Oxygen Forensic Suite - GETTING STARTED - SME

Oxygen Forensic Suite 2012 is mobile forensic software that goes beyond standard logical 

analysis of cell phones, smartphones and PDAs. Use of advanced proprietary protocols and phone APIs 

makes it possible to pull much more data than can be extracted by forensic tools utilizing standard 

logical protocols, especially for smartphones. 

Oxygen Forensic Suite 2012 helps you to extract most of the information from a great 

majority of mobile devices for investigation purposes. This program has played a significant role in 

criminal and other investigations all over the world and is used by Law Enforcement units, Police 

Departments, army, customs and tax services and other government authorities. 

Current software version provides access to the following sections: Phonebook, Calendar, 

Tasks, Notes, Messages, Event Log,File Browser and Extras (Timeline, Geo Event Positioning(LifeBlog), 

Web Connections and Location Services, Applications, Web Browsers Cache Analyzer, Dictionaries, Skype 

Analyzer, Google Services, Yahoo Services, Foursquare). Note that the number of sections and list of 

extractable data fields depends on the device model. 

You can examine: 

Common phone information and SIM-card data (contacts and messages) 

Contact list (including mobile, wire line, fax numbers, postal addresses, e-mails, 

contact photos and other contact information) 

Missed/Outgoing/Incoming calls 

Caller Groups information 

Organizer data (calendar meetings, appointments, memos, call reminders, 

anniversaries and birthdays, to-do tasks) 

Text notes 

SMS messages (messages, log, folders, deleted messages with some restrictions) 

Multimedia Messageswith attachments 

E-mail messages with attachments and folders 

GPRS, EDGE, CSD, HSCSD, Wi-Fi session log and traffic amount 

Photos and gallery images 

Video clips and films 

Voice records and audio clips 

All files from internal phone memory and flash card including installed applications 

and their data 

FM Radio Stations database - as a part of File Browser 

LifeBlog activity: track of all main events in chronological order with geographical 

coordinates 

GPS and XMP coordinates stored in camera snapshots 

Web browsers bookmarks and cache files 

iPhone password-protected backups 

Skype information 

Wi-Fi and IP connections 

Phone dictionary words

Oxygen Forensic Suite 2012 offers an easy and convenient management of all examined 

devices in one window: phone properties, case details and status, the person in charge of it, etc. 

Mobile device information analysis can be done from the program directly or with the help of 

advanced export function. You can create reports in the most popular file formats (XLS, RTF, PDF, XML, 

CSV, TSV, etc.) and either print or send them to remote departments and experts. 

The program has a powerful built-in search engine. You can easily find the necessary 

information in all the sections with few mouse clicks in Oxygen Forensic Suite 2012. What is important, 

the search results are saved between sessions and can be either exported or printed. Besides, a 

contextual filter in every section helps you to sort out the data the way you need it. 

Moreover, the software allows you to save extracted data to a file and then load it into the 

program on another computer. Thus you need to connect a phone and extract data only once and then 

send the extracted information outside, e.g. for analysis by remote experts. 

Current version supports about 2500 mobile devices from Nokia, Apple, RIM 

(Blackberry), Google, Samsung, Sony Ericsson, Motorola, Panasonic, LG, HTC, Asus, HPand 

other manufacturers. Oxygen Forensic Suite 2012 has a strong support foriOS, Android, 

Symbian OS, Blackberry and Windows Mobile(ActiveSync is not required) smartphones.The 

list of supported models is rapidly growing. To get the latest Oxygen Forensic Suite 2012 

version supporting your mobile device visit Hhttp://www.oxygen-forensic.com/en/H. 

Oxygen Forensic Suite 2012 supports USB cable connection, Bluetooth (Microsoft, Widcomm) 

connection, infrared connection using IrDA stack. Support for different types of connection depends on 

the phone series and model; check Oxygen Forensic Suite 2012 help file. 

The software works under 32-bit or 64-bit versions of Windows 7, Windows Vista, Windows 

XP, Windows Server 2003 and Windows 2000.

Oxygen Forensic Suite 2012 is distributed in two licensing systems of the program – an Internet 

license with hardware binding and a license with USB dongle. 

Run OxyForensic_Setup.exe installation package and follow the Setup wizard: 

On the next screen you must carefully read and accept the License agreement, if you agree: 

Then you can read the release notes:

Select the folder to install Oxygen Forensic Suite 2012: 

Choose the folder for program shortcuts:

You can specify the wizard to enter registration key (if you are using Internet license), create 

Desktop and Quick Launch icons: 

Check all settings and press “Next” button to start installation:

Enter the key you received from us (Internet license only): 

When installation is completed, you can choose to look through release notes, 

presentation, view Getting Started Guide and launch Oxygen Forensic Suite 2012: 

run

To use Oxygen Forensic Suite 2012you need to activate the license. The activation process differs 

according to the license type. 

 

To start working with Oxygen Forensic Suite 2012 you must have an Internet connection and 

activate the program. Press “Yes” to start the activation: 

Send your activation request via e-mail, WEB or save it to file:

Enter the key as soon as you receive it and restart Oxygen Forensic Suite 2012. 

 

Oxygen Forensic Suite 2012 USB dongle license must be used with a USB dongle that is 

bundled with your Oxygen Forensic Suite 2012package. For this license no Internet connection is 

required. After Oxygen Forensic Suite 2012 installation please insert a USB dongle into the USB port, 

wait till the driver initialization and start the main program. 

