Oxygen Forensics review: a keep-or-replace workflow for small teams

A forensic suite is easy to buy and hard to justify. When the question is whether to keep Oxygen Forensics or swap it for free tooling, a feature matrix will not answer it. Two numbers do: how much of your real casework actually flows through the tool, and what it costs you in isolation effort and paperwork.

This is the 60-minute routine I use to get both — roughly 45 minutes on the analysis workstation and 15 minutes writing the decision down. Difficulty: intermediate. You will need the installed Oxygen Forensics build together with its contract and licence documents, Android platform-tools (adb), the NOIR v0.1.1 portable build, a rooted test phone on Android 8.0 (API 26) or newer if you want to run VD-Google, sha256sum, host firewall tooling (iptables or netsh), and an export of your own forensic action log for the last 12 months.

Lead with a footprint number, not a feature list

The Met published exactly one figure before suspending the tool: it ran on a closed IT system with no internet connection and was used in under 0.2% of more than 23,000 digital forensic team actions in the previous year. Capable software, negligible share — and that single line carried more weight than any comparison table.

Without the equivalent measurement for your own team, keep-or-suspend stays an opinion. So the first step is to produce that number before you look at a single checkbox in the UI.

Requirements and setup

• OS: NOIR v0.1.1 ships portable builds for macOS, Windows 10/11 and Debian/Ubuntu. Oxygen Forensics' supported OS matrix and hardware sizing were not in the material I had — check the vendor documentation.
• Java: NOIR bundles Java 17, so there is no separate JDK install. It downloads adb and jadx on first launch, which means the first launch has to happen on a machine with internet access.
• Device access: USB cable with USB debugging enabled. NOIR does not need root; VD-Google does, and it needs Android 8.0 (API 26) or newer.
• Rights: admin/sudo to change firewall rules and to write outside your home directory.
• Disk: not stated in my source — read the vendor's evidence-storage guidance before you copy a case image.

Baseline table to fill in during Step 1:

Tool	What it covers	Cost	Requirements
Oxygen Forensics	Digital forensics suite; in the Met deployment it ran on a closed IT system without internet and covered under 0.2% of 23,000+ actions in a year	Not stated in my source — verify against vendor documentation	Closed, non-internet-connected workstation in that deployment
NOIR v0.1.1 (Verlintas/NOIR)	Console audit of Android apps from a computer: permissions, endpoints pulled out of the APK, risk score	Free and portable per the source — confirm the licence in the repo	macOS, Windows 10/11, Debian/Ubuntu; bundled Java 17; USB debugging; no root, no internet after the first run
VD-Google	Shows what Google records on the phone across RCS, Google Wallet and Play Integrity attestations	Free and open source on GitHub	Root + Android 8.0 (API 26)+; zero permissions, including internet

One row per option, one column per decision criterion. