounded all the flights for several days is a good example of it. Oxygen Forensic Detective had previously released support for data parsing from FreeFlight Pro, the official piloting mobile app for Parrot drones. However, the new version now delivers the ability to import and parse Parrot’s flight logs. Now investigators can view geo coordinates containing timestamps along with metadata that includes: altitude, velocity, ground speed, Wi-Fi signal, battery level, current satellite numbers, and more. The extracted flight history can be visualized with our built-in Oxygen Maps. The ability to import DJI drone logs has been an included feature in Oxygen Forensic Detective, but with this release our JetEngine module will also support these valuable logs. Investigators now will be able to import DJI log flight logs and parse additional technical data, like drone acceleration, gyroscope and temperature details to name a few.

Oxygen Forensic® Detective Version 11.2 Update Highlights

·         The industry’s only method to extract data from BlaBlaCar via login/password and token.

·         Apple Health data extraction via login/password or token.

·         Additional data extraction from Telegram including calls, polls, bot messages and albums.

·         Ability to analyze and visualize the flight data of Parrot drones including the following models: Anafi, Bebop, Bebop 2 and Disco.

·         Decryption of physical dumps with the known password for Android devices based on Qualcomm Snapdragon MSM8909 chipset.

·         Significantly Improved EDL screen lock bypass method by identification of the device via chipset, not model.


read more


New Oxygen Forensics updates put one of the world’s fastest, most comprehensive digital forensic platforms in the hands of investigators

ALEXANDRIA, Va. – Dec. 6, 2018 – Oxygen Forensics, a global provider of digital forensic investigation software to law enforcement, government and enterprise organizations, introduced today an update to its product enabling forensic investigators to process and examine large volumes of data at record speed. The update, which includes a new module called Oxygen Forensic® JetEngine, not only makes Oxygen Forensic® Detective 11.1 one of the most comprehensive analysis tools on the market for examining data from mobile devices, cloud services, drones and IoT devices, but also one of the fastest in the world.

While smartphones represent the handheld key to an individual’s digital identity and activity, only a small portion of the data collected about a person is stored on the phone itself. Complemented by various network devices such as laptops, drones, health trackers and connected home assistants, and powered by cloud services, the amount of data about an individual relevant to an investigation grows exponentially over time.

“Analyzing a dozen or more cell phones from different individuals can lead to quite a volume of data – not just from the phones alone, but also from online data and accounts associated with the phones,” noted Bryan Neumeister, a court-certified forensic expert and CEO of USA Forensic. “JetEngine has given us the ability to bulk-download information from various websites and backup files and incorporate that into a case database quickly and effortlessly.”

The JetEngine module enables users to remove processing memory limitations by expanding or upgrading the hardware used in extracting and processing data. Many advanced forensic labs leverage multi-core processors or multiple configurations to examine many devices and accounts at once as part of one or more investigations. Now, these investigators can take full advantage of these hardware components by removing limitations of the software.

Lee Reiber, chief operating officer for Oxygen Forensics, commented, “Finding relevant evidence across multiple devices and accounts is already like finding a needle in a haystack and law enforcement officers face haystacks that grow bigger every day. We designed JetEngine specifically to help investigators tackle enormous amounts of data quickly and efficiently. For high-stakes criminal investigations such as murder cases and terrorist activity, cutting the time spent retrieving and sifting through data by 50 percent has the potential to save countless lives.”

Oxygen Forensic® JetEngine, along with several other new features including industry-exclusive support for Uber, Fitbit, Google Fit and Samsung Health, is available today for Oxygen Forensics customers to download and begin using. For more information regarding this update or Oxygen Forensic® Detective, visit

Oxygen Forensic® Detective Version 11.1 Update Highlights

  • Introducing Oxygen Forensic® JetEngine, a module enabling rapid parsing of large data sets 50% faster than competing platforms
  • Full support for extracting and examining cloud data from Fitbit, Google Fit and Samsung Health
  • Extract and examine data from Uber, including trip maps and driver details
  • Perform logical data extractions without a cable connection using an SD card (Android 4.0+)
  • Added support for more than 4,500 Android devices and 190 application versions
  • For full release update notes, visit our web site

read more


Oxygen Forensics enhances cloud and decryption capabilities

ALEXANDRIA, Va. – Oct. 11, 2018 – Oxygen Forensics, the D.C. area provider of software enabling law enforcement organizations to collect and examine evidence from digital devices, has released the latest version of its flagship product, Oxygen Forensic® Detective. The new set of features builds on 18 years of digital forensics capabilities to support the growing needs of investigators with expanded support for smartphones in addition to new tools to examine connected home devices, smartwatches, and encrypted cloud data when involved in criminal activity.