Please note that USB dongle should be inserted all the time during your work with Oxygen 

Forensic Suite 2012. 

 

To be able to work with a phone you must make sure it is supported in current version of the 

software and all corresponding drivers and software modules are installed. Refer to the Oxygen Forensic 

Suite 2012 help file to learn what must be done in case of concrete phone model. 

To extract information from cell phone, smartphone, PDA or any other mobile device, you 

must first connect it to the program. If you use cable connection, attach the phone to the cable. For 

Bluetooth or infrared connection, activate it in the phone and make sure the phone is visible and 

accessible. 

Press “Connect new device” buttonand Oxygen Connection Wizard will start. Select the 

desired connection type – USB cable, Bluetooth or Infrared. The list of available connection types 

depends on the mobile device capabilities and hardware installed on your computer.

Important: Different mobile devices may require different connection procedures. For more 

information please refer to Oxygen Forensic Suite 2012 help file. 

Oxygen Connection Wizard will start searching for the phone: 

If you want to extract data from Symbian OS smartphones, Windows Mobile 5/6and Android 

devices, Oxygen Forensic Suite 2012will load small agent application into the phone. This application 

does not modify any personal data in the phone and provides facility to read much more information 

than it is possible with standard protocols like SyncML, OBEX or AT. Please select an option suitable for 

you:

Press “Upload” button to load OxyAgent application into the device: 

When the application is loaded, find it in the device menu and install it. Do not be afraid of 

that operation. Mobile devices have separate storage for applications and data, so OxyAgent installation 

will not modify any personal information in the phone.

Start OxyAgent application in the phone and select the desired connection type. After that 

press “Connect” button in Oxygen Connection Wizard. Once connection is established, the program will 

display phone information: 

 

Now you are ready to begin extracting data from the connected phone. When Oxygen 

Forensic Suite 2012 finds the phone, it will start Data Extraction Wizard automatically:

You can enter a device information, notes and case data: 

Enter the device owner numbers if your know any:

Select the information to be read by Data Extraction Wizard. Note that specific files and 

directories can be read later if needed. Please also be informed that the list of available sections 

depends on the mobile device capabilities. 

Check all the needed settings and press “Extract” button to start data extraction:

When all data is extracted, you can choose either to open the device for viewing and 

analyzing data or to run Export and Print wizard if you need to get fast report about the device. 

Note that you can run Export or Print Wizard anytime when working with device information.

“Devices” section lists all the devices connected and seized previously as well as actions 

available for them. 

 

Backup Extraction Wizard will help you to import data and place the device into data base for 

the convenient work with its information. 

You can load Oxygen, iTunes password-protected (with a known password), DMG and IPD 

backups with a specially created Backup Extraction Wizard by pressing the button:

Select backup type you would like to restore: 

Browse for a backup file on your PC:

Check the setting before restore procedure: 

When backup data is extracted, you can choose either to open the device for viewing and 

analyzing data or to run Export and Print wizard if you need to get fast report about the device.

You can view Device information in a separate window: 

“Phonebook” section contains contact list (including SIM-card contacts) with personal 

pictures, custom field labels and speed dials. It also allows to filter contacts by caller groups:

“Calendar” section displays all meetings, birthdays, reminders and other events: 

“Tasks” section displays all the tasks with priority marks and their date/time:

“Notes” section allows to view notes with their date/time:

SMS (even deleted from message folders in the phone), MMS, E-mail, Beamed and messages 

of other types are shown in “Messages” section: 

Important: At the moment of writing this document Oxygen Forensic Suite 2012 is the only 

forensic tool able to access SMS, MMS and E-mail messages stored in custom folders for Symbian OS 

smartphones. 

Previously deleted messages are also shown in the “Messages” section and are highlighted 

with a different color and marked by a “basket” icon. 

Note that reading deleted messages information feature has several restrictions: 

 

 

 

Available for Symbian OS smartphones only (except UIQ2 models) 

The message must not be older than the number of days specified by “Log duration” 

parameter in system Log application 

Only part of message text will be read (up to 64 characters). 

Important: Many forensic tools providing logical data access declare “Reading deleted SMS” 

feature but few of them notify customers that it works only for SMS messages which had been stored on 

SIM card. Oxygen Forensic Suite 2012 does not include this feature intentionally because the 

overwhelming majority of modern phones do not store any personal information on SIM card. 

“File Browser” section gives you an access to the entire mobile device file system, including 

photos, videos, voice records and other files:

Incoming, outgoing, missed calls history, SMS and MMS sent and received GPRS and Wi-Fi 

sessions – all this information is available in “Event Log” section:

Current Oxygen Forensic Suite 2012version contains new Extras section. Its contents depend 

on the license type. PRO version consists of Geo Event Positioning (LifeBlog), Web Browsers Cache 

Analyzer, Web Connections and Location Services, Dictionaries and Skype Analyzer. Analyst license 

additionally contains Timeline data, Applications, Google Services, Yahoo Services, Foursquare and 

several viewers: SQLite Database Viewer, Apple Plist Viewer, Nokia PM Viewer and Blackberry IPD 

Viewer. 

