What is it?
KeyScout is a utility built into Oxygen Forensic®
Detective which uncovers and extracts user data, tokens and passwords
from apps and web browsers as well as Wi-Fi hotspot passwords, iTunes backups,
and operating system data on PCs running Windows.
How to use it?
Oxygen Forensic® KeyScout is an
easy-to-use utility that can assist in any investigations.. There are four
steps investigators need to follow:
- Open Oxygen Forensic® Detective or JetEngine;
- In Oxygen Forensic Detective’s tool menu select Oxygen Forensic KeyScout and from Jet Engine’s main dashboard select KeyScout under Forensic Tools. *Investigators can also use Search for credentials on the target computer from within Oxygen Forensic Cloud Extractor;
- Add keyscout.exe to removable media.
- Run KeyScout on the target computer;
- Save collected data to an inserted removable drive (this collection will contain both an ocpk file and odb file).
- Investigators can import the ocpk file to Oxygen Forensic® Cloud Extractor and the odb file to JetEngine.
What makes it stand out?
Only one other company in the field of the mobile forensics provides its customers with a similar utility. However, their solution only extracts the username and password that a user saved within a PC web browser. Useful, but clearly not as comprehensive and multi-functional as Oxygen Forensic® KeyScout.
What can I do with it?
Oxygen Forensic® KeyScout focuses on extracting passwords, tokens, and user data from from web browsers and applications, locates and extracts iTunes backups, locates and extracts Wi-Fi hotspot passwords, and collects operating system artifacts from Windows OS-operated PC. Currently there are numerous apps and browsers supported, including WhatsApp Desktop, iCloud for Windows, Google Chrome, Internet Explorer, Mozilla Firefox, Opera, and Mozilla Thunderbird to name a few. We collect more than just tokens and passwords; with Oxygen Forensic® KeyScout investigators can extract valuable data from browsers including: cookies, history, bookmarks, and data from autofill forms.
We are constantly updating our algorithms to enhance the capabilities of Oxygen Forensic® KeyScout with each release. There is no need to pay extra; KeyScout is built-into Oxygen Forensic® Detective enabling investigators to import acquired data into Oxygen Forensic Cloud Extractor and JetEngine for further analysis at no additional cost.
Why do I need it?
Not only are our tools frequently
updated, the ease of use can save you some time and even crack the case.
In the United Kingdom in 2019 a child went missing. The terrified parents contacted the local Police Department to assist in searching for their child. With the phone believed to be switched off and presumably with the child, the only tech piece left to investigate was the child’s laptop. Deploying KeyScout on the laptop and then importing the acquired data into Oxygen Forensic® Detective, the police found some amazing web history. Within the recovered history, and among the most frequently visited pages, the child’s video blog on a social media site was located. The investigators located several followers of the vlog that seemed suspicious. Further investigation of the subjects on the social media site the investigators uncovered intensive messaging to the missing child.
The chat history with one of the
subjects was found in WhatsApp messenger. This message was extremely important
since it indicated the child wanted to run away because of the parent insisting
they go to school and do chores. The
subject having the conversation with the child on Whatsapp invited them to stay
at their home. This was the clue the
police needed. With the address the
police arrived to locate the child, unharmed, and arrest the subject who
happened to be wanted for child molestation and human trafficking.
The case was solved with the use
of Oxygen Forensic Detective and the built in Oxygen Forensic® KeyScout by extracting and analyzing browser
history with auto fillable forms along with the data from WhatsApp Messenger for
Your story using Oxygen Forensic®
KeyScout may be next. Feel free to try it and to share your experience with us!
Success is only a few clicks away! Check out the workflow!