How to Extract Data from Vault Apps

What are Vault Apps?

Vault and private storage apps allow users to hide content like photos, videos, messages, contacts, calls, browsing history, notes, and other sensitive data within a device. Usually, vault apps are password-protected and even encrypted.

These apps guarantee privacy and safe storage of user’s confidential data. However, vault apps can also be utilized to hide illicit content and SCAM. Moreover, vault apps might do the opposite thing – being a malware spy on their users.

 

Table of Contents

 

Vault App Forensics in Oxygen Forensic® Detective

We continue to update Oxygen Forensic® Detective Vault App support. Users can extract hidden data as well as the PIN code from many vault apps.

Supported Vault Apps:

      • Calculator#
      • Calculator+ light: hidden safe
      • Calculator+: Hide your secret
      • FileSafe – Hide File / Folder
      • GalleryVault
      • Hide it Pro
      • Hide Pictures in Vaulty
      • KeepSafe
      • KYMS – Keep your media safe
      • NQ Vault
      • Personal Photo Vault
      • Photo Vault Pro
      • Private Photo Vault
      • Private Photo Vault Pro
      • SafeCalc

 

Our users can always check the latest supported app versions in the Options/Supported applications menu of Oxygen Forensic® Detective.

Knowing the importance of vault app forensics for law enforcement, we continue to expand the apps that we support. In version 15.2 of Oxygen Forensic® Detective, we’ve added support for a couple of new vault apps.

Newly Supported Vault Apps

FileSafe extraction

With FileSafe a user can hide their files and folders and access them using a secret PIN code. Oxygen Forensic® Detective enables extraction of the following artifacts from Android devices, if physical or full file system methods are used:

  • Account info
  • PIN code
  • Images, audio, and video files
  • Cached images
Screenshot of files that were extracted from FileSafe using Oxygen Forensic® Detective
Files extracted from FileSafe vault app

 

Extraction of Calculator+ , Calculator#, and SafeCalc apps

All these apps are disguised as a full-featured calculator. However, they are vault apps that can hide photos, videos, bookmarks, notes, contacts, passwords, and other sensitive data. For their extraction, we recommend the checkm8 method. However, investigators can also extract them using the iTunes backup procedure.

Data that can be extracted from Calculator#:

      • The account info
      • Passwords
      • Photos and videos
      • Cookies

Data that can be extracted from Calculator+:

      • Contacts
      • Notes
      • Media files
      • Bookmarks
      • Web history
      • Settings
      • Cookies
      • Cache

Data that can be extracted from SafeCalc:

      • Contacts
      • Notes
      • Links
      • Files
      • Folders
      • Cache
      • Cookies
      • Snapshots

 

Screenshot of files that were extracted from SafeCalc using Oxygen Forensic® Detective
Files extracted from SafeCalc vault app

 

Other Supported Vault Apps

In addition to vault apps, Oxygen Forensic® Detective can extract and decrypt data hidden in Huawei PrivateSpace, Xiaomi Second Space, and Samsung Secure Folder. Use the Huawei Kirin, MTK Android Dump, and Samsung Exynos methods to gain access to these secure user profiles in our software.

 

Get more from Oxygen Forensic® Detective

At Oxygen Forensics our software is updated multiple times every year. We offer training courses and webinars that can help you learn the ins and outs of Oxygen Forensic® Detective and stay up to date on new features and tools needed for your investigation. Returning customer? Sign up for our newsletter to stay in the loop.

Don’t have Oxygen Forensic® Detective and want to try it out? Request a free-trial.

Leave a Reply

Your email address will not be published. Required fields are marked *