Difference between revisions of "Oxygen Forensic Suite 2"

From ForensicsWiki
Jump to: navigation, search
(Devices coverage update)
(Version update.)
(One intermediate revision by one other user not shown)
Line 5: Line 5:
 
<tr style="font-size:1em;">
 
<tr style="font-size:1em;">
 
   <td align="right"><b>Version Number:</b></td>
 
   <td align="right"><b>Version Number:</b></td>
   <td align="left">1.6</td>
+
   <td align="left">2.1</td>
 
</tr>
 
</tr>
 
<tr style="font-size:1em;">
 
<tr style="font-size:1em;">
 
   <td align="right" ><b>Date Released:</b></td>  
 
   <td align="right" ><b>Date Released:</b></td>  
   <td align="left">12 February 2009</td>
+
   <td align="left">23 March 2009</td>
 
</tr>
 
</tr>
 
<tr>
 
<tr>
Line 17: Line 17:
 
   <td colspan="2" align="left">
 
   <td colspan="2" align="left">
 
     <ul>
 
     <ul>
     <li>Added Web browsers cache analyzer
+
     <li>Added support for more than 70 Motorola phones
     <li>Added support for 200+ Samsung phones
+
     <li>Added To-Do list/Tasks extraction
 +
    <li>Added extraction of E-mail and MMS attachments
 +
    <li>Added extraction of Web browser bookmarks
 
     </ul>
 
     </ul>
 
   </td>
 
   </td>
Line 28: Line 30:
 
   <td colspan="2" align="left">
 
   <td colspan="2" align="left">
 
[[Image:OFS2_02_EventLog.png|200px|thumb|center|Event log]]
 
[[Image:OFS2_02_EventLog.png|200px|thumb|center|Event log]]
[[Image:OFS2_04_LifeBlog.png|200px|thumb|center|LifeBlog with GPS mapping]]
+
[[Image:OFS2_04_LifeBlog.png|200px|thumb|center|Geo event positioning (LifeBlog) data]]
 
[[Image:OFS2_05_FileBrowser.png|200px|thumb|center|File Browser with Hex viewer]]
 
[[Image:OFS2_05_FileBrowser.png|200px|thumb|center|File Browser with Hex viewer]]
 
[[Image:OFS2_08_MessagesExportPDF.png|200px|thumb|center|Sample report]]
 
[[Image:OFS2_08_MessagesExportPDF.png|200px|thumb|center|Sample report]]
Line 36: Line 38:
 
</table>
 
</table>
  
===Brief===
+
'''Oxygen Forensic Suite 2''' is a mobile forensic software for logical analysis of [[cell phones]], [[SmartPhones|smartphones]] and [[PDAs]] developed by [[Oxygen Software]]. The suite can extract device information, contacts, calendar events, [[SMS]] messages, event logs, and files. In addition, the vendor claims the suite can extract metadata related to the above. As of March 2008 the suite supported more than 1,350 devices, including [[Nokia]], Vertu, [[Sony Ericsson]], Samsung, Motorola, [[BlackBerry|Blackberry]], Panasonic, Siemens, HTC, HP, E-Ten, Gigabyte, i-Mate and other mobile phones. The suite also supports devices running [[symbian|Symbian OS]] and [[Microsoft Windows Mobile|Windows Mobile 5/6]].
  
[http://www.oxygen-forensic.com/ Oxygen Forensic Suite 2] by [http://www.oxygen-software.com/ Oxygen Software] is a mobile forensic software for logical analysis of [[cell phones]], [[SmartPhones|smartphones]] and [[PDAs]]. The authors claim that using advanced data access protocols helps to extract much more data than usually.
+
== Forensic Soundness ==
  
===Regular data extraction===
+
The suite access devices using advanced proprietary protocols. Some devices like smartphones require an Agent installation. Of course, installing software onto the device being examined will impact the forensic soundness of the investigation. If such information is not obtainable by other means and the impact is documented, it may still be admissible under the [[Best Evidence Rule]].
Oxygen Forensic Suite 2 is able to extract general data like:
+
* device information (IMEI, SW and HW versions, operator, etc),
+
* contacts (names, phones, notes)
+
* calendar events,
+
* messages ([[SMS]]),
+
* log records (incoming/outgoing/missed).
+
* files (images, sounds, videos, documents, etc)
+
  
