Analytics for Social Networks on the Go

Oxygen Forensic Suite 2012 offers forensic specialists an automated toolkit quickly revealing users’ communications occurring in popular social networks. Supporting Facebook, Twitter, and Google+ networks in both Apple iOS and Android as well as Twinkle (iOS only), Oxygen Forensic Suite 2012 provides the ability to examine the device user’s friend lists, communications, photos, geo location and search history. The social network analysis tools allow studying the user’s communication circles, chats, uploaded files, and similar information.

“With social networks such as Facebook and Twitter quickly gaining in popularity, mobile communications are no longer limited to phone calls, email and text messages”, says Oleg Fedorov, Oxygen Software CEO. “With more and more mobile communication occurring outside of the usual boundaries, we feel it’s extremely important to provide forensic specialists a usable toolkit for investigating users’ activities in social networks”.

Supporting Mobile Web Browsers

More mobile Web browsers are supported in Oxygen Forensic Suite 2012. The new toolkit extracts information from three more popular Web browsers, providing forensic access to users’ bookmarks, browsing history, cookies, login credentials to certain Web sites, passwords and stored form data.

Oxygen Forensic Suite 2012 supports three additional browsers for the Android OS, adding support for Mozilla Firefox, SkyFire and Dolphin.

Analyzing Android System Logs

Oxygen Forensic Suite 2012 adds the ability to analyze the Device Logs section of Android OS devices. Android devices generate a wide range of logs, recording core and system events, and containing information about installed applications and the current state of the phone. The new tool allows viewing initialization script output recorded during the last boot, information about applications and the state of the phone, as well as accessing the internal log of the Android system.

Meet Oxygen Software at Department of Defense Cyber Crime Conference 2012

The first official presentation of Oxygen Forensic Suite 2012 v. 4.0 will take place at DoD Cyber Crime Conference (January 23-25). The DoD Cyber Crime Conference annually draws over 1200 participants from federal agencies, the law enforcement community and the defense investigative organizations and aims to address current trends in cyber crime and those of the future. Oxygen Software is proud to make it to the list and invites everyone to visit its booth #623 during the expo in Atlanta, GA.

About Oxygen Forensic Suite 2012

Oxygen Forensic Suite 2012 helps investigators and forensic specialists access and analyze data from a variety of mobile devices such as cell phones, smartphones, communicators, PDA and tablet PCs. Currently supporting more than 2,500 different models, Oxygen Forensic Suite 2012 covers the widest range of mobile devices compared to competition, and allows fully automated acquisition and analysis of supported devices.

The unique Timeline feature offers convenient, single-place access to all activities and movements performed by the user arranged by date and time. Investigators can track user location at every moment, build and map their historic routes, and clearly see all activities performed by the user at each location.

Another signature feature of Oxygen Forensic Suite allows investigators performing a global search on all devices ever analyzed with the toolkit. The global search quickly reveals any connections (e.g. common contacts, exchanged calls, texts or emails) between the phone users.

Oxygen’s statistical analysis tools allow investigators discover social connections between the users of multiple mobile devices. Calls, text messages and Skype conversations are analyzed to produce charts and tables revealing the users’ closest circle at a glance.

Oxygen Forensic Suite 2012 guarantees zero-footprint operation, leaving no traces and making no modifications to the content of the devices, making it the tool of choice among government and law enforcement agencies, security services and forensic organizations in more than fifty countries.

About Oxygen Software

Founded in 2000, Oxygen Software offers the most advanced forensic data examination tools for smartphones and mobile devices. The company is dedicated in delivering the most universal forensic solution covering the widest range of mobile devices running Symbian, Windows Mobile, Blackberry, iOS, and Android operating systems. As a result, Oxygen Forensic Suite receives great response at forensic conferences, exhibitions and trainings, and occupies a spot in the top of the list in relevant tests for extracting more data than competition.

# # #

More information about the company and its forensic solutions is available at www.oxygen-forensic.com

Social Connections and Statistical Analysis Tools

Oxygen Forensic Suite 2012 introduces several new statistical analysis tools offering forensic specialists the ability to quickly reveal social connections between users of mobile devices under investigation and their contacts. The newly added Communications Statistics section provides a convenient tool to explore social connections between device users and their contacts by analyzing calls, text messages and Skype activities. The activities are analyzed and presented in a table or diagram view. Table view offers in-depth analysis, while diagram view presents a quick overlook of communication circles, allowing forensic experts to determine and analyze suspects’ communications at a glance.

“Automating the analysis is utterly important for our forensic customers”, says Oleg Fedorov, Oxygen Software CEO. “Manually tracking down users’ connections is an extremely time-consuming and labor-intensive task. The new analysis tools brought by Oxygen Forensic Suite 2012 produce a concise summary, with a graphical chart presenting the connections visible at a glance”.

New High-Performance Storage

The addition of new statistical analysis tools called for the change in the underlying engine. To facilitate the increased computational demands, Oxygen Forensic Suite 2012 upgrades its internal storage to a newly implemented, advanced storage format. The new storage offers even better performance, shorter load times and faster response, while providing better integrity and reliability compared to the older format. Previous version databases will be automatically converted to the new format with all data correctly migrated.