“Increasingly, the ‘eyes and ears’ of our personal digital networks – smartwatches, connected home devices, and other technologies that respond to our voices or movements – are the most reliable witnesses to a crime,” explained Lee Reiber, COO of Oxygen Forensics. “With this new version of Detective, we aim to empower investigators in solving their toughest cases using the most detailed data available by overcoming roadblocks and collecting more data from the central nervous system of these networks, the cloud.”

Headlines around the world during the recent years have highlighted the growing disparity between technology manufacturers and law enforcement, sparking debate regarding when and how data from smartphones and other devices can be secured for investigation. Similarly, law enforcement has been applauded for solving many high-profile crimes using data from these devices. Fitbit data retrieved through an Amazon Echo is currently being used in prosecution for the murder of Karen Navarra in San Jose, and the British government has begun pursuing organized crime rings through decryption of communications using WhatsApp.

Oxygen Forensic® Detective is leveraged by investigators in thousands of cases around the world to provide prosecutors with the digital evidence necessary to solve crimes like these and make the world a safer place. 

Oxygen Forensic® Detective Version 11.0 Update Highlights

  • Extract WhatsApp messages through the WhatsApp server using a QR code
  • Examine IoT connected home devices using Amazon Alexa and Google Assistant
  • Decrypt physical extractions of LG devices with brute force
  • Extract more than 30 different smartwatches using MediaTek chipsets
  • Discover additional authentication tokens on desktop using KeyScout
  • Updated DJI drone support for newest devices, as well as access to SkyPixel
  •  Acquire logical image of feature phones using MediaTek chips

read more


Oxygen Forensics now supports GrayKey iPhone extractions, enhanced analysis of Wi-Fi and Bluetooth connections

Alexandria, VA – Aug. 8, 2018 – Oxygen Forensics, a leadingglobal provider of digital forensic investigation software for government, law enforcement,and enterprise organizations, has released an update to its flagship product,Oxygen Forensic® Detective,introducing advanced features to support the extraction of data from lockedsmartphones, import of extractions performed from the popular GrayKey iPhonecracking software, and analysis of device logs including history of Bluetoothand Wi-Fi connections.

“If you’ve read any headlines lately aboutdigital forensics, then you’ve heard of GrayKey,” stated Lee Reiber, chiefoperating officer of the D.C. area-based software company. “The team atGrayshift has built a great product to help law enforcement organizations accesslocked iPhones for examination, and we’re excited to support customers usingthis tool with advanced analytics.”

Oxygen Forensics products offerinvestigators the ability to access and extract data from thousands ofsmartphones, drones, cloud accounts, and Internet of Things (IoT) components;however, many investigations in recent years have been limited by securityconstraints on Apple devices. GrayKey has caught the attention of investigatorsdue to its ability to work around these security constraints and grant accessto locked iPhones.

Oxygen Forensics customers who are usingits software to analyze data extracted from devices are now able to importdevice images from GrayKey to analyze the data and combine it with otherdigital evidence sources in their investigations.

OxygenForensic® Detective Version 10.4 Update Highlights

  • Decrypt WhatsAppbackup files using an account phone number or token
  • Import iOSimages extracted using GrayKey
  • Acquire partialimages of locked Samsung devices using MTP
  • Identify photoswith similar content using PhotoDNA hash sets
  • Extract Wi-Fihotspot access history with KeyScout
  • ExamineBluetooth connection history
  • AuthenticateGoogle services using 2FA with Google Prompt
  • Improved EDLmethod for extracting Qualcomm chip-based devices

read more


Oxygen Forensics adds support for Samsung Secure Folder and lock screen bypass enhancements

Alexandria, VA – May 31, 2018 - Oxygen Forensics, has released an update to its popular mobile forensic software allowing investigators exclusive access to mobile devices, applications, and cloud data not previously accessible through software solutions.

The company’s flagship software, Oxygen Forensic® Detective, enables investigators to access and extract data from thousands of mobile devices, applications, and storage locations to build stronger cases with digital evidence. The update to version 10.3, which most notably includes access to cloud backups of the Samsung Secure Folder and Viber messaging app, as well as expanded support in extracting from locked Android devices, will allow for more detailed investigations by law enforcement and government groups in legal proceedings.

“Our commitment to supporting digital investigations requires constant innovation to ensure we quickly deliver the most updated solutions to meet ever-evolving technological needs and supporting popular applications,” commented Lee Reiber, Oxygen Forensics COO. “The sooner law enforcement and organizations have access to these features, the sooner they can begin holding wrongdoers legally accountable for their actions.”

The Samsung Secure Folder represents one of many roadblocks investigators face when collecting digital evidence for a case. Users of supported Samsung devices may store files separately from the phone’s primary storage, allowing them to protect information with a separate set of security standards and access credentials. Oxygen Forensics’ software allows investigators exclusive access to backups of these protected files through cloud extraction to retrieve data relevant to a case.

Oxygen Forensic® Detective version 10.3 supports more than 7,000 smartphone and drone operating systems and applications – the most of any forensic software currently on the market – through both device physical extractions and cloud backup access. For more information on Oxygen Forensics or this software update, visit

Oxygen Forensic® Detective version 10.3 Update Highlights

  • Industry First: Extract cloud backup of Samsung Secure Folder, including account details, contact and calendar cards, Application Package Kit (APK) file, and document revisions
  • Industry First: Extract data from Viber messenger app backed up to iCloud or Google Cloud
  • New Oxygen Forensic® KeyScout utility enables investigators to locate and retrieve tokens and passwords from a device’s associated PC for use in mobile investigations
  • Bypass lock screen on more than 430 Android devices built with Qualcomm chipsets
  • Support for full physical extraction on more than 100 new Spreadtrum Android devices with storage over 4 GB
  • Support for more than 430 smartphone app updates

read more


Oxygen Forensics Introduces New Method of Decrypting WhatsApp Data With Release of Oxygen Forensic Detective 10.2

Alexandria, VA – May 8, 2018Oxygen Forensics is a worldwide developer and provider of advanced forensic data examination tools for mobile devices, cloud services and drones, announced today that Oxygen Forensic® Detective 10.2 can now acquire a WhatApp Cloud token from Android devices.

Two months ago, Oxygen Forensics announced Oxygen Forensic Detective 10.1 that featured the ability to help decrypt WhatsApp iCloud or Google backups with a token. If a key file that is required for backup decryption cannot be obtained, Oxygen Forensic Detective can create a WhatsApp authentication token and use it to decrypt backups stored within the iCloud and Google Cloud services.

Now, with Oxygen Forensic Detective 10.2, investigators can use a WhatApp Cloud token from an Androiddevice to decrypt WhatsApp backups from Android devices, WhatsApp Google Drive,as well as iCloud backups associated with the same phone number.

“Our product development team is constantly working on new features every single day,” said Lee Reiber, COO, Oxygen Forensics. “The new WhatsApp decryptionmethod leaves no digital trace and is a good alternative to the commonly used method with the key file. With this token, forensics experts can also acquire undelivered messages and unanswered calls directly from the WhatsApp Server, which can also help the investigators put the pieces together to solve crimes.”

read more


Oxygen Forensics Continues Leadership Position on Drone Forensics by Adding Physical Extraction from DJI Drones

Alexandria, VA – April 10, 2018 - Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices, cloud services and drones, announced today that its flagship software product, Oxygen Forensic® Detective v. 10.2, offers forensic detectives the industry-first ability to extract all information from a DJI drone with only a USB cable.

The new Oxygen Forensic® Detective v.10.2 allows forensics experts to connect the drone to their examination computer via USB cable and conduct a physical collection of the embedded storage chip. Once Oxygen Forensic® Detective recognizes the drone, a physical acquisition is available in only a few clicks that then reveals the drone’s complete flight history with GPS locations and metadata. This data includes valuable facts like speed, altitude, direction, and other evidentiary parameters. The drone flight path is then visualized in the built-in Oxygen Forensic® Maps (both online and offline) which gives a clear picture of where the drone has traveled.

“The number of recreational drones being used around the world is growing at an incredibly fast pace,” said Lee Reiber, COO, Oxygen Forensics. “It should come as no surprise that we’ll see the number of crimes involving drones also increasing exponentially. It has become essential for digital forensic experts to have a tool that combines automated extraction, parsing and analysis of drone data from all possible sources, and we’ve given our customers exactly that with more features expected in the weeks and months to come.”

In addition to the new ability to extract data with the physical drone and a USB cable, Oxygen Forensic® Detective (in version 10.1) also allows experts to extract drone data from DJI cloud, critical when the drone is damaged or cannot be acquired. With Oxygen Forensic® Cloud Extractor, forensics experts can analyze the user account information, the list of drones connected to this account, and the complete flight history of the drone(s), all from the DJI cloud.

