Oxygen Forensic Detective 18.2.0 | Full Version. Data retrieved from mobile

Download the latest, full, permanent version of Oxygen Forensic Detective 18. This mobile-based evidence extraction and analysis program supports over 50,000 app versions and features AI image analysis and event timelines.

What is an Oxygen Forensic Detective?

Oxygen Forensic Detective This is a professional digital forensics platform developed by Oxygen Forensics, Inc., a US-based company specializing in digital investigation software for over 20 years. It is used by law enforcement, government agencies, law firms, and corporate forensics teams in over 170 countries worldwide. What sets this program apart from other forensics tools is its ability to collect and analyze evidence from multiple sources simultaneously on a single platform, whether it's a mobile device, cloud service, or computer.

Oxygen Forensic Detective's core capabilities encompass data extraction from Android and iOS devices using multi-level methods ranging from logical to physical, chain extraction, and checkm8. It also allows for data retrieval from over 100 cloud services and the collection of artifacts from Windows, macOS, and Linux computers via the non-installable KeyScout tool. All of these capabilities can be integrated into a single case, providing detectives with a comprehensive view of evidence from all sources simultaneously without switching between programs.

Analytics is a key strength that sets Oxygen Forensic Detective apart from tools that only extract data. The program features a timeline analyzing events from all data sources, a geolocation system combining coordinates from multiple sources on a single page, AI-powered image analysis and categorization (capable of both CPU and GPU), a key evidence system for tagging and managing crucial evidence, and a cryptocurrency analysis system for digital wallets. This makes the program particularly suitable for complex cases with evidence from multiple sources.

Features:

Data extraction methods

iOS Agent: Extract data from iPhones and iPads via the iOS Agent. Supports extracting public data, Keychain system files, and specific files or folders. Supports extracting WhatsApp/WhatsApp Business chats with or without media, and real-time screenshots during extraction. Compatible with iOS 12 and above.
checkm8: Accessing physical data from an iPhone through a bootrom vulnerability that cannot be patched by software updates is possible, making it suitable for devices locked without the password known.
Chain Extraction: Automatically run multiple extraction methods in the same sequence, e.g., Physical → Full File System → Android Agent → ADB Backup, with fallback to the next method if the previous one fails.
Android Agent: Extract data from Android devices via an agent running directly on the device. Supports extraction from multiple sources in a single connection via USB and Wi-Fi.
Cloud Extraction: It retrieves data from over 100 cloud services, including Google, iCloud, Samsung Cloud, Dropbox, Facebook Warrant Returns, and Google Authenticator.
KeyScout (Computer Forensics): A portable tool for collecting artifacts from Windows, macOS, and Linux computers without installation. Supports file carving from NTFS unallocated space, malware scanning, and recognition of virtual machines on the target machine.

Special Features

AI Image Categorization: The new AI engine categorizes images for extraction, supporting categories directly relevant to cases such as Child Abuse, Nudity, Pornography, and Extremism, with adjustable prompts. It supports both CPU and GPU processing, with GPU offering significantly higher speed.
Timeline Analysis and Geolocations: Combines events from all data sources in chronological order, and includes coordinates from file, text, and app metadata on a single page. Supports OpenCellID for analyzing cell towers near events.
App Analysis with over 50,000 versions: Analyze insightful data from over 50,000 app versions. Supports popular apps like WhatsApp, Telegram, Signal, Discord, Slack, Teams, TikTok, and regionally specific apps. The Application Parsing Package allows for independent updates without waiting for a complete new version.
Passcode Recovery and Brute Force: The Brute Force Module supports simultaneous use of multiple GPUs, automatically stops when the GPU overheats, supports Android FDE/FBE, Samsung Smart Switch Backup, and creates a wordlist from device data to use as a password dictionary.
Cryptocurrency Section: Analyze transactions and digital wallets from extracted data. Supports Ledger Live and automatically searches for cryptocurrencies during data import.
File-to-App Linking and Key Evidence: Automatically identifies which app each file originated from and tags key evidence, categorizing it as Key Evidence, Notes, and Tagged Evidence for easier management and presentation in court.
Report of evidence: Export reports in HTML, PDF, and OFBR formats, with investigator details and extraction information added to the Case Details tab in version 18.2.