“Focus on what you need or the freedom to be selective.”
When conducting an investigation, time is always of the essence. Every minute counts and waiting for a full image to import when only a few apps are of interest can be frustrating, as is realizing that some of the apps within extraction have not been parsed correctly.
At Oxygen Forensics, we understand this problem. To save investigators valuable time and make the investigation easier, we have added Selective Data Analysis to Oxygen Forensic® Detective, starting with version 14.2. This feature is available for images and backups of devices operating on iOS, Android OS, and KaiOS.
Selective Data Analysis: Step-by-Step
Since this feature is turned off by default, investigators will have to enable it during the import of iOS, Android, or KaiOS images or backups after the platform is automatically detected. To do this, open the “Selective Data Analysis” tab within Import Wizard and drag the slider.
Upon enabling this feature, a table containing the list of supported apps will be displayed. The list is divided into two parts – System Applications and User Applications.
Please note that all supported applications will be displayed in the list, even though they may not be installed on the device itself. This is done to save time, because in order to detect the apps that are present on the device, we would have to extract and pre-analyze the file structure of the device.
Each category may be expanded by clicking on its header. The number of selected applications and an overall number of applications is also displayed there (X of Y applications selected). To find a specific app that is of interest, use the search bar above the grid. Use arrows to switch between search results. Investigators may select one or several apps to analyze.
As soon as all apps of interest are selected, click “Import”. The files will be parsed and a new extraction containing data only from the apps selected will be added to the list. Would you like to try this feature for free? Request a free, fully-equipped demo license here.