# Oxygen Forensics review: features, pricing and free alternatives > AI Release · @ai_release1 · https://ai-release.org/guides/oxygen-forensics-obzor_en.html ## TL;DR - Time to complete: 60 minutes (45 minutes on the analysis workstation, 15 minutes on the decision record) - Difficulty: Intermediate - You will need: the installed Oxygen Forensics build plus its contract and licence documents from the vendor, Android platform-tools (`adb`), the NOIR v0.1.1 portable build, a rooted test phone on Android 8.0 (API 26) or newer for VD-Google, `sha256sum`, host firewall tooling (`iptables` or `netsh`), and an export of your own forensic action log for the last 12 months. ## Requirements and setup ![Illustration: Requirements and setup](https://ai-release.org/guides/img/oxygen-forensics-obzor-en-1.jpg?v=1793781886) - OS: macOS, Windows 10/11 or Debian/Ubuntu — the three platforms NOIR v0.1.1 ships portable builds for. Oxygen Forensics supported OS matrix and hardware sizing are not in our source: verify against vendor documentation. - Java: NOIR bundles Java 17, so no separate JDK install. `adb` and `jadx` are downloaded on first launch, which means the first launch must happen on a machine allowed to reach the internet. - Device access: USB cable and USB debugging enabled. Root is not required for NOIR; VD-Google requires root and Android 8.0 (API 26)+. - Rights: admin/sudo to change firewall rules and to write outside your home directory. - Disk: not stated in our source — check the vendor's evidence-storage guidance before you copy a case image. - Access to the Met figures for a reality check: the tool ran on a closed IT system with no internet connection and was used in under 0.2% of more than 23,000 digital forensic team actions in the last year. Baseline comparison you will fill in during Step 1: | Tool | What it covers | Cost | Requirements | |---|---|---|---| | Oxygen Forensics | Digital forensics suite; in the Met deployment it ran on a closed IT system without internet and covered under 0.2% of 23,000+ actions in a year | Not stated in our source — verify against vendor documentation | Closed, non-internet-connected workstation in that deployment | | NOIR v0.1.1 (Verlintas/NOIR) | Console audit of Android apps from a computer: permissions, endpoints extracted from the APK, risk score | Free, portable builds per the source — confirm the licence in the repo | macOS, Windows 10/11, Debian/Ubuntu; Java 17 bundled; needs USB debugging; no root, no internet after first run | | VD-Google | Shows what Google records on the phone across RCS, Google Wallet and Play Integrity attestations | Free, open source on GitHub | Root + Android 8.0 (API 26)+; zero permissions including internet | Use one row per option and one column per decision criterion — the same method is worked through in [Gemini 4 Argon: features, access, and comparison with GPT-6.1](https://ai-release.org/guides/gemini-4-argon-chto-eto-kak-podklyuchit-i-stoit-li-pere.html?utm_source=tg&utm_medium=channel&utm_campaign=guide_inline&utm_content=guide_to_guide). ## Step 1. Inventory the tools and measure their real footprint **What to do:** create a working folder, an inventory CSV and a usage-share calculation before touching any evidence. **Why:** the Met published exactly this metric before suspending the tool. Without the same number for your team, "keep or suspend" stays an opinion. **Example:** ```bash mkdir -p ~/dfir-review && cd ~/dfir-review cat > inventory.csv <<'CSV' tool,vendor,host,network_access,actions_last_12m Oxygen Forensics,Oxygen Forensics,case-ws-01,offline, NOIR v0.1.1,Verlintas/NOIR,analyst-laptop,first_run_only, VD-Google,open source,test-phone,none, CSV awk -F, 'NR>1 {printf "%-18s %s\n", $1, $5}' inventory.csv ``` ```bash TOTAL=23000; TOOL=46 awk -v t=$TOOL -v a=$TOTAL 'BEGIN{printf "usage share: %.2f%%\n", 100*t/a}' # usage share: 0.20% ``` `0.20%` reproduces the Met's published ceiling of "under 0.2% of more than 23,000 actions". Replace `TOTAL` and `TOOL` with your own export — the point is that the number is measured, not estimated. If the extracted artifacts later become a labelled dataset, apply the rules in [How to prepare data for a neural network: dataset cleaning and labeling](https://ai-release.org/guides/kak-podgotovit-dannye-dlya-neyroseti-chistka-i-razmetka.html?utm_source=tg&utm_medium=channel&utm_campaign=guide_inline&utm_content=guide_to_guide). **How to check:** `column -s, -t inventory.csv` prints three aligned rows, and the `awk` line prints a single percentage. If a `` is still a placeholder, the review is not finished. ## Step 2. Build an isolated workstation and run the free analogs ![Illustration: Step 2. Build an isolated workstation and run the free analogs](https://ai-release.org/guides/img/oxygen-forensics-obzor-en-2.jpg?v=1793781889) **What to do:** take the analysis host off the network, unpack NOIR, confirm the phone is visible, and run the free tools on a copy of the evidence. **Why:** isolation is the control the Met relied on — the tool ran on a closed IT system with no internet connection. Repeating that setup is what makes a "high-risk vendor" finding contained instead of a data-egress incident. **Example — isolation (Linux, then Windows):** ```bash ip -br link sudo ip link set down ``` ```powershell New-NetFirewallRule -DisplayName "DFIR-offline-outbound-block" -Direction Outbound -Action Block -Profile Any ``` **Example — NOIR (run the first launch online, then move the folder):** ```bash tar -xzf NOIR-0.1.1-.tar.gz # archive name is on the release page cd NOIR-0.1.1 && ./ --help # exact flags: verify in the repo README ``` **Example — device checks and a manual endpoint sweep:** ```bash adb devices adb shell getprop ro.build.version.sdk adb shell su -c id # only needed for VD-Google adb shell pm list packages -3 adb shell pm path com.example.app adb pull /data/app/.../base.apk ./evidence/base.apk # debug builds; root for the rest unzip -o evidence/base.apk -d evidence/apk grep -Eoh 'https?://[a-zA-Z0-9._/-]+' -r evidence/apk | sort -u | head -20 ``` The `grep` sweep works because an APK is a ZIP archive: URLs baked into `classes.dex` and resources stay in plain text, which is why NOIR can list endpoints without running the app. NOIR adds permissions and a risk score on top; VD-Google reads device-side RCS, Wallet and Play Integrity data on a rooted phone. **How to check:** `adb devices` lists your serial with the word `device` (not `unauthorized`), and `grep` prints at least one URL line. An empty grep means the APK path is wrong, not that the app is clean. ## Step 3. Verify isolation, evidence integrity, and record the decision ![Illustration: Step 3. Verify isolation, evidence integrity, and record the decision](https://ai-release.org/guides/img/oxygen-forensics-obzor-en-3.jpg?v=1793781896) **What to do:** prove the workstation has no egress, hash the evidence, and write the keep/replace decision into one file. **Why:** an auditor will not accept "we unplugged it". They accept a command output and a checksum. **Example:** ```bash ss -tunap | grep -v '127.0.0.1' # expected: no output curl -m 5 https://example.com # curl: (6) Could not resolve host: example.com sha256sum evidence/base.apk > evidence/base.apk.sha256 sha256sum -c evidence/base.apk.sha256 # evidence/base.apk: OK ``` Decision checklist: - [ ] `inventory.csv` filled with real action counts and a measured usage share - [ ] `ss` output captured showing no non-loopback connections - [ ] Checksum recorded before and after analysis - [ ] NOIR output saved with permissions, endpoints and risk score - [ ] Cost column closed: Oxygen Forensics price taken from vendor documents, NOIR and VD-Google listed as free/open source - [ ] Residual risk noted: NOIR completeness is not guaranteed by the project, and it audits apps, not full device images **How to check:** `ls -1` in `~/dfir-review` shows `inventory.csv`, `evidence/`, `*.sha256` and the decision file; `sha256sum -c` returns `OK`. ## Troubleshooting **Problem. The phone is plugged in but the tool sees nothing** - Error: `adb: no devices/emulators found` - Cause: USB debugging is off, the cable is charge-only, or the RSA fingerprint prompt was dismissed on the phone. - Solution: re-enable USB debugging, unlock the phone, accept the fingerprint, then `adb kill-server && adb start-server && adb devices`. **Problem. VD-Google installs, but collection is empty** - Error: `/system/bin/sh: su: not found` - Cause: the device is not rooted, or the shell has no root grant — VD-Google requires root and Android 8.0 (API 26)+. - Solution: confirm with `adb shell getprop ro.build.version.sdk` (must be 26 or higher) and grant root to the shell in your root manager; if the phone cannot be rooted, use a dedicated rooted test device. **Problem. NOIR's first launch dies while fetching its tools** - Error: an error of the form `java.net.UnknownHostException: ` - Cause: first launch downloads `adb` and `jadx`, but the workstation was already isolated in Step 2, so the download cannot resolve. - Solution: run the first launch on a networked machine, then copy the whole folder to the isolated host and re-run `./ --help` offline. ## Summary and next steps Measure your own usage share first, then isolate the workstation and run NOIR and VD-Google on a copy before you decide anything about the paid suite. Record the price only after the vendor confirms it in writing, and treat the free tools as a scoped audit rather than a full forensic replacement. ## FAQ **How much does Oxygen Forensics cost?** Our source does not publish a price. Collect a written quote from the vendor and put it in the cost column of the table above; do not fill that cell from memory. **Does Oxygen Forensics need an internet connection?** In the Met deployment it ran on a closed IT system with no connection to the internet. Whether your instalment can work fully offline is vendor-specific — verify against vendor documentation. **Is NOIR a free replacement for Oxygen Forensics?** No. NOIR v0.1.1 is a console audit of Android apps from a computer — permissions, endpoints from the APK, risk score — and the project gives no completeness guarantee. It covers app-level review, not full device forensics. **Can VD-Google run without root?** No. It requires root rights and Android 8.0 (API 26) or newer; in exchange it installs with zero permissions, including no internet access.