Alexandria, VA – Aug. 8, 2018 – Oxygen Forensics, a leading global provider of digital forensic investigation software for government, law enforcement, and enterprise organizations, has released an update to its flagship product, Oxygen Forensic® Detective, introducing advanced features to support the extraction of data from locked smartphones, import of extractions performed from the popular GrayKey iPhone cracking software, and analysis of device logs including history of Bluetooth and Wi-Fi connections.

“If you’ve read any headlines lately about digital forensics, then you’ve heard of GrayKey,” stated Lee Reiber, chief operating officer of the D.C. area-based software company. “The team at Grayshift has built a great product to help law enforcement organizations access locked iPhones for examination, and we’re excited to support customers using this tool with advanced analytics.”

Oxygen Forensics products offer investigators the ability to access and extract data from thousands of smartphones, drones, cloud accounts, and Internet of Things (IoT) components; however, many investigations in recent years have been limited by security constraints on Apple devices. GrayKey has caught the attention of investigators due to its ability to work around these security constraints and grant access to locked iPhones.

Oxygen Forensics customers who are using its software to analyze data extracted from devices are now able to import device images from GrayKey to analyze the data and combine it with other digital evidence sources in their investigations.

Oxygen Forensic® Detective Version 10.4 Update Highlights

• Decrypt WhatsApp backup files using an account phone number or token
• Import iOS images extracted using GrayKey
• Acquire partial images of locked Samsung devices using MTP
• Identify photos with similar content using PhotoDNA hash sets
• Extract Wi-Fi hotspot access history with KeyScout
• Examine Bluetooth connection history
• Authenticate Google services using 2FA with Google Prompt
• Improved EDL method for extracting Qualcomm chip-based devices

Alexandria, VA – May 8, 2018 — Oxygen Forensics is a worldwide developer and provider of advanced forensic data examination tools for mobile devices, cloud services and drones, announced today that Oxygen Forensic® Detective 10.2 can now acquire a WhatApp Cloud token from Android devices.

Two months ago, Oxygen Forensics announced Oxygen Forensic Detective 10.1 that featured the ability to help decrypt WhatsApp iCloud or Google backups with a token. Ifa key ?le that is required for backup decryption cannot be obtained, Oxygen Forensic Detective can create a WhatsApp authentication token and use it to decrypt backups stored within the iCloud and Google Cloud services.

Now, with Oxygen Forensic Detective 10.2, investigators can use a WhatApp Cloud token from an Androiddevice to decrypt WhatsApp backups from Android devices, WhatsApp Google Drive,as well as iCloud backups associated with the same phone number.

“Our product development team is constantly working on new features every single day,” said Lee Reiber, COO, Oxygen Forensics. “The new WhatsApp decryptionmethod leaves no digital trace and is a good alternative to the commonly used method with the key file. With this token, forensics experts can also acquire undelivered messages and unanswered calls directly from the WhatsApp Server, which can also help the investigators put the pieces together to solve crimes.”

Alexandria, VA – May 31, 2018 - Oxygen Forensics, has released an update to its popular mobile forensic software allowing investigators exclusive access to mobile devices, applications, and cloud data not previously accessible through software solutions.

The company’s flagship software, Oxygen Forensic® Detective, enables investigators to access and extract data from thousands of mobile devices, applications, and storage locations to build stronger cases with digital evidence. The update to version 10.3, which most notably includes access to cloud backups of the Samsung Secure Folder and Viber messaging app, as well as expanded support in extracting from locked Android devices, will allow for more detailed investigations by law enforcement and government defense groups in legal proceedings.

“Our commitment to supporting digital investigations requires constant innovation to ensure we quickly deliver the most updated solutions to meet ever-evolving technological needs and supporting popular applications,” commented Lee Reiber, Oxygen Forensics COO. “The sooner law enforcement and defense organizations have access to these features, the sooner they can begin holding wrongdoers legally accountable for their actions.”