 

Many of Nokia smartphones have preinstalled Nokia LifeBlog application. This application also 

can be downloaded from Nokia site and installed manually into many other smartphones based on Nokia 

S60 3 rd Edition platform. The primary purpose of Nokia LifeBlog is to organize digital photo album and 

notes to publish them on blogs. But we at Oxygen Software discovered that LifeBlog stores a lot of 

information that can be very interesting for forensic investigations: 

 

 

 

 

List of photos made with phone camera with their date/time 

List of sent/received SMS messages with their date/time and cellular network 

coordinates (LAC, MCC, MNC and CellID) where SMS was sent or received (depends 

on LifeBlog version and data availability) 

List of text notes entered with their date/time 

Geographical position of the event on the map (using mini Google Maps)

Oxygen Forensic Suite 2012 extracts an approximate geographical positioning of the place 

where the photo was made. Mini Google Maps are generated and shown according to these coordinates 

right in the program. Feature is available for Apple iPhone, iPod Touch, Symbian Series 60, Windows 

Mobile and Sony Ericsson mobile devices and photos with GPS coordinates. 

 

Web Browsers Cache Analyzer allows to extract and examine cache files such as a list of 

Internet sites and downloaded files of mobile web browsers (preinstalled as well as 3 rd party ones). 

 

Timeline add-on for Oxygen Forensic Suite 2012 organizes all calls, messages, calendar 

events and other activities in a chronological way so it is easy to follow the conversation history without 

any need to switch between different sections.

All data can be sorted, filtered and grouped by dates, contacts or phone numbers.

Skype becomes very popular nowadays due to its cheap or even free calls. This application 

also can be downloaded for free and installed manually into smartphones. The mobile device owner can 

store a lot of important information inside Skype. He can chat, call, send SMS messages and transfer 

files without using regular mobile device functions but with the help of Skype. 

The following information that can be very interesting for forensic investigations: 

 

 

 

 

 

List of Skype accounts stored in the mobile device 

Chat messages with chat history 

List of sent/received SMS messages with their date/time 

List of calls with their date/time 

List of contacts 

At the moment this feature is available for Apple iPhone and Windows Mobile devices.

Web Connections and Location Services section shows all web connections in one list and 

allows to examine hot spots on the map. According to this list forensic experts can find out when and 

where the suspect used Internet access and detect his location. The section consists of three 

bookmarks. 

The first one permits to inspect all Wi-Fi connections (public and even private): 

Oxygen Forensic Suite 2012 extracts an approximate geographical positioning of the place 

where Wi-Fi connection was used. Its accuracy is shown in meters. Mini Google Maps are generated and 

shown according to SSID,BSSID and RSSI information extracted from the mobile device. 

The second bookmark presents the information about IP connections with all the history of 

Web connections (Wi-Fi, GPRS, LTE) and their details: MAC and VPN addresses, device and router IPs, 

DNS name, region, time stamp, etc. It displays geographical coordinates and maps received from Google 

server for all available IP connections.

The third bookmark allows to examine information about Locations. This section presents the 

information about all the network activity of the device (Cell, Wi-Fi and GPS). The section is supported 

for Apple and Android OS devices. 

To show this data consolidated.db file from iPhone is parsed out. Please note that iPhone should have 

iOS 4 or higher. 

To show this data in Android OS devices cache.cell and cache.wifi databases are parsed. You need to 

root Android OS device with a special Android rooting add-on to parse the files.

Applications section shows detailed information about system and user applications installed in 

the device. Most popular applications like Bump, eBuddy, Echofon for Twitter, Facebook, YouTube, 

Flickr, LinkedIn, fring, HeyTell, ICQ, IM+ and many others have a special User Data tab. This tab 

contains aggregated data of the application prepared for convenient analysis (passwords, logins, chats, 

all the messages and contacts used in apps, geo-location of the last run, visited places with coordinates 

and maps etc):

Besides User Data tab Application viewer offers: 

 

 

 

Application information tab - shows the whole application registry from which the data 

is parsed 

Application files tab - presents all the files (.plist, .db, .png, etc.) associated with the 

application 

Application log tab - tab provides you with the information about the dates and times 

the application was launched and used. 

 

Dictionaries section for Oxygen Forensic Suite 2012 shows all the words ever entered in 

device messages, notes and calendar. These are not words from the device system dictionary; they are 

from unique user dictionary that is created by device owner when using it.

An expert can determine the order in which the words appeared, how often each word was 

used, filter and reorder the words in the list. 

Phrase simulation feature is a highly valuable tool for an expert. Using it he can analyze the 

phrases that the suspect typed. It may be a password, an address or even a deleted message. 

 

Google Services section includes sub-sections with information about almost all Google 

applications installed in the mobile device. This section is constantly updated and will include data 

extracted from other Google applications in future versions. 

Google Maps 

Google Maps section gives an opportunity to investigate maps search history, stored bookmarks 

and routes with full addresses and coordinates:

Section is available for Apple devices. 

Google Mail 

Google mail section enables experts to investigate full information from all Gmail accounts:

Google Calendar 

Google Calendar section allows to examine all the user's important events all in one or multiple 

calendars. 

Section is available for Apple and Android devices. 

Google Talk 

Google Talk gives a possibility to analyze Contact list, private and group chats of the stored 

account as well as its search history. 

Section is available for Android devices. 

 

Yahoo Services section which includes Yahoo! Messenger and Yahoo! Mail sub-sections with all 

the important user data such as messages and contacts. 

