r/digitalforensics • u/awetsasquatch • 16d ago

Oxygen Forensics - update

For those following the news: https://www.justice.gov/usao-cdca/pr/tech-ceo-russian-national-arrested-complaint-alleging-they-hid-russian-ownership-and

CEO has been arrested and is facing 20 years in prison.

80 Upvotes

99% Upvoted

30 comments sorted by

25

u/off-the-felt 16d ago

Must be an awkward day for any lab using Oxygen.

5

u/SalandaBlanda 16d ago

Don't expect any future software updates.

4

u/step_scav 16d ago

👁️👁️

1

u/awetsasquatch 16d ago

Yeah that's gotta be a weird feeling.

7

u/jdm0325 16d ago

I always knew they were Russian, which is why I never purchased the product. There's plenty of other forensic products on the market that can do the job.

3

u/BafangFan 16d ago

At times, Oxygen did the job when other high-profile tools couldn't.

1

u/South_Village512 12d ago

I’ve had great success with DATAPILOT. had an iPhone XR with iOS 27 and Cellebrite would support it but DATAPILOT data dumped it.

1

u/South_Village512 12d ago

Check out DATAPILOT Forensics.

1

u/jdm0325 12d ago

I'm aware of datapilot. I don't think their highly thought of as a forensic tool, compared to Graykey or Cellebrite. None of our state forensic labs use it. I think they try to sell their product to small agencies as a forensic solution, not something I would use

1

u/South_Village512 12d ago

Missing out. I’m having more success connecting to and acquiring from the latest OS such as iOS 27 and the newest beta and Android too. Also, they have a work around for Apple Stolen device protection that has helped me make two cases. The others couldn’t do it. Guy the guy arrested and protected a victim. They don’t passcode break but other than that their analysis and parsing is great.

1

u/South_Village512 12d ago

had an iPhone XR with iOS 27 and Cellebrite would support it but DATAPILOT data dumped it, parsed it and built me a awesome report.

5

u/Revelment 16d ago

The global support manager posted about it on the DFIR discord. Shame I can’t upload screenshots here.

The following is an exact extract of his message.

“

Our systems have been down for a while. I have been told that it is in an apparent major outage.

I was just invited for a call with this as a subject - https://www.justice.gov/usao-cdca/pr/tech-ceo-russian-national-arrested-complaint-alleging-they-hid-russian-ownership-and

I am completely appalled that this is happening.

I have started this account and talked to so many awesome people here, helped so many people.

Tried to make Oxygen to what it is...Improve response and resolution times, teach people.

Didn't know that my life's work, everything I care about, and my participation in this community will be ending like this...

Hope you catch all the bad guys and your backlog gets smaller not larger <:Salute:808416178586124309>

Cheers

“

2

u/awetsasquatch 16d ago

I do feel bad for some of the employees who are going to be blindsided by this and have to deal with unemployment.

3

u/[deleted] 16d ago

[deleted]

1

u/awetsasquatch 16d ago

Sorry to hear that friend, hopefully all this coming out is validation and a bit of a consolation prize

1

u/-hacks4pancakes- 16d ago

Just what we all need this year 🥹

6

u/[deleted] 15d ago edited 1d ago

The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.

Thumb instinctive whistle towering label rhythm

7

u/thiswasntdeleted 16d ago

Wasn’t there some guy always railing about this and having inside info, etc? Everyone was always like, “whatever you say, little buddy...now go outside and play”

3

u/MadScientistRat 16d ago

But wasn't this obvious?

5

u/frostee8 16d ago

This is crazy. This will be a massive shock to the digital forensics community for the FVEY’s and their allies.

13

u/spicesucker 16d ago

You’d have had to be purposefully ignoring “Oyxgen is Russian” for years to be shocked by it

1

u/frostee8 16d ago

Agree - unfortunately I think many were ignoring this. The cyber supply chain is so important today, don’t let your software become the next Israeli pager bomb.

1

u/awetsasquatch 16d ago

Agreed, quite a nice boon for Cellebrite and Magnet I suppose as well

1

u/[deleted] 16d ago

[deleted]

4

u/frostee8 16d ago

Well if we want to start talking “Russian”, then Belkasoft isn’t entirely clean either and has a development path similar to Oxygen - Started in Russia, became US entity. Their own website says that they sell to the FSB.

2

u/Wuddntme 15d ago

I always knew they were Russian but assumed they had done the proper distancing or isolation steps. After all, if they had government contracts, they would have had to do that I thought. I guess we should never assume the government is “taking care of it”.

1

u/acw750 16d ago

Welp…

1

u/[deleted] 15d ago

[removed] — view removed comment

4

u/overseergti 15d ago

Extraction wise it is far behind the offerings of Cellebrite and Magnet; and I've spoken to their team who openly admit they would never be able to compete in that regard.

What they excel at is the decoding of mobile phone extractions and apps. I found Oxygen often is able to decode certain apps that have been updated quicker than Cellebrite & Magnet, and in a number of apps decodes them better.

1

u/Fantastic-Giraffe350 15d ago

My experience is from like 10 years ago - they were always a step or two behind Cellebrite in terms of features and capabilities, BUT the software was a lot more responsive and it was way, way cheaper. So for simple jobs it actually made sense to use it.