Insights from the global provider of digital forensic investigation software
RAM (Random Access Memory) is used to temporarily store working data or code on an active computer. RAM is a snapshot of a live running system and can be captured before the system is shut down. While capturing RAM, investigators and incident responders must bear in mind that it will lead to a change in …
Continue reading “Capture RAM using Oxygen Forensic® KeyScout”
Sometimes evidence, credentials, or tokens crucial to an investigation are not found on a mobile device, but a Mac. Today, macOS is the primary operating system for Apple’s Mac computers. Within the desktop, laptop, and home computer market, it is the second most widely used desktop OS, after Microsoft Windows. Oxygen Forensic® KeyScout can extract …
Continue reading “Collecting macOS artifacts with Oxygen Forensic® KeyScout”
What is a e01 file? The e01 (Encase Image File Format) file is a forensics disk image file that keeps backup of various types of acquired digital evidence. It was originally developed by EnCase® Forensic, a forensics software application. Then other companies started using it in their products, leading it to become common place. In …
Continue reading “E01 import now in Oxygen Forensic® Detective!”
Oxygen Forensic KeyScout is a portable utility available at no additional charge within Oxygen Forensic Detective software. It allows searching and extracting data from a running computer system using OS API calls and user privileges. You can find the KeyScout utility on the Oxygen Forensic Detective home screen. Once located investigators simply copy the executable …
Continue reading “Hunting Computer Artifacts with Oxygen Forensic KeyScout”
What is it? KeyScout is a utility built into Oxygen Forensic® Detective which uncovers and extracts user data, tokens and passwords from apps and web browsers as well as Wi-Fi hotspot passwords, iTunes backups, and operating system data on PCs running Windows. How to use it? Oxygen Forensic® KeyScout is an easy-to-use utility that can …