Oxygen Forensic® Detective v.17 Updates

We have added the ability to extract the physical image and hardware encryption keys from devices based on Unisoc/Spreadtrum chipsets SC9863,SC9832E and SC7731E released from 2020 onwards.

We have updated the ability to extract the following app data via Android Agent:

• Chrome browser
• Line
• Opera browser
• Signal
• Viber

You can now narrow down the extraction scope even more—choose specific Discord channels, private chats, or group chats to include.

The NOT IN operator has been added for rules with the ‘Hash Set’ and ‘Hash’ conditions on the Files tab. This makes it possible to find objects that are not part of the specified hash set or do not match the given hash. When the “NOT IN” operator is selected for hash sets, all files that are not included in the binary file containing the list of hashes (selected by the user when configuring the rule) will be found. For more detailed file searches, this rule can be combined with others (e.g., by specifying the file extension, signature, and more).

The following updated computer artifacts are supported for extraction:

• Telegram for macOS data from macOS
• Dropbox data from Windows
• iCloud Drive data from Windows and macOS

Oxygen Forensic^® Detective v.17.3.1 brings support for the following import types:

• UFED Advanced Logical extractions of iOS devices
• Physical dumps of Digma Optima 7 A101 3G, Fly Live Ace, Jinga Neon, ZTE Blade L8, and similar Unisoc/Spreadtrum devices based on the SC7731E chipset and manufactured in 2020 or later
• Physical dumps of Irbis TZ773 4G, Meizu C9, Black Fox B10, Itel A49, Rombica myPhone Jet, and similar Unisoc/Spreadtrum devices based on the SC9832E chipset and manufactured in 2020 or later
• Physical dumps of Doogee N10 and similar Unisoc/Spreadtrum devices based on the SC9863 chipset and manufactured in 2020 or later
• Physical dumps of Xiaomi Pocophone F1

Android devices may contain the Google Semantic Location artifact that stores detailed information about user’s movements, including precise locations and timestamps. Now this artifact is parsed in Oxygen Forensic^® Detective and shown in the Wireless Connections section.

Google Password Manager is a built-in password manager that saves, autofills, and synchronizes user credentials across devices via a Google account. This application data is now parsed in Oxygen Forensic^® Detective.

Search for specific cryptocurrencies has been implemented in the Cryptocurrency tab of the Search section. A drop-down menu has been added allowing users to select the cryptocurrencies for which they want to search. This will help reduce the number of false positives in cryptocurrency search.

We have added support for Albanian, Bosnian, Bulgarian, Gujarati, Marathi, Punjabi, Tamil, and Yoruba languages.

You can now restrict access to privileged data by protecting it with a password. This feature is especially useful when certain evidence must remain hidden from investigators due to legal or procedural constraints.

To enable password protection, click the Protection option in the upper right corner of the Device Information section or in the device context menu and set a password. For security reasons, forgotten passwords cannot be recovered.

Afterwards, in the software sections, you can select artifacts and use the ‘Protect with password’ option from the context menu to secure the selected items. Password protection will be applied after restarting the software.

When exporting, password-protected data is hidden in the final report. If needed, this data can be fully displayed in reports after entering the password on the Security tab of the Export Wizard.

We have added support for the following new languages: Catalan, Czech, Creole, Danish, Finnish, Greek, Indonesian, Japanese, Slovak, Swedish, Thai, and Swahili.

View all supported languages →

A new method for extracting data from feature phones based on Unisoc T117 and T107 chipsets has been implemented. Supported devices include Alcatel 3080G, Gigaset GLX8, MyPhone C1 LTE,  Nokia 225 4G 2020, Nokia 106 4G, Nokia 2660 Flip, Panasonic KX-TU550, UNIWA F249L, and many others.

View all supported mobile extraction methods →

We have added several enhancements for this method:

• Introduced a new method for extracting data from iOS devices via iOS Agent without installing or signing iOS Agent. Supported devices are:
  • iPhone 6s – iPhone 7 with iOS 15.2 – 15.8.4
  • iPhone 8 – iPhone X with iOS 15.2 – 16.7RC(20H18)
  • iPhone Xs – iPhone 15 with iOS 15.2 – 16.7RC(20H18), iOS 17.0
  • iPad A8/A8X with iPadOS 15.2 – 15.8.4
  • iPad A9 – A15, M1, M2 with iPadOS 15.2 – 16.7RC(20H18), iOS 17.0
• Implemented the ability to extract and decrypt Zoom data via iOS Agent.
• Added the ability to extract Element Messenger via Android Agent.

