Oxygen Forensic is a mobile and cloud forensic vendor founded in 2000, originally based in Moscow before establishing its primary corporate presence in the United States. The company’s flagship product, Oxygen Forensic Detective, extracts data from mobile devices, drones, cloud accounts, and IoT devices. Oxygen has been actively used by law enforcement and government investigators in more than 100 countries, with documented deployments in the US, EU, and across the Middle East. The Russian origin and the company’s restructuring during the 2022 to 2024 period have made its corporate history one of the more complicated in the forensic tooling market.
What it means in practice
Oxygen Forensic Detective performs logical and physical extraction across thousands of mobile device models, with notable strength in cloud account extraction. The product retrieves messages, photos, location history, app data, and deleted records, and additionally supports cloud-based acquisition from Google, iCloud, Microsoft, WhatsApp, Telegram, and other service providers when investigator-supplied credentials are available. The cloud extraction capability has become increasingly important as mobile device storage has tightened access while cloud storage has expanded.
Specific things to know
Oxygen’s corporate trajectory through 2022 to 2024 saw the company restructure away from its Russian origin in response to international sanctions following the Russian invasion of Ukraine. The current corporate presence is US-based, though questions about ongoing engineering relationships and legacy customer access have been raised in industry coverage. The product remains technically competitive with Cellebrite and MSAB and is used in cases where cloud account extraction is the primary objective.
Change today
For any device or cloud account that may be subject to forensic extraction, the operational answer is to limit cloud storage of sensitive material, use strong distinct passwords on cloud accounts, enable two-factor authentication, and review cloud account activity quarterly. Oxygen’s cloud extraction strength depends entirely on having access to working credentials, which means that good account hygiene is a more meaningful defence than device-level countermeasures in many investigations.
Related articles
See our coverage of mobile and cloud forensic extraction, the post-2022 restructuring of Russian-origin technology vendors, and account hygiene against forensic compulsion.