Yahoo! Messenger 

Yahoo! Messenger section shows all available accounts, contact lists with Yahoo accounts and 

phone numbers, messages and chats: 

Section is available for Apple devices.

Yahoo! Mail 

Yahoo! Mail section displays multiple mail accounts with contacts including Yahoo! mail and 

messenger and phonebook as well as all types of messages. 

 


Foursquare application analyzer allows to examine the user’s most frequently visited venues and 

locations, view all check-ins including tips and comments, check the list of friends and other important 

account information: 


Besides the exclusive information shown in Extras section the approach used in Oxygen 

Forensic Suite 2012offers several significant advantages over other logical forensic tools: 

 

 

 

Support for Symbian OS smartphones, Window Mobile and BlackBerry devices. The 

amount of useful data extracted from these devices considerably exceeds the 

capabilities of other products. 

User-friendly interface for data analysis. The data is grouped according to its classes. 

A convenient search and sorting engine and content filtering are implemented. 

Data extraction from custom SMS folders. Besides standard SMS folders, smartphones 

permit to create custom SMS folders. For example, for messages of a particular type

or for a certain contact. In such folders the most interesting information is usually 

stored. Only Oxygen Forensic Suite 2012 has an access to the messages in custom 

SMS folders. 

Extraction of information about deleted SMS messages. Even if a message was 

deleted from a Symbian OS smartphone, the information about it can be extracted! 

Many other programs can also show deleted messages but on a SIM card only. It is 

very misleading because the majority of phones and smartphones do not store 

messages on their SIM cards, using phone memory instead of it 

Direct access to the data. Access to Windows Mobile devices is possible without 

ActiveSync/Vista Mobile Center that may change the data in the examined phone. 

Access to Event Log in Symbian OS smartphones includes the information about 

GPRS, EDGE, CSD, HSCSD and Wi-Fi activity (besides the standard information about 

calls). 

Access to Event Log in Windows Mobile devices. 

Extraction of contact field labels from Symbian OS smartphones, including the ones 

changed by the user. 

Extraction of the fields of the same type with the same attribute from Symbian OS 

smartphones. The data is fully shown if its types and modifiers coincide with the fields 

extracted before. 

Extended information about contacts. The program extracts the information about 

caller groups and speed dials that can point to the communication frequency between 

the phone owner and specified contacts. 

Extraction of the last modification date of contacts and calendar events. 

Extraction of the message Service Center Time Stamp. This feature is available for all 

Symbian OS smartphones. 

Easy device connection. Data extraction is performed via standard cables and 

adapters. No other expensive equipment is needed. 

Unique Forensic protocol for access to smartphones, created especially for safe 

extraction of maximum information. Standard protocols (AT, OBEX, SyncML) used by 

other software are developed for data synchronization and may change the data of 

the examined device. 

Data extraction from exclusive devices, like Vertu and Mobiado. 

Most of the information above is not accessible via standard communication protocols used 

by other logical forensic tools - SyncML, OBEX or AT command sets. Besides their limitations these 

protocols have another big disadvantage – all of them had been developed for information 

synchronization purposes that does not meet forensic requirements. 

Oxygen Forensic Suite 2012 uses advanced proprietary protocol developed specially for 

forensic information extraction and analysis. To implement this protocol we put a small OxyAgent 

application there. This approach has several benefits: 

 

 

 

Using our own communication protocol we can be sure that all the personal 

information is untouched in the device 

Agent application runs inside a phone and in phone OS therefore it can access much 

more data than the one available with generic protocols 

Oxygen Forensic Suite 2012 does not use ActiveSync application to get information 

from Windows Mobile 5/6 devices so there is no risk that device information can be 

changed if ActiveSync decides to run synchronization process.

Rooting a device based on Android OS reveals the complete set of user data to the investigator. 

Generally this procedure needs certain knowledge, but Oxygen Forensic Suite product can do this for 

you automatic mode. 

Rooting procedure becomes the part of Data Extraction Wizard that will guide you through the 

whole process to gain the root rights to the device. 

The important benefit of the proprietary method is that the root access will be revoked 

immediately after rebooting the device. This method makes rooting and further extraction completely 

forensic and safe. 

Android Rooting add-on grants an access to: 

 

 

 

 

Full file system, stored both on internal memory and memory card 

Application saved data including logins, passwords, history, cache and much more 

Geo-location information for tracking suspect position in the past 

Deleted data in database tables 

The procedure is available for the most of Android devices with versions 2.0-2.2. 

Oxygen Forensic Suite 2012 is the only smart phone forensics software that allows automatic rooting 

and provides powerful in-build tools for data analysis. 

Android rooting add-on is available for the Oxygen Forensic Suite (Analyst) license at additional cost.

Oxygen Forensic Suite 2012 contains four viewers that can open database as well as .plistand 

backup files. Viewers are available in an Analyst license of Oxygen Forensic Suite 2012 only. 

 

SQLite Database Viewer allows to analyzedatabase files from Apple, Android and Symbian Series 

60 devices in SQLite format. These files contain information about SMS, notes, calls,applications cache, 

voice mail information, etc. The main Viewer window presents tables and the information they contain: 

 

Plist Viewer allows to analyze .plist files from Apple devices. These files contain information about 

Wi-Fi access points, speed dials, the last cellular operator, Apple Store settings, Bluetooth settings, 

global applications settings, etc:

Nokia PM Viewer permits to view .pm files made by Nokia firmware updaters from Nokia phones. 