Learn more about Android Agent →

We have added the following enhancements to the checkm8 method:

• Extraction of full file system and keychain via checkm8 from iPad devices based on:
  • the A8X chipset and running iOS 12.0 — 15.8.4
  • the A10X chipset and running iOS 12.0 – 17.7.8
• Extraction of full file system and keychain via checkm8 from:
  • iPad 6th gen running iPad OS 17.0 – 17.7.8
  • iPad 7th gen running iPad OS 17.0 – 17.7.2
  • iPad Pro 10.5-inch running iPad OS 17.0 – 17.7.8
  • iPad Pro 12.9-inch 2nd gen running iPad OS 17.0 – 17.7.8

It is now possible to extract a Line backup stored in iCloud Drive using the Apple ID login and password.

The parsed data will contain:

• Contacts
• Private and group chats
• Private and group calls
• Notifications

We have added support for passcode brute force using the CPU. A driver must be installed to enable CPU-based password recovery. After that the list of available CPUs for running the password brute force attack will appear in the attack configuration window.

The following new computer artifacts are supported for extraction:

• Chat data from Windows, macOS, and GNU/Linux
• WinSCP data from Windows
• Notepad data from Windows 11
• Chromium browser, installed from the official website, from GNU/Linux

We have also added the ability to decrypt E01 images containing volumes that have multiple recovery key protectors. Moreover, performance improvements have been implemented to optimize data extraction and saving.

You can now enrich existing files in the software with supplementary data. A new Import Supplementary Data button has been added to the Files section of the toolbar, allowing you to upload CSV or TXT files with supplementary data. Each hash from the uploaded file is matched against the hashes in the extracted files. When a match is found, the related data is added to the corresponding file in the extraction. The information about supplementary data will appear in the right-hand sidebar and will also be included in data reports.

Telegram Desktop  allows users to export chats individually. Now this exported Telegram chats can be imported and parsed in Oxygen Forensic^® Detective. Data set will include contacts, chats, and polls.

Support for additional columns in AT&T Call Data Records has been implemented, including fields such as “Beamwidth,” “Sector,” ECGI, ENB-ID, LAC, and CID. Moreover, the display of cell towers, as well as beam and sector widths, has been implemented in the Maps module (accessible from both the CDR module and the standalone section).

Predefined templates have been added to simplify the processing of CDR data from the AT&T provider.

Updates to the Export engine include the ability to:

• Selectively export data to OFBR backups choosing specific sections, applications, and time ranges in the Custom export settings.
• Export communications in chat format from the contact card.

Now, specific applications can be selected when extracting the Full File System from Android devices,  eliminating the need and time required to extract all applications. This feature is currently available only when using the CVE-2024-31317 exploit.

We have added support for extracting encryption keys and decrypting user data for additional users on Android devices based on Qualcomm chipsets.

We have enhanced the Android Agent functionality, allowing data extraction from devices running Android OS 15.

The following new computer artifacts are supported for extraction:

• Passwords from Bitwarden Password Manager web extension used in Brave, Chromium, Google Chrome, Microsoft Edge, Opera, Vivaldi and Safari browsers from Windows, macOS and GNU/Linux
• Passwords from NordPass from Windows, macOS and GNU/Linux
• RustDesk data from Windows, macOS and GNU/Linux
• MetaMask web extension used in Brave, Brave Nightly, DuckDuckGo, Google Chrome, Microsoft Edge, Opera, Vivaldi browsers from Windows, macOS and GNU/Linux

Additionally, we have introduced the ability to recognize virtual machines on target desktop devices.

Introducing the ability to import single or multiple extractions of the same type via the command line. This ability can save time when importing multiple extractions into Oxygen Forensic^® Detective simultaneously and enables seamless integration with other solutions.

To use this feature, click CLI Demo in the Tools menu on the software Home screen to read the instructions and start using the feature. During the import configuration, you can set various parameters, such as selecting hash types, enabling or disabling analytics, recovering deleted data, and more.

Read more ⇾

You can now decrypt DJI Avata drone flight logs stored on the drone’s memory cards. Simply import the encrypted log into our software and follow the instructions.

Oxygen Forensic^® Detective now supports importing exported WhatsApp chats and parsing messages with attachments and shared contacts.

You can now perform speech and text recognition on files in the Messages, Applications, Timeline, and Files sections. Simply right-click a file in the grid and select “Speech and Text Recognition.” The recognized results will appear in the right panel.