Decryption of DJI Cloud Token

With Oxygen Forensic® Detective v.10.2, forensics experts can extract and decrypt the DJI cloud token directly from a mobile device (Apple iOS and Android) when the DJI GO or DJI GO 4 app is installed. A decrypted DJI token is shown in the Cloud Accounts section of Oxygen Forensic® Detective. The token is then used to access DJI cloud with just one click to reveal and extract the drone flight history. By using the token, experts leave no digital trace. DJI token extraction from a mobile device makes it possible to acquire all the vital drone information, even without the drone itself.

read more


Oxygen Forensics Doubles Down on Drone Forensics by Providing Industry-Exclusive Support for DJI Cloud

Alexandria, VA – March 01, 2018 - Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices, cloud services and drones, announced today that its flagship software product, Oxygen Forensic® Detective v. 10.1 can now obtain data from the DJI cloud, which is the data repository for all DJI drones. Oxygen Forensics does this through Oxygen Forensic® Cloud Extractor.

With almost a million registered drones in the United States alone and much more all over the world, drones take pictures and video and even can transport packages. Law enforcement continues to review methods to acquire data from drones that are involved in illegal activities, especially GPS location data such as altitude, direction of travel, speed, and facial recognition data that can reveal the flight data of the drone. This information is sometimes stored on the drone itself, but in the case of drones manufactured by DJI, this digital information is also stored in the DJI cloud.

“Gathering data from the DJI cloud is a feature exclusive to Oxygen Forensics. From the DJI cloud, we can obtain important data from a drone that crashed or was physically damaged,” said Lee Reiber, COO, Oxygen Forensics, Inc. “The DJI cloud is critical since it stores all the serial numbers of the drones associated with an account holder. If we can match serial numbers from the cloud to a specific device, then the authorities can find information about the owner of the drone.”

Oxygen Forensic® Detective is the only tool that allows forensics professionals the ability to extract and decode drone data from all possible sources: drones, the cloud and apps associated with drones. Drone data is transmitted and stored in either the user’s online account, the drone manufacturer’s cloud, or in some cases both locations. The additional data within the cloud represents a separate challenge for a mobile data forensics expert since manual extractions can be extremely complicated or just simply not possible for various reasons. With the use of Oxygen Forensic® Detective, experts are now able to access the drone cloud and extract the information about the account, the drone serial number, the flight history, and other associated metadata.

read more


Oxygen Forensics Works to Fight Domestic and International Child Exploitation; Partners with Project VIC

Alexandria, VA – January 25, 2018 - Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices, drones and cloud services, today announced that it is partnering and integrating its product and technology with Project VIC.

Project VIC is a coalition of law enforcement and private sector partners who champion a transformation in the approach to child exploitation investigations by developing innovative technologies and victim-centric methodologies. Law enforcement agencies worldwide use the technology developed by Project VIC’s partners in their pursuit rescue child victims, apprehend offenders and secure crime scenes. 

“Oxygen Forensics is committed to helping law enforcement fight child exploitation around the world, and we’re very proud of our partnership with Project VIC,” said Lee Reiber, COO, Oxygen Forensics, Inc. “Unfortunately, child exploitation happens all the time. Anything we can do to slow that down and bring those that abuse to justice is worth every ounce of effort we have as a company.”

Through Oxygen Forensics’ product functionality, users will be able to search child exploitation content by hash sets and other indicators via Project VIC as well as exporting extracted file information to the VIC-JSON format that is certified with Project VIC.

Mobile forensic experts can now download files from Project VIC’s extensive library of hash signatures and collaborate with the rest of the world on identifying if they have illegal or images of interest to the Global VIC Community. Any images found to be suspicious on seized mobile devices will be copied to the Project VIC section and classified according to the Project VIC Classification Standard

“Mobile devices have become weapons in the hands of individuals seeking to exploit our children,” said Richard Brown, Director of Project VIC. “Oxygen Forensics’ new technical capabilities will have a significant impact on efforts by law enforcement to rescue victims from abusers.”

read more


Oxygen Forensics Enjoys Double-Digit Growth in 2017

Alexandria, VA – Dec. 19, 2017 — Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices, drones and cloud services, today announced that it has seen double-digit growth in 2017 as it worked to increase its customer base with new customer additions in law enforcement, government and corporate spaces. Due to its growth, Oxygen relocated its headquarters in Alexandria, VA, and tripled the size of the office. 

Oxygen has seen double-digit to triple-digit growth year over year since 2013. This past year the company focused on strategic expansion that produced an exceptional growth-to-revenue ratio that positioned Oxygen Forensics well for the future. Due to the historic growth over the past four years, Oxygen needed to move its headquarters to a larger space to add a classroom, forensics lab and more sales and technical support space for the growing staff. 