Extended Compatibility: iPhone 4S Support, Android 2.3.5 – 3.0.1 Rooting

Oxygen Forensic Suite 2012 supports more smartphone devices than ever. The new release adds support for iPhone 4S and offers Android rooting add-on for Android OS devices versions 2.3.5 and higher. The complete list of supported Android devices includes Android platforms 1.6 through 3.0.1, which covers over 96% of all Android devices on the market.

Meet Oxygen Software at Department of Defense Cyber Crime Conference 2012

Oxygen Forensic Suite 2012 v.4.0 will be officially presented at Department of Defense Cyber Crime Conference 2012 (January 23-25). Visit Oxygen Software at booth #623 during the upcoming expo in Atlanta, GA.

About Oxygen Forensic Suite 2012

Oxygen Forensic Suite 2012 helps investigators and forensic specialists access and analyze data from a variety of mobile devices such as cell phones, smartphones, communicators, PDA and tablet PCs. Currently supporting more than 2,500 different models, Oxygen Forensic Suite 2012 covers the widest range of mobile devices compared to competition, and allows fully automated acquisition and analysis of supported devices.

The unique Timeline feature offers convenient, single-place access to all activities and movements performed by the user arranged by date and time. Investigators can track user location at every moment, build and map their historic routes, and clearly see all activities performed by the user at each location.

Another signature feature of Oxygen Forensic Suite allows investigators performing a global search on all devices ever analyzed with the toolkit. The global search quickly reveals any connections (e.g. common contacts, exchanged calls, texts or emails) between the phone users.

The newly added and improved statistical analysis tools allow investigators discover social connections between the users of multiple mobile devices. Calls, text messages and Skype conversations are analyzed to produce charts and tables revealing the users’ closest circle at a glance.

Oxygen Forensic Suite 2012 guarantees zero-footprint operation, leaving no traces and making no modifications to the content of the devices, making it the tool of choice among government and law enforcement agencies, security services and forensic organizations in more than fifty countries.

About Oxygen Software

Founded in 2000, Oxygen Software offers the most advanced forensic data examination tools for smartphones and mobile devices. The company is dedicated in delivering the most universal forensic solution covering the widest range of mobile devices running Symbian, Windows Mobile, Blackberry, iOS, and Android operating systems. As a result, Oxygen Forensic Suite receives great response at forensic conferences, exhibitions and trainings, and occupies a spot in the top of the list in relevant tests for extracting more data than competition.

# # #

More information about the company and its forensic solutions is available at www.oxygen-forensic.com

• Added Android rooting add-on for Android OS devices version 2.3.-2.3.2 and 3.0- 3.0.1.
• Added support for Android OS tablets with OS version 3.x.
• Added support for Dropbox application for Apple and Android OS devices. This section allows to examine account settings, custom folders and uploaded files. Android Rooting add-on is required for Android OS devices to see this data. Available in Analyst version only.
• Web Browsers Cache Analyzer. Added support for a default web browser of Android OS devices. Now web cache, bookmarks, cookies and geo location cache are extracted. Android Rooting add-on is required to see this data. Available in Analyst version only.
• Added support for Google Maps for Android OS devices. Android Rooting add-on is required to see this data. Available in Analyst version only.
• Skype. Added support for Android OS devices. Android Rooting add-on is required to see this data. Available in PRO and Analyst versions only.
• Licensing policy. After the expiration date you can acquire the devices supported by most recent program version available at your personal page. Previously any device connection and data extraction after the expiration date were not allowed.
• Skype. Added support for Skype version 3.5 for Apple devices.
• Messages. Added MMS messages extraction from Android OS devices.
• General. Preliminary support for unencrypted BlackBerry OS 7 backups extraction.
• Added support for Nokia Series 30 phones. Contacts, messages and calls are acquired. More than 10 old and new Series 30 phones added: Nokia 1006 CDMA, Nokia 1100b, Nokia 1200b, Nokia 1202-2, Nokia 1202-2b, Nokia 1220 Phase 2 DAMPS, Nokia 1260 Phase 2 DAMPS, Nokia 1508 CDMA, Nokia 1508i CDMA, Nokia 1606 CDMA, Nokia 1610/1611/1620/1630/1631, Nokia 5030 XpressRadio etc., Nokia 1600/1600b and Nokia 1650/1650b support updated.
• SQLite Viewer. Added ability to search for clusters of deleted records. There is no guarantee that these found clusters are 100% true to life and reliable therefore they cannot be used as evidence in the court.
• Extraction Wizard. Export option is available right after data extraction is finished.
• Added support for Apple iTunes 10.4.1 and iTunes 10.5.
• Added support for more than 30 mobile devices: Acer ICONIA TAB A500, Acer ICONIA TAB A100, HTC Stallion (Inspire 4G), HTC Incredible S (Vivo), HTC Pyramid (Sensation), HTC Rider (Evo 4G), HTC Vivo_w (Incredible 2), HTC Wildfire S (Marvel), Motorola DEFY+, Motorola DROID 3,Motorola FIRE, Motorola MOTO XT531, Motorola TRIUMPH, etc.
• Messages. Improved messages support for Blackberry devices.
• Plist Viewer. Improved support for Base64 converter.
• Google Services, Google Mail, Google Talk. Improved support for Android OS devices.
• Foursquare. Improved support for iPhone dump images and jailbroken devices.
• Backup Extraction Wizard. Fixed error when an .ofb backup from a previous version could not be uploaded in a Trial and USB dongle versions of Oxygen Forensic Suite 2011.
• Extraction Wizard. Fixed error when a USB dongle key code was not recognized by Extraction Wizard.
• General. Fixed error that appeared when running Oxygen Forensic Suite 2011 under Windows XP.
• Full list of changes and improvements

