Oxygen Forensics

Analyst Features

Aggregated Contacts

In this section you can analyze contacts from multiple sources such as Phonebook, Messages, Social Networks and Messengers.  

The section automatically reveals same people in different sources and groups them together in one meta-contact.

Android Rooting

Rooting an Android device reveals the complete set of user data to the investigator.

Generally this procedure requires certain knowledge and research, but Oxygen Forensic® software helps experts to automate this operation.


Oxygen Forensic® software retrieves all vital application data from mobile devices running iOS, Android OS, BlackBerry 10, Windows Phone 8. The program is able to decrypt apps databases even if they securely encrypted.

Currently 420 unique applications and 6590+ app versions are supported.

Backups Import

Oxygen Forensic® products allow to import and parse data from various device backups and images created by sync software or other forensic products.

Chinese Devices

Oxygen Forensic® software allow to bypass screen lock passwords and create full physical dumps from Chinese chipset devices.

The current version supports all popular devices based on MediaTek (MTK) and Spreadtrum chipsets.

Data Viewers

Various data viewers help experts to analyze extracted data in a convenient way.

Oxygen Forensic® software has built-in HEX-viewer, picture viewer, music and video players, text viewer with code page converter, HTML, SQLite and Plist Viewers. 


Dictionaries section shows all the words ever entered in device messages, notes and calendar.

These are not words from the device system dictionary, they are from unique user dictionary that is created by device owners when using it.

Geo Locations

Web Connections section may reveal suspects' visited places.

With Wi-Fi Connections list forensic experts are able to determine where and when suspect used Wi-Fi internet access (public or even private) and ascertain his location.

Global Search

Global Search allows discovering user data in every section of the device.

Tool offers searching for text, phone numbers, emails, geo coordinates, IP addresses, MAC addresses, Credit Card numbers. Regular expressions library is available for more custom search.

Key Evidence

Key Evidence section offers a clean, uncluttered view of evidence marked as essential by investigators.

Forensic specialists can mark certain items belonging to various sections as being essential evidence, then review them all at once regardless of their original location.

Links and Stats

Quickly reveal social connections between users of mobile devices under investigation and their contacts.

Links and Stats section provides a convenient tool to explore social connections between device users by analyzing calls and all types of communications in standard and third-party applications.


Passwords section displays logins, passwords and tokens extracted from applications databases. 

Password recovery is available for iOS, Android and Windows Phone 8 devices.

Social Graph

Social Graph visualizes complex connections inside crime groups.

This is a highly adjustable workplace that allows forensic experts to review connections between mobile device owners and their contacts, pinpoint connections between multiple device owners, and detect their common contacts.


Oxygen Forensic® software can detect spyware apps installed on Android and Apple devices, discover and process their logs and configuration files.


Timeline allows to view all facts of mobile device usage in one sorted list. 

This section organizes all calls, messages, calendar events, geo data and applications activities in chronological way, so you can easily follow the conversation history without the need to switch between different sections.

WebKit Data

Oxygen Forensic® software can parse WebKit data from iOS and Android devices. WebKit is an engine that is widely used by mobile web browsers and other applications that display information using webpages. WebKit data usually stores emails from webmail interface and content of visited pages.