Figure 6: Selecting Categories for Extraction.When using a USB or Wi-Fi connection in Oxygen Forensic® Extractor, investigators can now select data to extract directly in the Oxygen Forensic® Extractor window (see Figure 7).
When an investigator installs and runs our innovative OxyAgent on the target device, data categories can now be selected on the device screen (see left of Figure 6). Our redesigned and reconfigured OxyAgent now allows investigators to select data categories for extraction. The screenshots will be found in the files section.įigure 5: Screenshots in File Section Selective data extraction Screenshots and data collected via OxyAgent will be shown as one extraction. Then, copy both folders that contain data and screenshots to the PC running Oxygen Forensic Detective, and import.
Manual Mode: the device screen displays a button for taking a single screenshotĦ.As soon as all rights are granted, select the semi-automated mode on the home screen2.Semi-Automated Mode: the device screen displays a joystick with the ability to set the direction of taking series of screenshots.Return to OxyAgent and select the type of screenshot mode (semi-automated or manual): Click Start Now to open Settings and follow the directions to allow OxyAgent to be displayed over other apps. Return to OxyAgent and select the type of screenshot mode (semi-automated or manual):ĥ. Investigators must give permissions to all the app to capture everything that is displayed on the screen.Ĥ.
Choose “Take and save screenshots” on the OxyAgent main screen. The OxyAgent is available in Oxygen Forensic Extractor.Ģ. This can include any screen available to the investigator, no matter if it is a photo, video, third-party apps anything! Follow these steps to take screenshots manually or semi-automated:ġ.
Our enhanced OxyAgent now makes it possible to take screenshots of any Android screen to document clear and concise evidence related to the case. Thus, investigators can miss valuable data in a basic logical Android extraction. Logical data extraction does not allow investigators to gain access to the internal memory where applications are stored. Once data is extracted, investigators will be provided the option to import it into Oxygen Forensic® Detective, at which point, the app can be uninstall from the device. Extraction progress bars will be displayed both on the device and PC screens. Once the device is connected, the investigator can now select the data to extract Figure 2: Selecting data for Extractionĥ. Enter the device IP address displayed on the OxyAgent screen into the corresponding field within the Oxygen Forensic® Extractor window, confirm app installation and data entry, and then press Next.Ĥ. Once the OxyAgent app is installed, accept all permission requests, and then select Extract Over WiFi on the OxyAgent home screen.ģ. Select a folder in which the extraction will be stored.
Install OxyAgent on the device by either scanning the QR-code or manually entering the link from the Oxygen Forensic® Extractor screen to the device browser. To connect an Android device via Wi-Fi, choose the corresponding option in Oxygen Forensic® Extractor and follow the steps:ġ. Fortunately, data extraction via Wi-Fi network is now available. There can always be problems when dealing with mobile devices, such as faulty cables or broken USB ports.
Now, investigators can obtain full conversations of any application on any Android device! Data extraction via Wi-Fi This is extremely important with today’s applications that can only be extracted with either a rooted phone or full physical. Select artifacts for extraction, and take screenshots of Android data that cannot be extracted via any other method. Oxygen Forensic® Detective 12.5 comes equipped with the redesigned and enhanced OxyAgent utility that now allows investigators to acquire data via a Wi-Fi network. With many Android devices and system applications now using security that disables the backup of basic built in apps (e.g., SMS/MMS, Call Logs) having a secondary method to collect this important data from every supported Android device via USB cable is a must. Our OxyAgent allows investigators to collect important information to include contacts, calls, messages, calendars, files from both internal and external media cards, and more.
Oxygen Forensics offers investigators a wide range of extraction methods for Android devices that include screen lock bypass methods, rooting, ADB backup creation, and a robust OxyAgent method for logical acquisition.