===Unique data extraction===
+
== Previous Names ==
Besides the general data usually extracted, Oxygen Forensic Suite 2 can extract a lot of unique information:
+
Oxygen Forensic Suite was previously marketed as "Oxygen Phone Manager II (Forensic Edition)"
* contacts (last date of contact modification, contacts photos, field labels, contact groups and speed dials)
+
* calendar events (last date of event modification, all event dates, alarm status, recurrences)
+
* messages (e-mails and MMS, messages from custom folders, message SMSC time stamp)
+
* log records ([[GPRS]], [[EDGE]], CSD, HSCSD and Wi-Fi session traffic and time, deleted SMS details)
+
* files (file system from phone memory and flash card)
+
* Geo event positioning (LifeBlog) data (all main phone events like sms, photos, events '''with their geographical coordinates'''),
+
* Web browsers cache analyzer (extracts and allows to examine cache files such as a list of Internet sites and downloaded files of mobile web browsers)
+
'''Important!''' The list of supported features depends on a certain phone model.
+
  
===Device coverage===
+
== External Links ==
By the October, 2008 Oxygen Forensic Suite 2 supports more than '''1300 devices''': [[Nokia]], Vertu, [[Sony Ericsson]], Samsung, Motorola, [[BlackBerry|Blackberry]], Panasonic, Siemens, HTC, HP, E-Ten, Gigabyte, i-Mate and other mobile phones.
+
Oxygen Forensic Suite 2 has a strong support for [[symbian|Symbian OS]], [[symbian|Nokia S60]], Sony Ericsson UIQ, [[Microsoft Windows Mobile|Windows Mobile 5/6]] and [[BlackBerry|Blackberry]] [[SmartPhones|smartphones]] and communicators.
+
 
+
===Other===
+
* The software access devices without using standard protocols like AT, OBEX or SyncML. The Agent installation is required to access smartphones and communicators.
+
* The software is able to perform data search, to create and print reports.
+
* The software has a full support of Unicode standard. So the multilanguage information is read and shown correctly.
+
 
+
===History===
+
Oxygen Forensic Suite 2 is a third generation of forensic tools by Oxygen Software.
+
* 2004, March. Oxygen Phone Manager II for Nokia phones (Forensic Edition) is released.
+
* 2005, November. Oxygen Phone Manager II for Symbian OS smartphones is released.
+
* 2007, June. Oxygen Phone Manager II (Forensic Edition) becomes a stand alone project with new name "Oxygen Forensic Suite"
+
* 2008, May. Oxygen Forensic Suite 2 is released and presented at Mobile Forensics World 2008. 
+
 
+
===Links===
+
 
* [http://www.oxygen-forensic.com/ Official web site]
 
* [http://www.oxygen-forensic.com/ Official web site]
* [http://www.oxygen-software.com/ Oxygen Software web site]
 
  
 
[[Category:Windows Mobile]]
 
[[Category:Windows Mobile]]
 +
[[Category:Mobile device tools]]

Revision as of 08:23, 23 March 2009

Current version
Version Number: 2.1
Date Released: 23 March 2009
Recent changes
  • Added support for more than 70 Motorola phones
  • Added To-Do list/Tasks extraction
  • Added extraction of E-mail and MMS attachments
  • Added extraction of Web browser bookmarks
Screenshots
Event log
Geo event positioning (LifeBlog) data
File Browser with Hex viewer
Sample report

More screenshots ...

Oxygen Forensic Suite 2 is a mobile forensic software for logical analysis of cell phones, smartphones and PDAs developed by Oxygen Software. The suite can extract device information, contacts, calendar events, SMS messages, event logs, and files. In addition, the vendor claims the suite can extract metadata related to the above. As of March 2008 the suite supported more than 1,350 devices, including Nokia, Vertu, Sony Ericsson, Samsung, Motorola, Blackberry, Panasonic, Siemens, HTC, HP, E-Ten, Gigabyte, i-Mate and other mobile phones. The suite also supports devices running Symbian OS and Windows Mobile 5/6.

Forensic Soundness

The suite access devices using advanced proprietary protocols. Some devices like smartphones require an Agent installation. Of course, installing software onto the device being examined will impact the forensic soundness of the investigation. If such information is not obtainable by other means and the impact is documented, it may still be admissible under the Best Evidence Rule.

Previous Names

Oxygen Forensic Suite was previously marketed as "Oxygen Phone Manager II (Forensic Edition)"

External Links