 

Blackberry IPD Viewer permits to explore IPD file tables made by BlackBerry Desktop Manager.

It’s a common situation when you need to find some text, person or phone number in the 

extracted mobile device information. Oxygen Forensic Suite 2012 has two kinds of advanced search 

feature: search for text and search for contact activity. 

data tab: 

To use these features you should go to Device section and switch from Devices to Search 

Search for text function is rather simple, it finds all occurrences of the specified text in all or 

selected phones. Please note that multi-device search is available in an Analyst license only! 

Search for contact feature implements really smart functionality. You can enter only part of 

any contact data – name, phone number or other fields. If the program finds a contact satisfying search 

criteria, it analyzes all phone numbers, e-mails and other fields of this contact and starts searching for 

any of this information through all sections of specified mobile devices. Phone number formatting and 

prefix are not regarded in the search. 

The screenshot above demonstrates the result of contact search function with only one 

criterion – first name. As you can see, the result contains contact entries in two different phones, call log 

and messages sent and received by this contact. If there are any calendar events associated with this 

contact – birthdays, meetings and so on, they will also be displayed. 

By double-click on entry you can switch to the corresponding section of the relevant phone 

for more detailed analysis. All search results are saved and can be reused later.

Oxygen Forensic Suite 2012 allows an examiner to print reports containing all the extracted 

mobile device information. You can select only specific section(s) as well. 

This is an example of how Event Log report section looks like: 

Forensic reports can also be exported to a number of file formats – Adobe PDF, Microsoft 

Excel, Rich Text Format, etc.

Hardware and software you need for connection 

Original USB cable 

Oxygen Forensic Suite 2012 installed on your PC 

Cable drivers from phone manufacturer (recommended, but not strictly required) 

Flash card compatible with the specific device (used as temporary storage when extracting 

data) 

OxyAgent application usage notice 

OxyAgent application must be installed into Android device to extract data. Oxygen Forensic Suite 

2012 installs and uninstalls OxyAgent automatically, so you don’t need to perform any special actions 

about it. 

OxyAgent is a small forensically designed application that allows you to extract the maximum 

amount of data from Android devices. It does not change any personal information inside the device. 

Please be informed that this moment there is no other way to extract data from Android devices 

except the physical analysis. 

Where to find cable drivers 

First of all, before connecting the mobile phone to PC you must install Android cable drivers. You 

can use official drivers from the disc supplied by manufacturer, look for drivers on the manufacturer 

official site or download the drivers package from Oxygen Forensic Suite site: 

http://www.forensicsuite.com/download/drivers/android-drivers.rar. 

Android driver folder taken from the link above consists of two parts: 

Manufacturer folder contains official Motorola and HTC drivers for Motorola CLIQ, DEXT, 

Droid, Heron, Milestone, Sholes and HTC Click, Dream, Hero, Magic, Tattoo devices. 

General folder has drivers for all other Android devices (for example, Google Nexus, T- 

Mobile G3, T-Mobile Pulse). 

We advise you to use General folder drivers when you have connection problems with official 

drivers or they are not available at all. 

If the drivers above do not allow you to connect a device you can look for cable drivers on 

thisofficial site: http://developer.android.com/sdk/oem-usb.html. 

If you have Sony Ericsson device you need to download PC Companion software that includes 

cabledrivers: http://www.sonyericsson.com/cws/support/softwaredownloads/detailed/pccompanion/. 

In case you still experience connection problems you can always contact us at 

support@oxygenforensic.com and we will send you patched drivers for your phone model. 

How to install cable drivers 

To install the drivers from General driver folder please follow these instructions: 

Connect Android device via cable to PC. New Hardware Wizard will be started. Choose Install 

from a list or specific location option and after that Don’t search. I will choose the 

driver to install:

Select Show all devices, press Next button and then press Have disk to continue: 

Then press Browse, select General driver folder on your PC and open android_winusb.inf file 

there. As a result you will get the following window. Press Next to install the driver:

To install the drivers from Manufacturer driver folder you should either run 

Motorola_Consumer_Driver_Installation_MotoConnect.msi file for Motorola Android devices or follow the 

instructions above for HTC Android devices. 

How to check if cable drivers are installed correctly 

After drivers installation is finished you need to check if they are installed correctly. Attach a cable 

to the device and go to Start/Control panel/System/Hardware/Device Manager menu on PC. In ADB 

Interface there should be the name of the Android device you have connected. In our case it is 

Motorola Milestone: 

If you do not see it the drivers were not installed correctly. 

What options to select in the device 

After you installed the drivers you need to perform the following steps before starting our 

software: 

You need to select ‘USB Debugging’ mode in Settings/Applications/Developmentmenu of the 

Android device. This mode enables ADB server in the device that is used during connection:

It is very important to select the correct USB mode in the device when you attach a cable to it. 

For the most Android devices it should be ‘None’. Do not select ‘Memory card management’, 

‘Motorola phone tools’ or ‘Windows media sync’ modes. With these modes Android devices will 

not be connected to Oxygen Forensic Suite 2012: 

Make sure that a flash card is inserted in the device. It should have at least 1Mb free space. 

During data extraction our OxyAgent application uses it to store temporary files that are 

removed when extraction is finished. 

Please note: no other files that were previously saved on a flash card are deleted or modified. To 

be on the safe side, you can also use your own flash card for data extraction. 

