← All guides AI Release
RU Subscribe to @ai_release1

Oxygen Forensics review: features, pricing and free alternatives

Updated: 04.11.2026 · AI Release · @ai_release1
Oxygen Forensics review: features, pricing and free alternatives

TL;DR

Requirements and setup

Illustration: Requirements and setup
Illustration: Requirements and setup

Baseline comparison you will fill in during Step 1:

ToolWhat it coversCostRequirements
Oxygen ForensicsDigital forensics suite; in the Met deployment it ran on a closed IT system without internet and covered under 0.2% of 23,000+ actions in a yearNot stated in our source — verify against vendor documentationClosed, non-internet-connected workstation in that deployment
NOIR v0.1.1 (Verlintas/NOIR)Console audit of Android apps from a computer: permissions, endpoints extracted from the APK, risk scoreFree, portable builds per the source — confirm the licence in the repomacOS, Windows 10/11, Debian/Ubuntu; Java 17 bundled; needs USB debugging; no root, no internet after first run
VD-GoogleShows what Google records on the phone across RCS, Google Wallet and Play Integrity attestationsFree, open source on GitHubRoot + Android 8.0 (API 26)+; zero permissions including internet

Use one row per option and one column per decision criterion — the same method is worked through in Gemini 4 Argon: features, access, and comparison with GPT-6.1.

Step 1. Inventory the tools and measure their real footprint

What to do: create a working folder, an inventory CSV and a usage-share calculation before touching any evidence.

Why: the Met published exactly this metric before suspending the tool. Without the same number for your team, "keep or suspend" stays an opinion.

Example:

mkdir -p ~/dfir-review && cd ~/dfir-review

cat > inventory.csv <<'CSV'
tool,vendor,host,network_access,actions_last_12m
Oxygen Forensics,Oxygen Forensics,case-ws-01,offline,<count>
NOIR v0.1.1,Verlintas/NOIR,analyst-laptop,first_run_only,<count>
VD-Google,open source,test-phone,none,<count>
CSV

awk -F, 'NR>1 {printf "%-18s %s\n", $1, $5}' inventory.csv
TOTAL=23000; TOOL=46
awk -v t=$TOOL -v a=$TOTAL 'BEGIN{printf "usage share: %.2f%%\n", 100*t/a}'
# usage share: 0.20%

0.20% reproduces the Met's published ceiling of "under 0.2% of more than 23,000 actions". Replace TOTAL and TOOL with your own export — the point is that the number is measured, not estimated. If the extracted artifacts later become a labelled dataset, apply the rules in How to prepare data for a neural network: dataset cleaning and labeling.

How to check: column -s, -t inventory.csv prints three aligned rows, and the awk line prints a single percentage. If a <count> is still a placeholder, the review is not finished.

Step 2. Build an isolated workstation and run the free analogs

Illustration: Step 2. Build an isolated workstation and run the free analogs
Illustration: Step 2. Build an isolated workstation and run the free analogs

What to do: take the analysis host off the network, unpack NOIR, confirm the phone is visible, and run the free tools on a copy of the evidence.

Why: isolation is the control the Met relied on — the tool ran on a closed IT system with no internet connection. Repeating that setup is what makes a "high-risk vendor" finding contained instead of a data-egress incident.

Example — isolation (Linux, then Windows):

ip -br link
sudo ip link set <iface> down
New-NetFirewallRule -DisplayName "DFIR-offline-outbound-block" -Direction Outbound -Action Block -Profile Any

Example — NOIR (run the first launch online, then move the folder):

tar -xzf NOIR-0.1.1-<platform>.tar.gz    # archive name is on the release page
cd NOIR-0.1.1 && ./<noir-binary> --help  # exact flags: verify in the repo README

Example — device checks and a manual endpoint sweep:

adb devices
adb shell getprop ro.build.version.sdk
adb shell su -c id        # only needed for VD-Google

adb shell pm list packages -3
adb shell pm path com.example.app
adb pull /data/app/.../base.apk ./evidence/base.apk   # debug builds; root for the rest
unzip -o evidence/base.apk -d evidence/apk
grep -Eoh 'https?://[a-zA-Z0-9._/-]+' -r evidence/apk | sort -u | head -20

The grep sweep works because an APK is a ZIP archive: URLs baked into classes.dex and resources stay in plain text, which is why NOIR can list endpoints without running the app. NOIR adds permissions and a risk score on top; VD-Google reads device-side RCS, Wallet and Play Integrity data on a rooted phone.

How to check: adb devices lists your serial with the word device (not unauthorized), and grep prints at least one URL line. An empty grep means the APK path is wrong, not that the app is clean.

Step 3. Verify isolation, evidence integrity, and record the decision

Illustration: Step 3. Verify isolation, evidence integrity, and record the decision
Illustration: Step 3. Verify isolation, evidence integrity, and record the decision

What to do: prove the workstation has no egress, hash the evidence, and write the keep/replace decision into one file.

Why: an auditor will not accept "we unplugged it". They accept a command output and a checksum.

Example:

ss -tunap | grep -v '127.0.0.1'      # expected: no output
curl -m 5 https://example.com
# curl: (6) Could not resolve host: example.com

sha256sum evidence/base.apk > evidence/base.apk.sha256
sha256sum -c evidence/base.apk.sha256
# evidence/base.apk: OK

Decision checklist:

How to check: ls -1 in ~/dfir-review shows inventory.csv, evidence/, *.sha256 and the decision file; sha256sum -c returns OK.

Troubleshooting

Problem. The phone is plugged in but the tool sees nothing

Problem. VD-Google installs, but collection is empty

Problem. NOIR's first launch dies while fetching its tools

Summary and next steps

Measure your own usage share first, then isolate the workstation and run NOIR and VD-Google on a copy before you decide anything about the paid suite. Record the price only after the vendor confirms it in writing, and treat the free tools as a scoped audit rather than a full forensic replacement.

FAQ

How much does Oxygen Forensics cost?

Our source does not publish a price. Collect a written quote from the vendor and put it in the cost column of the table above; do not fill that cell from memory.

Does Oxygen Forensics need an internet connection?

In the Met deployment it ran on a closed IT system with no connection to the internet. Whether your instalment can work fully offline is vendor-specific — verify against vendor documentation.

Is NOIR a free replacement for Oxygen Forensics?

No. NOIR v0.1.1 is a console audit of Android apps from a computer — permissions, endpoints from the APK, risk score — and the project gives no completeness guarantee. It covers app-level review, not full device forensics.

Can VD-Google run without root?

No. It requires root rights and Android 8.0 (API 26) or newer; in exchange it installs with zero permissions, including no internet access.

🤖 AI summary

Related posts

Related guides

Giga Pisar review: what it is and whether it is worth installing

Разбираем российский ИИ-генератор текстов: что умеет, сколько стоит, где ограничения и чем он отличается от ChatGPT и De

GPT-6.1 Sol Pricing and Access: Plans and Payment Methods

Рассказываем о стоимости новой модели GPT-6.1 Sol, доступных тарифах и легальных способах оплаты из разных стран.

How to prepare data for a neural network: dataset cleaning and labeling

Как подготовить данные для обучения нейросети: очистка, нормализация и разметка датасета с примерами.