Updates to the Export engine include the ability to:

• Exclude messages based on tags when exporting from the messages section.
• Export the Accounts and Passwords section data to JSON file format.

We have updated data extraction via Android Agent from Discord, Viber, and Zoom.

These updates include the abilities to:

• Authorize in Facebook and Discord
• Extract Huawei tokens from Android devices
• Extract workout data from Runtastic
• Connect the device to an external IP address via VPN when extracting iCloud data via iOS Agent (iCloud mode)

The following new computer artifacts are supported for extraction:

• A web version of Telegram used in Brave, Chromium, Firefox, Google Chrome, Microsoft Edge, Opera, Safari, and Vivaldi browsers from Windows, macOS, and GNU/Linux
• RPM Package Manager data from GNU/Linux
• Falkon browser data from Windows and GNU/Linux
• .DS_Store (Desktop Services Store) files from macOS

• Google Timeline data from Google Takeout that includes the information about visits, activities, memories, locations info, and Wi-Fi networks of the Google account
• Samsung Smart Switch backups of version 37 and later. If a backup is encrypted, a passcode can be brute forced in our software and used for decryption
• AT&T call data records in XSLX/CSV formats
• Memory card dumps in AD1 format
• Unencrypted DMG backups of iPhones devices

Recognized texts from the Optical Character Recognition (OCR) and Speech-to-Text engines can now be translated into all supported languages listed in the Speech and Text Recognition section. To translate recognized text, use the Translations button on the toolbar or right-click a selected entry to access the translation option.

Optical Character Recognition (OCR) and Automated Speech Transcription (AST) results are now seamlessly embedded within the Messages section, maintaining a natural conversation flow. Recognized text appears inline with messages, with clear indicators when OCR or AST processing is applied. The Details panel also includes recognition results for easy reference, improving accessibility, and usability.

Now you can search for cryptocurrency addresses in the Search section. The following cryptocurrencies are supported: Bitcoin (BTC), Bitcoin Cash (BCH), BNB (BNB), Cardano (ADA), Dogecoin (DOGE), Ethereum (ETH),  Litecoin (LTC), Monero (XMR), Polkadot (DOT), Solana (SOL), TRON (TRX), and XRP (XRP).

We have updated the offline Maps with the latest location information. You can download the new offline Maps from the Maps module.

Now automatic detection of connected devices is supported in Oxygen Forensic^® Detective. When Device Extractor is launched, the available information about a connected device will be shown along with the available methods of data extraction.

Automatic detection is supported for Android devices if ADB debugging is enabled and confirmed and for iOS devices with the confirmed Trust option.

Several enhancements have been made to this method:

• Added

support for recording audio during device screen video capture, so now both video and audio of on-screen activity are recorded.

• Added the new extraction mode in Device Extractor that guides users through the process of manual data extraction via Android Agent.
• Added the ability to extract Slack data via Android Agent.
• Added the ability to extract Telegram scheduled messages via Android Agent.

We’ve updated the ability to authorize in the following cloud services:

• Box
• Google
• Samsung Cloud Data
• Samsung Cloud Backup
• Samsung Secure Folder Backup
• Telegram
• Zoom

Now KeyDiver can find passcodes to decrypt:

• Containers and partitions protected with VeraCrypt
• Huawei HiSuite backups

We have also added support for NTLM hashes. This will allow users to find passwords for a Windows OS user account, allowing decryption of OS data and third-party applications connected with this password.

Users can now create custom attack templates. There are two methods for creating a template:

• Save the attack parameters as a template while configuring a new attack using the option on the right-hand sidebar.
• Create a template using the “Create New Template” button in the Template Manager.

The Settings window has been added. Users can enable or disable drivers (CUDA, HIP, OpenCL, Temperature Monitoring), manage the attack queue, set a temperature threshold, and adjust the desired performance. The selected settings will be saved and automatically applied to all current and subsequent attacks.

The following new computer artifacts are supported for extraction:

• NTLM hashes from Windows
• Passwords from Bitwarden from Windows, macOS and GNU/Linux
• NordPass data from Windows, macOS and GNU/Linux
• Brave Nightly data from Windows, macOS and GNU/Linux
• FrostWire data from Windows, macOS and GNU/Linux
• SSH keys from Windows
• 7-Zip data from Windows
• Flatpak data from GNU/Linux

The ability to use hash sets when creating file search rules has been added. Users can select a hash set file in the search options or click the “Open Hash Set Manager” button on the Files tab of KeyScout.

In Oxygen Forensic^® Detective v.17.1 we introduced support for custom-built drones based on the ArduPilot. Now users can import ArduPilot log data in BIN formats and parse the detailed drone flight history as follows:

• Device geo coordinates (global, GPS, and home points)
• Drone orientation information
• Flight mode information
• Battery status during the flight

Dataflash logs (or BIN) are saved on the autopilot (usually on an SD card) and can be downloaded from the autopilot immediately after the flight.

The ability to import drone logs in the AWM format and parse the drone flight history from them has been added.

Oxygen Forensic^® Detective v.17.1 supports the import and parsing of TikTok account data.

The extracted categories include information about:

• The account owner’s authorization history
• The last known location
• The main account details
• Followers and subscriptions
• Direct messages
• Blocked users
• Application settings
• Posts
• Search history

Now users can import and parse Google Voice service. Google Voice data is organized into a separate Voice directory within the Google Takeout report and is displayed in the Google Voice category of the downloaded Google Takeout account data.

Users can now customize malware scans by selecting specific files and folders in the Files section.

You can now convert spoken language from audio and video files into written text using the speech-to-text engine in Oxygen Forensic^® Detective v.17.0. This feature, available in the Speech and Text Recognition section, works offline and comes at no extra cost.

By default, our software uses the Base recognition model, but you can download more advanced models from your Customer Area. The engine supports speech recognition in over 50 languages. Additionally, you can search through the recognized speech in the Search section and export recognized data to reports.

Read: Speech-to-text capabilities in Oxygen Forensic® Detective ⇾

Internal memory data and applications can be now extracted from unlocked Android devices running Android 9-14 with the Security Patch Level (SPL) till June 1, 2024. This is a significant advancement in Android device extraction, providing comprehensive support for a wide range of modern devices. Supported devices include but are not limited to Xiaomi 11T, Xiaomi 12T Pro, Samsung S22+, Samsung A30, Samsung A31, Redmi 9A.

Locked MTK-based Samsung devices with the latest TEEGRIS version and released after June 2023 can now be extracted.

We’ve extended our checkm8 acquisition support for iPads. Now the following iOS versions are supported:

• iPad mini 4: iOS 14.8.1 – 15.8.3
• iPad 5^th gen: iOS 16.4 – 16.7.10
• iPad 6^th gen, iPad 7^th gen: iOS 16.4 – 16.7.2

Several enhancements have been made to this method:

• Now it supports iPhone and iPad devices with iOS 13.
• Full file and keychain extractions are now available from iOS devices based on the A8, A8X, A9, and A10 chipsets and running iOS 15.8.3.
• Extraction speed is significantly accelerated.

We’ve made numerous improvements to the WhatsApp Multi-Device extraction method. The key ones include extraction of the following information:

• Video messages
• Live locations
• Message delivery time stamp
• Modified message time stamp
• Pinned message information

Now KeyDiver can find passcodes to decrypt:

• encrypted Android backups
• encrypted MS Office files (Microsoft, Excel and PowerPoint)
• RAR archives

Attack methods can be created using a dictionary, a mask, or a user’s personal data from an extraction.

Updated KeyScout allows making bit-by-bit disk copies and saving them to RAW or E01 formats. This feature is supported for all the available methods: live extraction, image and drive extractions.

The following new computer artifacts are supported:

• passwords extraction from DuckDuckGo from Windows
• passwords extraction from KeePass from Windows and GNU/Linux
• Bitwarden data from Windows, macOS and GNU/Linux
• qBittorrent data from Windows, macOS and GNU/Linux
• a web version of Bitwarden from Windows, macOS and GNU/Linux

We’ve also added support for macOS 15 Sequoia (beta).

Oxygen Forensic^® Detective v.17.0 supports the import and parsing of vCard files that contain contact information. This feature enriches investigations with valuable contact details.

You can now import and parse Huawei backups created with Huawei HiSuite versions 13 and 14. If a backup is encrypted, you can decrypt it with a known password.

We’ve enhanced the visibility of geolocation data by distinctly marking the device owner’s coordinates with a unique icon, making them easily distinguishable from third-party locations in the Timeline section. Additionally, in the Maps section, you can now filter coordinates based on whether they belong to the device owner or not. These improvements provide greater transparency in geodata analysis.

We’ve added support for six additional languages: Croatian, Georgian, Hungarian, Korean, Slovenian, and Telugu.