#Oxygen Forensics Android Examination Ios#
#Oxygen Forensics How To Do As#

So, itвЂ™s safe to say that I spend a lot of time becoming familiar with the tools, learning what I am able to trust and where they ultimately fail me.OXYGEN FORENSICS Oxygen Forensics is known primarily for its easy-to-use interface. I also use these tools for my regular job, where I aim to find gaps and then fill them with my own methods and tools. I test tools thoroughly and include the best ones in the SANS FOR585 Advanced Smartphone Forensic course that I co-author. I have been using Oxygen for years and this last update has really impressed me. Free Hex Editor Neo is a basic hex editor that was designed to handle very large files. If you are investigating a case that requires you to gather evidence from a mobile phone to support your case, Oxygen Forensics Suite (Standard Edition) is a tool that will help you achieve this.

Is it the vendorвЂ™s fault вЂ“ No! The phones are hard to keep up with and the version updates on each OS make it even harder, but examiners like to press the вЂњFind EvidenceвЂќ button and that makes me shiver. Addeddate 09:06:18 IdentifierNormally, I have a hard time seeing the good side of tool output because the artifacts are often so convoluted and misleading to examiners who donвЂ™t know any better. Topics program Collection opensourcemedia Language English. Perfect for R&D, life science biotech research, personal protection, ambient air measurements, industrial applications, and continuous O2 process monitoring.Oxygen Forensic Suite 2014 6.3.0.900 Multilanguage. Details: The professional OXYGEN gas detector by FORENSICS has all the advanced features and functions, made with the highest quality electrochemical sensors.

Now that, is the key to success right there. This tool is fantastic at supporting the parsing of third-party apps and when it canвЂ™t вЂ“ guess what? It will give you a cheat sheet for the files you must MANUALLY examine. Why should you care? Because you are going to see smartphones with third-party applications on them. This tool has made my life so much easier! I am going to highlight some of my favorite new features. I have always loved the PList Editor and SQLite Viewer, but that is really where my love existed вЂ“ until recently, that is. DonвЂ™t get me wrong, there is never enough time, but some things are worth digging for and verifying!What changed my mind about Oxygen? Well, itвЂ™s not that I was ever against the tool, I just didnвЂ™t see how it added value to my everyday work or smartphone course until this latest release.

Oxygen Forensics How To Do As

Oxygen has been helping me see what I need to hone in on and then allows me to keep my deep dive all within the tool.My normal application analysis process involves (Note: since this blog is about my Oxygen experience, I am highlighting how to do as much of the examination as possible in that tool): Tools should be used to triage what you need to focus your efforts on. Now will this tool get it right every time? No, but it gets you a little bit closer. This includes popular apps like Facebook, Facebook Messenger, WhatsApp and those less popular ones that will shock you when you load your image file and see the glorious application data parsed for you.

Examining any other files of interest pertaining to the applications (xml, dat, multimedia, etc) PList of interest (using the Apple PList Viewer in Oxygen Detective) Leveraging the SQL Editor to draft my own queries to parse and join tables of interest (No experience here? Try the query builder that is built in to learn) Combing through each relevant database and examining for both active and deleted artifacts of interest (via SQLite Database Viewer in Oxygen Detective) Identifying apps of interest and going directly to the application directory for manual examination and verification (via File Browser in Oxygen Detective) Examining the data for application installation traces

But guess what вЂ“ Oxygen decoded it and correctly displayed the location I was sharing from that app. Even Google maps could not render the broadcasted location from this obscure app. The first tools I tried did not parse this data. For example, I was working an app last week that allowed the user to share their location for a set period of time.

Not everyone has time to thoroughly test all tools, so we, as a community need to test and share our results (hence most of my blog posts).LetвЂ™s take a look at some examples. A tool that was great two years ago could be useless today, so you need to keep up and always test and validate with datasets you trust. Add another thing to the list on what is impressing me about Oxygen.I aim learn the strengths (and weaknesses) of each tool and tool feature and impart that wisdom on my students.

Few tools will provide you the location for all of the files associated with the app. This tool gives me a quick reference to the files associated to the application and leaves the rest to me, which I prefer and appreciate. Some of these were parsed and a lot them were not. Below, I scanned the files associated to WhatsApp. From there, I select the ones of interest and start looking at the actual files. As previously mentioned, I start by looking at the apps that are parsed vs which are installed.

This is helpful to those of us who are lazy and do not enjoy opening every file and examining the data in separate windows.After exhasting my examination of the apps themselves, I went to the webkit and browser for more hunting. Below I was examining a log file associated to WhatsApp without navigating from my list of app files. What I really like is the ability to get a glance of what is stored within each file without opening each one. If you have other tools you prefer, simply export the file and go on your merry way. Some required queries and the recovery of items marked for deletion, all of which is possible within the tool.

The SQL Editor was used in this example.The mapping was great in this tool, but I have decided to omit those screenshots, since it highlights my home location. This can be exported and included in my report template. I drafted a SQL query and joined two tables to show the results I needed for my forensic examination. I am simply showing the raw files associated with webkit activity.Below I am showing an example of a localstorage file that I wanted to customize to fit my examination needs. I normally conduct a simple keyword search in my tool of choice for вЂњlocalstorageвЂќ, but this way was much easier and eliminated the need for that step.В As a side note, Oxygen did a great job parsing these files.

A simple example: I receive an iMessage with an attached photo. The tools have a hard time interpreting how the location got onto the phone. If you have heard me present on location artifacts in tools, it is commonly a WARNING to tread carefully.

Go Oxygen!In summary, this was just a short blog post highlighting the successes I have been having with Oxygen. I was thrilled that Oxygen parsed that location information, especially because Google Maps was throwing fits when I was attempting to manually render the lat/longs. Hence, be careful! The reality is that the the cool artifacts used and created by third-party apps use are often overlooked. This is how someone without a lot of experience may interpret that evidence. The location from the shared photo shows up in my report as if my device was there. I dump my phone and look at the locations.

Oxygen Forensics Android Examination Ios

I recommend you always get a physical dump and logical or backup to help you parse the data. There are so many tools and methods available that most people can figure out a way to get the data. This is simply a quick blog to highlight what has helped me in the past 6+ months.I am not going to dive too deep into acquisition. Again, I am not including every single tool out there or highlighting all of their capabilities, so if one is missing that you find useful, please post in the comments. Mention my blog! android examination ios OxygenHappy Saturday everyone! Several of my SANS FOR585 students have asked me to document my opinions on what tools I like and how I find them to be helpful.

Make sure you test your tools and test them often. Smartphones are beasts and security is getting stronger. Each tool has their pros and cons and itвЂ™s a bad idea to only have one tool in your toolbox.