The devices covered by the training are:

•Android smartphones
•iPhone and iPod Touch devices
•Symbian OS smartphones
•Windows Mobile 5/6 smartphones
•Blackberry smartphones
•Nokia S40 phones
•Sony Ericsson cell phones
•Samsung cell phones
After completed training the students receive official Oxygen Forensic Suite Expert certificates.

New Application Lets Forensic Investigators View Plist Files Used in Apple and Android Smart Phones to Store Private User Data, Logs and Settings

Oxygen Software, a leading developer of iPhone forensic software products, today announces Oxygen Forensic Plist Viewer, a new Windows utility for viewing Plist files used in Apple and Android smart phones. Earlier this tool was available only as part of Oxygen Forensic Suite 2011.

Plist is a data file with the .plist extension. This format is used in Apple and Android smart phones to store various data, including forensically important information. Many built-in and external user applications store their settings, logins, passwords, history, logs in Plist files. The format is binary, which means that a plist file cannot be opened in a text editor such as Notepad. To view these files, forensic experts can use Oxygen Forensic Plist Viewer, which provides a user-friendly interface for examining data of the smart phone itself, or its backup file.

Oxygen Forensic Plist Viewer automatically unpacks a plist file and displays its content as a folder tree. The expert can view data, convert text entries to different encodings, and convert numeric values to Unix, Windows, or iOS dates. What’s more, the program can show binary content of cells, such as images, video and sound and export the content of a plist file to XML format for further analysis in other forensic software.

Viewing a plist file in Oxygen Forensic Plist Viewer is very easy. Simply select a node of a plist file in the folder tree, and its content will open in the viewer. For example, if the user downloaded a file from the file sharing website, the investigator can see a direct link to that file, date of downloading, title of the webpage the file was downloaded from, as well as the number of visits to that webpage. In case of viewing binary content, the tool will detect its format and display an image, or play a sound automatically.

Oxygen Forensic Plist Viewer is available for immediate download and purchase.

Here is the short video introducing iPhone forensics with Plist Viewer.

Oxygen Forensics for iPhone is the only cell phone forensics software that is able to extract information
from password-protected backup files.

You can also use built-in iPhone Password Breaker to unlock backup files made with iTunes.

One of the places where examiner can find deleted data is database files. Usually entries are not deleted
permanently at once and stay in database for a long period of time. Here is where SQLite viewer can really help.

There are a plenty of database files in SQLite format in Apple, Android devices, Symbian Series 60 smartphones.
These files contain various application data like history, logs, settings and information itself.
Data can be marked with GEO-coordinates and/or timestamp that help to determine where the suspect was at
a certain moment.

SQLite Viewer for Oxygen Forensic Suite offers convenient analyzing of device data:

• Parse SQLite database files.
• SQLite Viewer runs automatically when opens compatible file.
• Shows data in a convenient table view.
• Displays deleted blocks of data.
• Ability to open external files for analysis.

Watch SQLite Viewer intro  tutorial.

Wi-Fi Connection analyzer module in Oxygen Forensic Suite 2011 retrieves Wi-Fi connection list from a mobile device. With this list forensic experts are able to know where and when suspect used Wi-Fi internet access (public or even private) and ascertain his location.

IP Connections tab shows all the history of Web connections (Wi-Fi, GPRS, LTE) and their details: MAC and VPN addresses, device and router IPs, DNS name, region, time stamp, etc.

Locations tab represents consolidated.db file contents in an extremely convenient way. Initially this file stores all the network activity of the device basing on GPS/Cell/Wi-Fi data. Experts can track device movements and determine device owner location basing in Locations data.

Experts can view geographical coordinates and maps directly in Oxygen Forensic Suite or export data to KML format to see the route in Google Earth application.

• Get logins and passwords to the app
• Find geo-location of the last run
• Inspect all used or created app files
• Know exactly when the app was used
• Access to system and user apps
• Customize “User data” output format
• View all apps activities with times
• Filter apps by a certain term
• Export and print selected items

Applications addon shows detailed information about system and user applications installed on a device. Most popular applications like Bump, eBuddy, Echofon for Twitter, Facebook, YouTube, Flickr, LinkedIn, fring, HeyTell, ICQ, IM+, and many many other have a special User Data data tab. This tab contains aggregated data of the application prepared for convenient analysis. Because of the open format of Application User Data Templates experts can easily change the way of the data output and create own templates for other applications.