How to connect Android device in Oxygen Forensic Suite 2012 

If all the previous instructions are strictly followed launch Oxygen Forensic Suite 2012 and select 

Connect new device option on Common tasks sidebar. Oxygen Connection Wizard will be started. 

Please, choose ‘Connect via cable’ there and wait till the device is found and you are offered to install 

OxyAgent:

Accept OxyAgent installation. After it installs and starts you will see the following window 

informing you that the device is connected: 

Press Next button to finish connection process. After that Device Extraction Wizard will start 

automatically and you can proceed to extract data from the device.

Please note:OxyAgent is automatically uninstalled from the device after data extraction is over. If 

connection was broken or due to some errors the program was suddenly closed please make sure that 

OxyAgent is uninstalled in Settings/Applications device menu. 

Troubleshooting 

In case you have connection problems with Android devices we recommend you to check how 

ADB (Android Debug Bridge utility supplied by manufacturer) is functioning. Please do the following: 

Connect your Android device via cable 

Go to Oxygen Software/Oxygen Forensic Suite 2012/SystemFilesfolder, create a .txt file with 

the contents, like on the screenshot: 

Name it device.bat file and launch it. ADB.exe will be started in the same folder. If ADB utility 

functions well you will see your Android in the list of devices attached. It will have no real name but 

some figures: 

If the list of devices is empty, it means that ADB utility does not work and there will be no 

connection in Oxygen Forensic Suite 2012. Unless you make ADB utility work correctly there is no way to 

extract data using our software. 

If the connection problem persists do not hesitate to contact us at support@oxygenforensic.com. 

We are always glad to help you.


Original USB cable 


Apple iTunes installed on your PC. 

Connection types support for Apple devices 

 

Oxygen Forensic Suite 2012 supports only cable connection for Apple devices. 

Where to find Apple iTunes 

You can install Apple iTunes software from the disc supplied by manufacturer, look for it onthe 

manufacturer official site or download the driver package from Oxygen Forensic site: 

http://www.oxygen-forensic.com/download/drivers/OFS2_Drivers_Pack.zip. 

How to install Apple iTunes from Oxygen Drivers Pack 

To install Apple iTunes start Oxygen_Connectivity_Driver_Setup.exe from the Drivers Pack and 

follow the installation steps. 

What options to check on PC 

 

 

 

 

 

Make sure that you at least once started Apple iTunes after installation and accepted the 

license agreement there. Before connection to our software Apple iTunes must be closed. 

Check if the firmware version in Settings/General/About menu in Apple device is supported by 

our software. As a rule, we add support for a new Apple firmware version a bit later than it is 

released. 

Check if Apple iTunes version is supported by Oxygen Forensic Suite 2012. Please note that 

we support only Apple iTunes v.9.x.x. and 10.x.x. As a rule, we add support for a new Apple 

iTunes version a bit later than it is released. 

We highly recommend not to use any USB hubs and connect Apple devices directly to PC. 

Before connection to our software please attach a cable to the device and wait till the cable 

drivers are found. 

How to connect Apple devices in Oxygen Forensic Suite 2012 


Connect new device option on “Common tasks” sidebar. Oxygen Connection Wizard will be started. 

Please choose Connect via cable option there and wait till the device is found:

After connection is established Device Extraction Wizard will start automatically and you can 

proceed to extract data. 

 


Compatible USB cable or Bluetooth adapter 


Microsoft ActiveSync or Mobile Device Center (preinstalled on Windows Vista and Windows 7 OS) 

for cable connection or Bluetooth drivers for Bluetooth connection 

Connection types support for Windows Mobile devices 

Both cable and Bluetooth connection are supported by Windows Mobile devices. 

Please note that not all Windows Mobile devices have a Bluetooth module. 

Devices that have non Microsoft Bluetooth stack cannot be connected to Oxygen Forensic Suite 

2012. 


OxyAgent application must be installed into Windows Mobile devices to extract data. Oxygen 

Forensic Suite 2012 installs OxyAgent automatically, so you just need to follow Oxygen Connection 

Wizard instructions. 


amount of data from Windows Mobile devices. It does not change any personal information inside the 

device. For more information about OxyAgent approach please refer to .

Where to find drivers 

Cable drivers 

You can install Microsoft ActiveSync software from the disc supplied by manufacturer, look for it on 

the manufacturer official site or download the driver package from Oxygen Forensic Suite site: 

. 

If you have Windows Vista or Windows 7 you should have Mobile Device Center preinstalled. 

Bluetooth drivers 

You can use the drivers from the disc supplied by manufacturer or look for them on the 

manufacturer official site. 

We highly recommend you to use Microsoft or Widcomm Bluetooth drivers. 

Please note that Microsoft Bluetooth drivers are preinstalled in Windows OS starting from XP 

Service Pack 2. 

How to install Microsoft ActiveSync from our driver package 

To install Microsoft ActiveSync please run ActiveSync.msi file from the Driver package and follow 

the instructions step by step. 


Before you connect any device to Oxygen Forensic Suite 2012 using a USB cable please make sure 

that it is connected to Microsoft ActiveSync or Mobile Device Center. 

How to connect Windows Mobile device via Bluetooth 


Connect new device option on ‘Common tasks’ sidebar. Oxygen Connection Wizard will be started. 

