Oxygen Forensic® Advanced Analysis (OFAA) : Oct 8-10, 2024 .

This three-day instructor-led training event is a direct successor to the three-day OFBC course and continues with deep dives in to Oxygen Forensic® Detective analytics, database parsing, lost data recovery, alternate data sets and advanced tools such as the Call Data Record expert, the SQLite and Property list viewers and Oxygen Maps.

Contact Us

Why Attend?

This three-day instructor-led training event is a direct successor to the three-day OFBC course and continues with deep dives into Oxygen Forensic® Detective analytics, database parsing, lost data recovery, alternate data sets, and advanced tools such as the Call Data Record expert, the SQLite and Property list viewers, and Oxygen Maps.  Students will investigate IoT devices, take deep dives into application cache database files with the SQLite database and Property list viewers, and learn to aggregate and correlate data from multiple sources to enhance the overall investigation in scenario-based exercises. A solid understanding of Oxygen Forensic® Detective will greatly enhance the deliverables of this course.

    National Registry of CPE Sponsors.

OFAA – Oxygen Forensic® Advanced Analysis – 3 day class

CPE Credits – 21
Field of Study – Specialized Knowledge
Advanced Preparation – None
Prerequisites – No prerequisites required
Program Level – Advanced
Delivery Method – Group Internet Based

National Registry Sponsor Number 149408
In accordance with the standards of the National Registry of CPR Sponsors, CPE credits will be granted based on a 50-minute hour at completion of the course.

Interested in taking this course.

Fill out a form and a Oxygen sales rep will contact you soon.

Contact Us

Course Modules.

Students will investigate IoT devices, take deep dives into application cache database files with the SQLite database and Property list viewers and learn to aggregate and correlate data from multiple sources to enhance the overall investigation in scenario-based exercises. Check out the course modules.

icon-tick

Install and Support

This module educates end-users about how to install the latest Oxygen Forensic® Detective (OFD) products and mobile device drivers. Students will learn how to access their unique customer portal to download software and drivers. Additionalsoftware will also be described and installed for additional extraction flexibility.

View Full Course Content
icon-tick

Technology Review

  • Passware Kit Mobile
  • Oxygen Forensic® Map
  • Oxygen Forensic® KeyScout
  • Oxygen Forensic® SQLite Viewer
  • Oxygen Forensic® Cloud Extractor
  • Oxygen Forensic® Call Data Expert
  • Oxygen Forensic® Property List Viewer
View Full Course Content
icon-tick

Use Case - Investigation #1

Jumping right into things, the first scenario to work through includes data from IoT devices including Amazon, Google, and Ring. This scenario involves collaboration with a computer forensic unit and includes expanded education and lab work with:

  • Oxygen Forensic® KeyScout
  • Oxygen Forensic® Cloud Extractor
  • Computer hard disk drive evidence files
View Full Course Content
icon-tick

Use Case - Investigation #2

The next case includes intensive SQLite database interrogation. As the investigator, you will be assigned on the job education on SQLite database structure, content and viewing methodology. That knowledge will be applied to assist in locating target data from “non-parsed” target files. This scenario involves expanded education and lab work with:

  • Oxygen Forensic® SQLite Viewer
  • • Oxygen Forensic® Property List Viewer
View Full Course Content
icon-tick

Use Case - Investigation #3

This team challenge includes OxyAgent extraction, multiple devices and collaborative problem solving to get the most data possible from devices not willing to participate in the challenge. This challenge includes expanded education with:

  • Oxygen Forensic® OxyAgent
View Full Course Content
icon-tick

Use Case - Investigation #4

Back to database interrogation. We will continue applying what we’ve learned with additional database parsing

  • Oxygen Forensic® SQLite Viewer
  • Oxygen Forensic® Property List Viewer
View Full Course Content
icon-tick

Use Case - Investigation #5

With a computer, a large challenge could be – “Who was at the keyboard at the time of thecrime?”. With a phone, a large challenge could be – “Who was using the phone at the time of the crime?”. Pretending you have figured that out, now you must answer – “Who’s not telling the full story, the user, the device or the call detail records? This challenge includes expanded education and timeline re-creation with:

  • Mobile provider records
  • Oxygen Forensic® Call Data Expert
View Full Course Content
icon-tick

Use Case - Investigation #6

So – whatever you just found is locked -- Augh! – Now what? This challenge includes expanded education with:

  • Passware Mobile Kit
  • Oxygen Forensic® KeyScout
View Full Course Content
icon-tick

Use Case - Investigation #7

This scenario involves an investigation where all chatting and media exchange took place in WhatsApp. The device hosting WhatsApp no longer has the application installed but a token was captured from a device backup and stored in a Google account. Follow the process from discovery of the token to extracting, decrypting, and parsing the database. This challenge explores the WhatsApp capabilities of the Oxygen Forensic® Cloud Extractor.

View Full Course Content
icon-tick

Use Case - Investigation #8

Bonus challenge: This lab explores common case information across everything we’ve encountered. Find common artifacts between these data sets:

  • Stan
  • Dolly
  • Bonny
  • Alex
  • Smitty
  • Gorgeous Git
View Full Course Content

Request pricing information for this course.

By submitting a form you are agreeing to our Privacy Policy.