MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsOxygen Forensics
Oxygen Forensic Detective
Oxygen Forensic Detective is an all-in-one extraction and analysis tool for phones, cloud accounts, drones and other connected devices. On 2 November 2026 the maker's website could not be checked, so this profile is marked unverified.
SoftwareCommercialUnverified
Profile
- Manufacturer
- Oxygen Forensics
- Category
- Mobile forensics
- Product type
- Software
- Platforms
- Not stated by the manufacturer
- Licensing
- Commercial
- Product status
- Unverified
- Educational level
- Intermediate
- Last verified
- 2 November 2026
Marked Unverified. On 2 November 2026 oxygenforensics.com returned a notice stating that the domain had been seized by the United States Bureau of Industry and Security under a warrant from the Central District of California. Press reports dated 24 September 2026 describe wire fraud conspiracy charges against the company's chief executive and chief technology officer over alleged concealment of Russian ownership and the seizure of about 57 domains and corporate accounts. The reports say the authorities do not allege malicious code in the software. These are allegations before a court, not findings. Product name, editions, platform and licence could not be checked with the maker, so capabilities above are from the maker's documentation as it stood before the seizure.
What Oxygen Forensic Detective is
For many years Oxygen Forensic Detective was one of the three or four tools an Indian mobile forensics lab would expect to see beside Cellebrite and MSAB. Its documented scope covered logical and physical extraction from Android and iOS handsets, import of extractions made by other tools, collection from cloud accounts through a built-in cloud extractor, data from drones and wearables and artefacts gathered from computers with a companion utility called KeyScout. Analysis views such as a timeline, a social graph of contacts and a map of locations sat on top, with a free viewer so investigators could read the output.
This profile cannot confirm any of that against the maker today. The company's domain displayed a United States government seizure notice on 2 November 2026. News reports from September 2026 describe charges against two company executives over alleged concealment of the company's ownership, together with the seizure of its domains and accounts. The same reports quote the authorities as saying the software itself is not alleged to contain malicious code or to have accessed customer data. Those are allegations, not findings. For a laboratory the practical questions are different: whether a current licence, updates and support can be obtained and whether an existing installation and its past reports can still be explained and validated in court.
Primary applications
Where it is used
- Historically, extraction and analysis of Android and iOS devices
- Import of extractions from other mobile tools for a second analysis
- Cloud account collection under legal authority, using the maker's cloud extractor
- Drone, wearable and other connected device data
- Computer artefact collection with the KeyScout companion utility
Who uses it
- Laboratories that hold existing licences and must decide how to proceed
- Examiners who need to explain reports produced with the tool in earlier cases
- Students studying tool validation and vendor risk
Capabilities and limits
Major capabilities
- Mobile extraction and decoding for Android and iOS, as documented by the maker before September 2026
- Import of third-party extractions and backups
- Cloud extraction module for supported online services
- Drone and IoT device support
- Analytic views including timeline, social graph and maps
- SQLite database viewer for manual checking of parsed records
- A free viewer for sharing output with investigators
Technical limitations
- None of the capabilities above could be re-verified on the maker's site on 2 November 2026
- Licensing, updates and support availability are uncertain while the maker's infrastructure is seized
- Device and app support changes with every release, so a lab without updates falls behind quickly
- A tool under public scrutiny invites challenge in court, so validation records for past cases matter more than ever
Learning with DFRTI
Independent professional education covering the principles and workflows of Oxygen Forensic Detective. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- Mobile extraction fundamentals and SQLite basics
- Tool validation: how a lab proves that a tool's output is reliable
- Procurement and vendor risk as part of laboratory governance
Disciplines
Related tools
- Cellebrite Physical AnalyzerPhysical Analyzer is the decoding and analysis side of Cellebrite's mobile workflow. PA 7 is being discontinued and the database-backed PA Ultra has become Inseyets.PA 10.x.Cellebrite
- MSAB XAMNXAMN is where an XRY extraction becomes readable evidence. MSAB sells XAMN Pro for analysis and gives away XAMN Viewer so that others in the case team can open the same files.MSAB
- Magnet AxiomAxiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.Magnet Forensics
- MOBILedit ForensicCompelson now sells its phone forensics tool as MOBILedit Forensic. The Forensic Express name survives only in old web addresses. The product comes in editions, from a single-phone licence to the ULTRA edition that the maker classes as a dual-use item.Compelson
- Belkasoft X ForensicBelkasoft X is a single tool for computer, mobile, drone, vehicle and cloud evidence. Belkasoft sells X Forensic to government customers and X Corporate to businesses, both on a perpetual licence.Belkasoft
Courses that cover this tool
MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reports
MobileMobile & IoT ForensicsiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone cases
NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.
MobileMobile & IoT ForensicsDrone ForensicsRecover DJI flight logs, GPS tracks and home points from drones, controllers and phone appsProduct names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.