Please choose Connect via Bluetooth option and device model:

Then select Bluetooth drivers. You will be offered to search for available Bluetooth devices. Select 

your device in the list and press Next button: 

After that choose Upload and install OxyAgent into the phone option. You will need a flash 

card to copy OxyAgent to the device. Insert it in a card-reader or PC card slot, select it in Removable 

drives menu and press Upload button:

Please note: You can change the phone owner’s flash card to the flash card which is used for 

forensic investigations. This operation will prevent changes in the device memory. If the original phone 

owner’s card is used only free clusters can be lost (which potentially can contain previously deleted 

data) but no existing information will be modified. 

After OxyAgent is copied you need to find it in ‘Program Files’/’OxyAgent’ folder in the device, open 

it and select Start option in File menu and press Next button in Oxygen Connection Wizard: 

The following Bluetooth icon will appear. As soon as the device gets connected it becomes green: 

Oxygen Connection Wizard will inform you that Windows Mobile device is found. Press Next 

button to finish connection process:

Device Extraction Wizard will start automatically and you can proceed to extract data from the 

device. 

Please note: in case of Bluetooth connection Oxygen Forensic Suite 2012 does not uninstall 

OxyAgent automatically. You can go to ‘Program Files’/’OxyAgent’ folder in the device and remove the 

application manually. 

How to connect Windows Mobile device via USB 


Connect new device option on ‘Common tasks’ sidebar. 

Oxygen Connection Wizard will be started. Please choose Connect via Cable option there. You 

will be offered to install OxyAgent in the device, select Upload and install OxyAgent into the 

phone option and choose where to install it – to the internal memory or flash card:

After you press Upload button OxyAgent will be automatically loaded and the device should be 

found: 

Please note: while using USB connection Oxygen Forensic Suite 2012 uninstalls the Agent 

automatically. 

If Windows Mobile device does not connect via USB

Sometimes Windows Mobile devices do not allow installing and starting uncertified applications, 

like OxyAgent. Unlocking procedure solves this problem. Unlocking is changing some values in the device 

registry. 

There are two mains steps of unlocking: 

1st Step 

Connect your device to ActiveSync or Mobile Device Center via USB cable. 

Start UnlockWM.bat in Oxygen Forensic Suite 2012/SystemFilesfolder on PC. 

Your device should be unlocked. 

If this step does not help you may start WhatsNow.bat file in the same folder on PC. A special 

file RapiConfigOut with the device registry information will be created. You can send this file to us for 

analysis and we will try to fix the problem. 

2nd Step 

You can take a special application regeditand unlock the device with its help. This application is 

free and can be started without any installation. It can be found in Oxygen Forensic Suite 

2012/SystemFiles folder on PC. 

Please, note that the application from our program folder is certified only for HTC devices. To 

install it to another device you should find the relevant version in the Internet. 

The unlock process should be carried out this way: 

Connect your device to ActiveSync or Windows Mobile Center. 

Copy regedit.exe to any device folder and start it from device File Manager. Edit the following key 

names in the registry: 

HKEY_LOCAL_MACHINE->Security->Policies->Policies->00001001 

value data 2 should be 1 





We also recommend you to edit the following key name or create it if it does not exist: 

HKEY_LOCAL_MACHINE->Security->Policies->Policies->0000101b 

value data should be 1 (DWORD type). 

Restart the device. It should be unlocked. 

In case you still experience problems with OxyAgent installation or want to learn more about 

Windows Mobile security policy system you can refer to MSDN:


Original USB cable or Bluetooth adapter or Infrared transceiver 


Cable drivers from phone manufacturer or Bluetooth drivers (Microsoft or Widcomm 

recommended) or Infrared drivers 

Connection types support for Symbian OS devices 

 

 

 

Cable connection is supported by smartphones based on the following platforms: 

o Nokia S60 starting from the 2 nd Edition (except Nokia 6600 that has no official 

cable connection) 

o Samsung S60 

o Sony Ericsson UIQ3 

Bluetooth connection is supported by all Symbian OS smartphones 

Infrared connection is supported by Nokia and Samsung S60 smartphones that have Infrared 

transceiver 


OxyAgent application must be installed into Symbian OS device to extract data. Oxygen Forensic 

Suite 2012 installs OxyAgent automatically, so you just need to follow wizard instructions. 


amount of data from Symbian OSsmartphones. It does not change any personal information inside the 

smartphone. For more information about OxyAgent approach please refer to . 

Where to find drivers 

Cable drivers 

You can use official cable drivers from the disc supplied by manufacturer, look for drivers on the 

manufacturer official site or download the driver package from Oxygen Forensic Suite site: 

. 

Bluetooth drivers 



We highly recommend you to use Microsoft or Widcomm Bluetooth drivers. 

Please note that Microsoft Bluetooth drivers are preinstalled in Windows OS starting from XP 

Service Pack 2. 

Infrared drivers 



How to install cable drivers from our driver package 

 

For Nokia S60 smartphones run Nokia_Connectivity_Cable_Driver.msi file from Nokia folder 

and follow the instructions of the Installation Wizard.

For Samsung S60 smartphones execute Samsung_USB_Driver_Installer.exe file from Samsung 

folder and follow the instructions of the Installation Wizard. 

For Sony Ericsson UIQ3 smartphones run Sony_Ericsson_Smartphones_PC_Suite.exe file from 

Sony Ericsson folder and follow the instructions of the Installation Wizard. 