The Samsung Secure Folder represents one of many roadblocks investigators face when collecting digital evidence for a case. Users of supported Samsung devices may store files separately from the phone’s primary storage, allowing them to protect information with a separate set of security standards and access credentials. Oxygen Forensics’ software allows investigators exclusive access to backups of these protected files through cloud extraction to retrieve data relevant to a case.

Oxygen Forensic® Detective version 10.3 supports more than 7,000 smartphone and drone operating systems and applications – the most of any forensic software currently on the market – through both device physical extractions and cloud backup access. For more information on Oxygen Forensics or this software update, visit www.oxygen-forensic.com.

Oxygen Forensic® Detective version 10.3 Update Highlights

• Industry First: Extract cloud backup of Samsung Secure Folder, including account details, contact and calendar cards, Application Package Kit (APK) file, and document revisions
• Industry First: Extract data from Viber messenger app backed up to iCloud or Google Cloud
• New Oxygen Forensic® KeyScout utility enables investigators to locate and retrieve tokens and passwords from a device’s associated PC for use in mobile investigations
• Bypass lock screen on more than 430 Android devices built with Qualcomm chipsets
• Support for full physical extraction on more than 100 new Spreadtrum Android devices with storage over 4 GB
• Support for more than 430 smartphone app updates

Alexandria, VA – April 10, 2018 - Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices, cloud services and drones, announced today that its flagship software product, Oxygen Forensic® Detective v. 10.2, offers forensic detectives the industry-first ability to extract all information from a DJI drone with only a USB cable.

The new Oxygen Forensic® Detective v.10.2 allows forensics experts to connect the drone to their examination computer via USB cable and conduct a physical collection of the embedded storage chip. Once Oxygen Forensic® Detective recognizes the drone, a physical acquisition is available in only a few clicks that then reveals the drone’s complete flight history with GPS locations and metadata. This data includes valuable facts like speed, altitude, direction, and other evidentiary parameters. The drone flight path is then visualized in the built-in Oxygen Forensic® Maps (both online and offline) which gives a clear picture of where the drone has traveled.

“The number of recreational drones being used around the world is growing at an incredibly fast pace,” said Lee Reiber, COO, Oxygen Forensics. “It should come as no surprise that we’ll see the number of crimes involving drones also increasing exponentially. It has become essential for digital forensic experts to have a tool that combines automated extraction, parsing and analysis of drone data from all possible sources, and we’ve given our customers exactly that with more features expected in the weeks and months to come.”

In addition to the new ability to extract data with the physical drone and a USB cable, Oxygen Forensic® Detective (in version 10.1) also allows experts to extract drone data from DJI cloud, critical when the drone is damaged or cannot be acquired. With Oxygen Forensic® Cloud Extractor, forensics experts can analyze the user account information, the list of drones connected to this account, and the complete flight history of the drone(s), all from the DJI cloud.

Decryption of DJI Cloud Token

With Oxygen Forensic® Detective v.10.2, forensics experts can extract and decrypt the DJI cloud token directly from a mobile device (Apple iOS and Android) when the DJI GO or DJI GO 4 app is installed. A decrypted DJI token is shown in the Cloud Accounts section of Oxygen Forensic® Detective. The token is then used to access DJI cloud with just one click to reveal and extract the drone flight history. By using the token, experts leave no digital trace. DJI token extraction from a mobile device makes it possible to acquire all the vital drone information, even without the drone itself.

Alexandria, VA – March 01, 2018 - Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices, cloud services and drones, announced today that its flagship software product, Oxygen Forensic® Detective v. 10.1 can now obtain data from the DJI cloud, which is the data repository for all DJI drones. Oxygen Forensics does this through Oxygen Forensic® Cloud Extractor.