“I am very excited for our corporate growth which led to the expansion of our training facilities worldwide, additional new certified trainer partnerships, and the increase of our valued resellers and distributors to better support our growing customer base,” said Lee Reiber, COO, Oxygen Forensics, Inc. 

“The reason I joined Oxygen was because of the tremendous growth potential in the digital forensics market,” said Tim O’Rourke, VP of Sales, Oxygen Forensics, Inc. “Oxygen not only has a product that is an industry leader, but also a team of people that cares deeply for our customers and for those people that our products and our customers assist.”

read more


Oxygen Forensics Adds Nearly 20 New Features to Launch Oxygen Forensic Detective X

Alexandria, VA – November 30, 2017 — Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices, drones and cloud services, today announced that it has added almost 20 new features in its flagship product Oxygen Forensic® Detective X (version 10). Among the features, Oxygen has made its industry-leading Oxygen Forensic® Cloud Extractor even faster by using 64-bit database processing power that speeds up the entire data extraction process. 

Oxygen Forensic Detective X enhances investigation abilities for forensic experts with the addition of these uniquely supported cloud services:

  • Mi Cloud - Xiaomi phones are growing in popularity. The Oxygen Forensic Cloud Extractor offers the industry-first ability to extract all available information from Mi Cloud via login/password or token including contacts, calls, messages, calendar and other personal data.
  • Samsung Cloud backup - Forensic experts can import and parse complete Samsung Cloud backups that can be accessed via login/password or token. Backups may contain contacts, calls, messages, calendars, files and Wi-Fi history.
  • Samsung Cloud Gallery – Added the ability to extract live, trashed and deleted photos, videos and documents from Samsung Cloud. This data also contains geographical locations so experts can track the whereabouts of the Samsung device owner.

As announced earlier this month, Oxygen Forensic Detective X also includes enhanced WhatsApp data extraction including WhatsApp backup decryption with 2-step verification and data extraction from the WhatsApp server. 

Other additions to Oxygen Forensic Detective X include unsupported apps parsing, drone support enhancements, selected physical extraction, screen lock bypass for Motorola devices, Huawei backups import ability (Detective X can find passwords for encrypted backups with the help of a built-in Passware module), predefined keyword list and an improved SQL editor. For an advanced explanation of all new features, please visit the Oxygen Forensic Detective X product page.

“We have been very excited to tell our customers and the world about all of the new additions to Oxygen Forensic Detective X,” said Lee Reiber, COO, Oxygen Forensics, Inc. “With our new cloud services additions, Oxygen now supports many cloud services, and we continue to lead the competition with two industry-first WhatsApp extraction capabilities. Our ability to keep providing new product improvements every single month speaks to the strength and determination of our entire product team as we help government, law enforcement and corporate forensics experts.”

read more


Oxygen Forensic Detective X Launches with New WhatsApp Extraction Features

Alexandria, VA – November 16, 2017 — Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices, cloud services and drones, today announced that its new flagship product, Oxygen Forensic® Detective X (version 10), which contains the industry- leading Oxygen Forensic® Cloud Extractor, has added new WhatsApp extraction features. 

Advanced WhatsApp Extractions 
Oxygen Forensic Detective X has added two industry-first features in the algorithm of WhatsApp data extraction, including:

  • WhatsApp backups decryption with 2-step verification - This verification is an optional feature that added to provide better security to the account. When enabled, any attempt to verify the phone number on a WhatsApp account needs to be accompanied by the six-digit PIN created by the user. The new Oxygen Forensic Cloud Extractor offers either the opportunity to enter the PIN (if it’s known) or several methods to deactivate it.
  • Unique WhatsApp data from the server - Oxygen Forensics has added a special WhatsApp Cloud service that allows forensics experts to acquire undelivered messages, unanswered calls and information about groups and contacts directly from the WhatsApp server. This service is useful in specific cases with damaged or locked devices. When forensic experts use the WhatsApp Cloud service, they can even obtain access to the WhatsApp server without the phone.

For a full list of WhatsApp extraction capabilities, please visit this link.

“Since the middle of this year, we’ve been able to decrypt WhatsApp backups from Google Drive without an encryption key from the device. For the Oxygen Forensic Detective X release, our team has been strategically focused on supporting investigations by continuing to provide industry firsts such as WhatsApp extractions,” said Lee Reiber, COO, Oxygen Forensics, Inc. “With Oxygen’s Cloud Extractor, we can now decrypt devices with 2-step verification, and acquire data from the WhatsApp server. Both were greatly needed to keep pace with 3rd party mobile apps – and are more industry firsts.”

read more