What options to select in the device 

It is very important to select the correct USB mode in the smartphone when you attach a cable 

to it. For Nokia and Samsung S60smartphones it must be ‘PC Suite’. Do not select ‘Data 

transfer’, ‘Image Print’ or ‘Media Player’ modes. With these modes smartphones will not be 

connected to Oxygen Forensic Suite 2012. Please note that Nokia PC Suite and Samsung 

Studio programs are not needed for connection. 

If you need to set the phone date back to preserve Event Log records you have to install selfsigned 

OxyAgent in the device from Oxygen Forensic Suite 2012/Agent/SymbianOldCert folder. 

 

 

During installation the S60 phone may say that the certificate is not correct so you need to go 

to “Tools” –“Settings” – “App Manager”menu in the smartphone and allow all applications 

installation by turning off certificate check. 

During installation the UIQ3 phone may say that the certificate is not correct so you need to 

go to “Control panel” – “Install” - “Security”menu in the smartphone and disable “Enable 

revocation check”option. 


 

Before you connect any smartphone to Oxygen Forensic Suite 2012 please make sure that no 

other software (like Nokia PC Suite, Samsung Studio, Sony Ericsson Suite, other forensic 

programs etc.) is connected to the device at this time. Otherwise Oxygen Forensic Suite will 

not be able to establish connection.

How to connect Nokia and Samsung S60 smartphones in Oxygen Forensic Suite 2012 



Please choose the connection type there and wait till the smartphone is found and you are offered to 

install OxyAgent: 

In Oxygen Connection Wizard choose “Upload and install OxyAgent into the phone” option and 

press Upload button on the next screen of Oxygen Connection Wizard. It will copy OxyAgent to the 

phone. Symbian OS does not install applications automatically so the smartphone will offer you to upload 

OxyAgent manually: 

OxyAgent can be installed either to phone memory or flash card. Please notethat installation 

process leaves traces in App Manager log including its timestamp. 

After OxyAgent is installed please find it in “Applications” folder in the smartphone. In some S60 

phones OxyAgent can be found in another folder where all applications appear after installation. 

Start OxyAgent choosing the needed connection method in the menu: USB, Bluetooth or IrDA 

exchange:

Then select “OxyAgent is started and ready to connect the phone” option in Oxygen Connection 

Wizard and press Next button: 

After that the device should be found:

Then Device Extraction Wizard will start automatically and you can proceed to extract data from 

the smartphone. 

Please note: OxyAgent uninstalling leaves traces in App Manager log including its timestamp. 

Symbian OS does not uninstall OxyAgent automatically so you need to uninstall the Agent manually 

immediately after you detached the smartphone from the PC or finished working with Oxygen Forensic 

Suite 2012.

How to connect Motorola or Sony Ericsson UIQ3 smartphones in Oxygen Forensic Suite 

2012 



If OxyAgent has not been loaded in the smartphone before you need to choose Bluetooth 

connection (the only connection type that loads OxyAgent in Motorola and Sony Ericsson UIQ3 

smartphones). 

Select the phone model in the list and press Next button: 

After that choose a Bluetooth stack you are using, enable Bluetooth in the phone and press Next 

button. Oxygen Connection Wizard will search for available Bluetooth devices. As soon as your device is 

found select it and press Next button:

After that you will be offered to upload OxyAgent: 

In Oxygen Connection Wizard choose “Upload and install OxyAgent into the phone”option and 

press Upload button on the next screen. You will receive an incoming Beamed message in the 

smartphone, open it and install OxyAgent manually:

OxyAgent can be installed either to phone memory or flash card. Please notethat installation 

process leaves traces in App Manager log including its timestamp. 

After OxyAgent is installed please find it in “Applications” folder and start it choosing the 

supported connection method in the menu. 

Then select “OxyAgent is started and ready to connect the phone”option in Oxygen Connection 

Wizard and press Next button: 

The smartphone should be found:

After that Device Extraction Wizard will start automatically and you can proceed to extract data 

from the smartphone. 

Please note: OxyAgent uninstalling leaves traces in App Manager log including its timestamp. 

Symbian OS does not uninstall OxyAgent automatically so you need to uninstall the Agent manually 

immediately after you detached the smartphone from the PC or finished working with Oxygen Forensic 

Suite 2012.

Oxygen Forensic Suite, Oxygen Forensic Suite 2012 and OxyAgent are the trademarks and 

properties of Oxygen Software LLC. 

Symbian and Symbian OS are the registered trademarks of Symbian Ltd. 

Windows 2000, Windows XP, Windows Server 2003, Windows Vista,Windows 7 and Windows 

Mobile are registered trademarks of Microsoft Corporation. 

All other trademarks are owned by their respective companies. 

Oxygen Forensic Suite 2012 official website is Hhttp://www.oxygen-forensic.com 

Government & Commercial Registrations: 

D-U-N-S® Number: 565447377 

NATO Commercial and Government Entity (NCAGE, also CAGE) Code: SJF45 

Central Contractor Registration (CCR): Visit www.bpn.govand enter our NCAGE or 

DUNS number. 

Contacts: 

Telephone (USA, toll-free): +1 877 9-OXYGEN 

Telephone (UK): +44 (0) 20 8133 8450 

E-mail: support@oxygen-forensic.com

Oxygen Forensic Suite - GETTING STARTED - SME

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?