With almost a million registered drones in the United States alone and much more all over the world, drones take pictures and video and even can transport packages. Law enforcement continues to review methods to acquire data from drones that are involved in illegal activities, especially GPS location data such as altitude, direction of travel, speed, and facial recognition data that can reveal the flight data of the drone. This information is sometimes stored on the drone itself, but in the case of drones manufactured by DJI, this digital information is also stored in the DJI cloud.

“Gathering data from the DJI cloud is a feature exclusive to Oxygen Forensics. From the DJI cloud, we can obtain important data from a drone that crashed or was physically damaged,” said Lee Reiber, COO, Oxygen Forensics, Inc. “The DJI cloud is critical since it stores all the serial numbers of the drones associated with an account holder. If we can match serial numbers from the cloud to a specific device, then the authorities can find information about the owner of the drone.”

Oxygen Forensic® Detective is the only tool that allows forensics professionals the ability to extract and decode drone data from all possible sources: drones, the cloud and apps associated with drones. Drone data is transmitted and stored in either the user’s online account, the drone manufacturer’s cloud, or in some cases both locations. The additional data within the cloud represents a separate challenge for a mobile data forensics expert since manual extractions can be extremely complicated or just simply not possible for various reasons. With the use of Oxygen Forensic® Detective, experts are now able to access the drone cloud and extract the information about the account, the drone serial number, the flight history, and other associated metadata.

Alexandria, VA – January 25, 2018 - Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices, drones and cloud services, today announced that it is partnering and integrating its product and technology with Project VIC.

Project VIC is a coalition of law enforcement and private sector partners who champion a transformation in the approach to child exploitation investigations by developing innovative technologies and victim-centric methodologies. Law enforcement agencies worldwide use the technology developed by Project VIC’s partners in their pursuit rescue child victims, apprehend offenders and secure crime scenes. 

“Oxygen Forensics is committed to helping law enforcement fight child exploitation around the world, and we’re very proud of our partnership with Project VIC,” said Lee Reiber, COO, Oxygen Forensics, Inc. “Unfortunately, child exploitation happens all the time. Anything we can do to slow that down and bring those that abuse to justice is worth every ounce of effort we have as a company.”

Through Oxygen Forensics’ product functionality, users will be able to search child exploitation content by hash sets and other indicators via Project VIC as well as exporting extracted file information to the VIC-JSON format that is certified with Project VIC.

Mobile forensic experts can now download files from Project VIC’s extensive library of hash signatures and collaborate with the rest of the world on identifying if they have illegal or images of interest to the Global VIC Community. Any images found to be suspicious on seized mobile devices will be copied to the Project VIC section and classified according to the Project VIC Classification Standard

“Mobile devices have become weapons in the hands of individuals seeking to exploit our children,” said Richard Brown, Director of Project VIC. “Oxygen Forensics’ new technical capabilities will have a significant impact on efforts by law enforcement to rescue victims from abusers.”

Alexandria, VA – Dec. 19, 2017 — Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices, drones and cloud services, today announced that it has seen double-digit growth in 2017 as it worked to increase its customer base with new customer additions in law enforcement, government and corporate spaces. Due to its growth, Oxygen relocated its headquarters in Alexandria, VA, and tripled the size of the office.

Oxygen has seen double-digit to triple-digit growth year over year since 2013. This past year the company focused on strategic expansion that produced an exceptional growth-to-revenue ratio that positioned Oxygen Forensics well for the future. Due to the historic growth over the past four years, Oxygen needed to move its headquarters to a larger space to add a classroom, forensics lab and more sales and technical support space for the growing staff.

“I am very excited for our corporate growth which led to the expansion of our training facilities worldwide, additional new certified trainer partnerships, and the increase of our valued resellers and distributors to better support our growing customer base,” said Lee Reiber, COO, Oxygen Forensics, Inc.

“The reason I joined Oxygen was because of the tremendous growth potential in the digital forensics market,” said Tim O’Rourke, VP of Sales, Oxygen Forensics, Inc. “Oxygen not only has a product that is an industry leader, but also a team of people that cares deeply for our customers and for those people that our products and our customers assist.”

