Digital forensic analytic tools are important for investigators due to the increasing use of computers and mobile devices by offenders when committing crimes.
Analytic tools are useful in helping put the pieces of a case together while providing an in-depth analysis and examination that can be used in court proceedings.
Oxygen Forensic® Detective Analytic Tools
At Oxygen Forensics we saw the benefit to investigators of providing software that not only offered the ability to extract data from digital devices but also provided analytic tools in the same software.
Ten years ago we introduced Timeline, our first analytic tool in Oxygen Forensic® Detective. Today, we offer 10 analytic tools at no additional cost. Let’s go through all of them.
- Timeline
- Social Graph
- Image Categorization
- Facial Categorization
- Maps
- Data Search
- Key Evidence
- OCR
- SQLite Viewer
- Statistics
1. Timeline
Our Timeline section provides a view of all device events in a single list. The Timeline tool allows investigators to view events, filter data, view geo coordinates, and track activity through the activity matrix.
Events
Events that are able to be viewed include:
- Chats within apps
- Calls
- Web activity
- Web connections
- Photos
- Videos
- Calendar Events
Events can be viewed for one device or a group of devices, allowing easy identification of common group activities.
Filter
Sort and filter by date, time, activity frequency, contact, remote party, or other data points to focus only on the most relevant data.
Geo Location
The Geo locations tab contains the full list of geo coordinates from all the sources that include photos, videos, apps, drone flight logs, and more.
Activity Matrix
In addition, the Activity matrix located in the bottom panel helps to detect when the device was most used.
Smart Filters
This feature is designed to make investigations more efficient and insightful by offering a variety of intuitive filters which helps narrow Timeline searches.
2. Social Graph
The built-in Social Graph provides a convenient platform to explore social connections between a device owner, contacts, or between devices.
Contacts
Using the Social Graph investigators can identify the device owners closest contacts in one click. Click on any contact to open a card containing detailed information about the selected contact and all communications across device sources.
Drag and Drop
The Social Graph interface is dynamic and agile. Investigators can drag and drop to move, hide, or merge contacts while producing a crystal clear view of device and case connections.
Define Contact Paths
It is also possible to define the shortest path between selected contacts (by default up to 5 intermediaries). That allows investigators to visually see that the device owner did not speak directly to someone, but spoke to a contact, who spoke to another, and then spoke to the identified target.
3. Image Categorization
Oxygen Forensic® Detective provides the ability to categorize images from different classes:
- Pornography
- Nudity
- Child abuse
- Extremism
- Drugs
- Alcohol
- Weapons
- Graphic violence
- Gambling
- Currency
- ID / Credit card
- Document
- Vehicles
- Chat
- QR /Barcodes
- Maps
- Tattoos
- Aircraft
Our image categorization is available when importing device data and also on already imported extractions.
Investigators can select all or selected categories while also having the ability to fine-tune the positive “hit” settings. After running the image analysis, the number of matching images for each supported category is tagged and shown in Key Evidence and in the Files sections. Investigators can review the tagged data and manually exclude any false positives.
4. Facial Categorization
Oxygen Forensic® Detective offers investigators the ability to categorize human faces.
The facial categorization is available in the Faces section. The unique features include:
- Detailed face analytics (gender, age, accessories)
- Detecting similar faces and “familiar with” people
- Multi-thread categorization using CPU and GPU
- Support for massive volumes of data
Using built-in facial recognition investigators will save valuable time when looking through thousands of photos or videos in mobile, cloud, or drone extractions.
5. Maps
Oxygen Forensic® Detective acquires geo coordinates from all possible sources including mobile devices, drones, cloud storage, media cards, and imported mages.
Once analyzed, the data can be viewed within our Oxygen Forensic® Maps, either online or offline.
The Maps module includes the ability to:
- Identify a device’s frequently visited places
- Pinpoint common locations of several devices
- Visualize a device’s movements within specific periods of time
- Play an animated route showing the direction of travel
6. Data Search
Oxygen Forensic® Detective allows investigators the option to search across a single device, all the devices in a case, or all devices in a database.
Investigators can search:
- Texts
- Phone numbers
- Email addresses
- Geo-coordinates
- IP addresses
- MAC addresses
- Credit card numbers
- File hashes including Project VIC
A “Regular Expression” library is available for custom search functions, and investigators can create a set of keywords or hex lists for a data search.
There is also an opportunity to create face sets from uploaded photos and search faces in extracted evidence.
Moreover, there are 4 ways how a search can be done: in parsed data, in files, in file metadata, and in file content such as SQLite databases.
7. Key Evidence
The Key Evidence section displays all records that have been bookmarked in other sections by the investigator. This section is where all entries identified as relevant to a case are found, making data analysis easier and saving valuable time.
Bookmark
Investigators can bookmark important evidence in a single device, or several devices, and export it later to one data report.
Tags
Oxygen Forensic® Detective also offers a number of predefined tags, including: Nudity, Weapon, Guns, Important, and several others.
Create Tags
Investigators can also create and set their own tags and export entries to data reports by simply selecting the relevant tags.
8. Optical Character Recognition
Optical Character Recognition (OCR) automatically identifies typed, handwritten, or printed text located within an image and converts it into machine-encoded text. Whether it’s from a scanned document, a photo of a document, a screenshot of a conversation, or an image with subtitles, we can convert it.
Using the built-in, automated OCR module, investigators can easily conduct searches for words located in images. This is done by converting images containing text to allow for recognizable searchable characters.
This feature is an incredible time-saver, as investigators no longer need to manually search image data for possible evidentiary material. The OCR tool becomes even more useful when dealing with large backups, taking little time to recognize and convert all text from images and screenshots on the device.
9. SQLite Viewer
The built-in Oxygen Forensic® SQLite Viewer is a powerful 64-bit tool for examining SQLite files.
With this tool, investigators can open any SQLite database, recover deleted records, convert values to a readable format, build visual and non-visual SQL queries, save them for further use, run a search, and export the selected entries to customized data reports.
10. Statistics
Oxygen Forensic® Detective offers investigators a new Statistics section that shows detailed statistics about the extraction:
- Activity chart
- Activity matrix
- Top 10 applications with the greatest number of communications
- Top 10 groups
- Top 10 contacts
- Last contacted
- Key Evidence with tags and notes.
Get more from Oxygen Forensic® Detective
At Oxygen Forensics our software is updated multiple times every year. We offer training courses and webinars that can help you learn the ins and outs of Oxygen Forensic® Detective and stay up to date on new features and tools needed for your investigation. Returning customer? Sign up for our newsletter to stay in the loop.
Don’t have Oxygen Forensic® Detective and want to try it out? Request a free-trial.