Predaxia Research

Oxygen Forensic Detective

Oxygen Forensics · United States

ActiveRussian roots

Confidence 3/5

VendorOxygen Forensics Inc.

Country of originUnited States (Alexandria, VA)

Original founding2000 in Moscow (Oleg Davydov)

Current statusActive. Claims full Russia divestment post-2022

US Entity ListNo

Customer baseUS federal, state and local LE, military, corporate investigators

Predaxia GlossaryWhat it means in practicePlain-English explainer · Threat model · Action steps

Technical capabilities

Oxygen Forensic Detective is a digital forensics platform with strong emphasis on cloud and social-media data acquisition in addition to mobile-device extraction. The vendor positions the product as an alternative to Cellebrite and Magnet AXIOM, with particular strengths in volume cloud-data parsing and acquisition from messaging apps.

Supported data sources per vendor documentation include iOS and Android device images, cloud accounts (iCloud, Google, Microsoft, Amazon, Box, Dropbox), social platforms (Facebook, Instagram, Twitter/X, LinkedIn, WhatsApp Business), IoT and smart-home ecosystems (Amazon Echo, Google Home, smart wearables), drones (DJI, Parrot, Autel) and vehicle infotainment systems. Cloud acquisition typically requires credentials, tokens, or warrant-served carrier cooperation.

Documented use

Oxygen Forensics has marketed primarily to US federal and state law-enforcement agencies. Public procurement databases (USAspending, GSA contract data) record purchases by US federal departments, state police agencies, and certain US municipal forces.

Historical use by Russian law enforcement during the company’s pre-2022 Moscow operations has been the subject of reporting in Russian-language security press. The company stated full divestment from Russia following the February 2022 invasion of Ukraine. Independent verification of operational divestment remains limited.

Customer states

Documented customers include US federal agencies (FBI, DHS components, Department of Defense), US state and local LE, and unspecified Western European law-enforcement units. Distribution to authoritarian regimes is less documented than for Cellebrite or MSAB but cannot be ruled out given the lack of mandatory disclosure regime for forensic tools.

Legal and sanctions status

Not on the US Department of Commerce Entity List.
Headquartered in the United States since at least 2015.
Original founder Oleg Davydov has been the subject of OSINT scrutiny regarding the timing of the US relocation.
Subject to US export controls under EAR for forensic tools.

Technical countermeasures

Hardware security keys: enforce FIDO2 or WebAuthn on cloud accounts to defeat session-token acquisition.
Periodic session revocation: actively revoke device sessions in Google, Apple, Microsoft consoles.
Encrypted message disappearing timers: Signal disappearing messages substantially reduce cloud and on-device retention.
iCloud Advanced Data Protection: end-to-end encrypts most iCloud categories. Removes Apple from the data-disclosure chain.
Account compartmentation: separate primary identity from cloud accounts used for sensitive workflows.

For at-risk individuals. Cloud forensics is often more productive than device forensics. Account hardening with hardware keys, end-to-end encryption where available, and disciplined session management defeats most acquisition workflows.

Sources

Update log

April 2, 2026: Entry created. Sourced from Forensic Focus product reviews, USAspending federal contract records, Privacy International Surveillance Industry Index and Oxygen Forensics own capability documentation.

There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.