Alexandria, VA – November 30, 2017 — Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices, drones and cloud services, today announced that it has added almost 20 new features in its flagship product Oxygen Forensic® Detective X (version 10). Among the features, Oxygen has made its industry-leading Oxygen Forensic® Cloud Extractor even faster by using 64-bit database processing power that speeds up the entire data extraction process.

Oxygen Forensic Detective X enhances investigation abilities for forensic experts with the addition of these uniquely supported cloud services:

• Mi Cloud - Xiaomi phones are growing in popularity. The Oxygen Forensic Cloud Extractor offers the industry-first ability to extract all available information from Mi Cloud via login/password or token including contacts, calls, messages, calendar and other personal data.
• Samsung Cloud backup - Forensic experts can import and parse complete Samsung Cloud backups that can be accessed via login/password or token. Backups may contain contacts, calls, messages, calendars, files and Wi-Fi history.
• Samsung Cloud Gallery – Added the ability to extract live, trashed and deleted photos, videos and documents from Samsung Cloud. This data also contains geographical locations so experts can track the whereabouts of the Samsung device owner.

As announced earlier this month, Oxygen Forensic Detective X also includes enhanced WhatsApp data extraction including WhatsApp backup decryption with 2-step verification and data extraction from the WhatsApp server.

Other additions to Oxygen Forensic Detective X include unsupported apps parsing, drone support enhancements, selected physical extraction, screen lock bypass for Motorola devices, Huawei backups import ability (Detective X can find passwords for encrypted backups with the help of a built-in Passware module), predefined keyword list and an improved SQL editor. For an advanced explanation of all new features, please visit the Oxygen Forensic Detective X product page.

“We have been very excited to tell our customers and the world about all of the new additions to Oxygen Forensic Detective X,” said Lee Reiber, COO, Oxygen Forensics, Inc. “With our new cloud services additions, Oxygen now supports many cloud services, and we continue to lead the competition with two industry-first WhatsApp extraction capabilities. Our ability to keep providing new product improvements every single month speaks to the strength and determination of our entire product team as we help government, law enforcement and corporate forensics experts.”

Alexandria, VA – November 16, 2017 — Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices, cloud services and drones, today announced that its new flagship product, Oxygen Forensic® Detective X (version 10), which contains the industry- leading Oxygen Forensic® Cloud Extractor, has added new WhatsApp extraction features.

Advanced WhatsApp Extractions
Oxygen Forensic Detective X has added two industry-first features in the algorithm of WhatsApp data extraction, including:

• WhatsApp backups decryption with 2-step verification - This verification is an optional feature that added to provide better security to the account. When enabled, any attempt to verify the phone number on a WhatsApp account needs to be accompanied by the six-digit PIN created by the user. The new Oxygen Forensic Cloud Extractor offers either the opportunity to enter the PIN (if it’s known) or several methods to deactivate it.
• Unique WhatsApp data from the server - Oxygen Forensics has added a special WhatsApp Cloud service that allows forensics experts to acquire undelivered messages, unanswered calls and information about groups and contacts directly from the WhatsApp server. This service is useful in specific cases with damaged or locked devices. When forensic experts use the WhatsApp Cloud service, they can even obtain access to the WhatsApp server without the phone.

For a full list of WhatsApp extraction capabilities, please visit this link.

“Since the middle of this year, we’ve been able to decrypt WhatsApp backups from Google Drive without an encryption key from the device. For the Oxygen Forensic Detective X release, our team has been strategically focused on supporting investigations by continuing to provide industry firsts such as WhatsApp extractions,” said Lee Reiber, COO, Oxygen Forensics, Inc. “With Oxygen’s Cloud Extractor, we can now decrypt devices with 2-step verification, and acquire data from the WhatsApp server. Both were greatly needed to keep pace with 3rd party mobile apps – and are more industry firsts.”