Product Type

Why You Want It


Oxygen Forensic® Detective is an all-in-one forensic software platform built to extract, decode, and analyze data from multiple digital sources: mobile and IoT devices, device backups, UICC and media cards, drones, and cloud services. Oxygen Forensic® Detective can also find and extract a vast range of artifacts, system files as well as credentials from Windows, macOS, and Linux machines.


The cutting edge and innovative technologies deployed in Oxygen Forensic® Detective include, but are not limited to, bypassing screen locks, locating passwords to encrypted backups, extracting and parsing data from secure applications and uncovering deleted data.


Furthermore, multiple extractions can be investigated in a single interface to gain a complete picture of the data. By using the integrated industry-leading analytical tools to find social connections, build timelines, and categorize images, law enforcement, corporate investigators and other authorized personnel can help make this world a safer place.


Oxygen Forensic® Detective is distributed in a USB dongle and is valid for a single user.


Recommended System Requirements:


  • Intel® Core™ i7,
  • 32 GB DDR4,
  • 1TB SSD / HDD,
  • Nvidia Graphics,
  • Windows 10 64 bit.


Accounts and passwords

Decrypt passwords and authentication tokens to user accounts in Social Networks, Messengers and Email apps. Reveal passwords that were used to connect to Wi-Fi networks.


Advanced physical methods

Physical collection while bypassing device security.



Extract, decrypt and examine user data from today’s most popular apps.


Backup and image import

Import and parse various backups and images made from today’s devices like iOS, Android, and more as well as import from other forensic tools like Cellebrite and MSAB.



View dialed, answered and failed calls including deleted ones. Apply filters to show calls only for a specific period of time.


CDR analysis

Process and analyze call data records obtained from wireless providers. Visualize geo coordinates on the map and identify links between callers.


Cloud data

Gain access to cloud services like: WhatsApp, Telegram, iCloud, Google, Samsung, Microsoft, Facebook, Instagram, Twitter and many other social media cloud services.



Uncover and reveal names, usernames, emails, and more in different sources on the device.


Data Reports

Customize and generate data reports in many formats like PDF, XLS, RTF, XML and HTML.


Data search

Powerful global search over a single device, multiple devices or entire case.


Device information

View the detailed information about the device and its owner.


Drone data

Extract and analyze drone data from physical dumps, drone logs and mobile applications.


Encrypted backups and images import

Find passwords to encrypted backups and images by using various attacks and optimize the attacks to deliver unrivaled results in record speeds.


Facial categorization

Categorize human faces using the built-in facial recognition technology.



Access a devices photos, audio and video files, databases and other acquired evidence at the file-system level. View any file in a raw, hex mode, native view.


Geo data

Extract and view geo coordinates from various sources: applications data, photo and video EXIF headers, history of Wi-Fi connections, etc.


Image categorization

detect significant images including pornography, extremism, drugs, guns, etc with the built-in image categorization engine.


IOT device support

Extract and analyze data from IoT devices.


Key evidence

Mark important entries as key evidence in any program section and view them later in a single list.


Keyword search

Create and use keyword lists to quickly find the relevant data during or after data extraction.


Live data extraction

Extract data from mobile devices based on iOS, Android, Windows Phone, Windows Mobile, Blackberry, Bada OS or feature phones. Additionally, acquire device media and SIM cards.


Locations visualization

Open geo coordinates on the built-in Maps, visualize user’s movements, determine his frequently visited places and find out if several people were at the same time at the same place.



Gain access to SMS, MMS, Email and iMessage communications and read them either in Table or Chats view.


Optical character recognition

Automatically convert text on photos into machine-encoded text.



Extract and recover user’s calendars, notes and tasks. Decode iOS encrypted notes.


Plist viewer

Open and examine. plist files found in iOS device extractions. Use Converter panel to convert values into a readable format.


Social graph

Explore social connections between the device owner and his contacts or between several devices by analyzing calls, messages and app communication activities.



Navigating the enormous amount of data efficiently has always been our development objective. To prove this point, we have introduced the Statistics section that offers an overview of the entire extraction and allows the investigator to quickly identify sections of interest.


SQLite viewer

Examine SQLite databases, recover deleted data, convert values, build SQL queries, perform search and export selected entries to reports.



View all events in a chronological order: chats, calls, voicemails, photos and videos history, wi-fi connections, geo files and web cache.


User data collection on computer

Collect credentials and passwords on computer using Oxygen Forensic® KeyScout.


Webkit data

Parse user’s emails from webmail interface and content of visited webpages. Gain access to email messages, web search history, locations and other data stored in WebKit databases.


Wireless connections

Find out when and where the device owner used Internet access and gather information about frequent locations of iOS users.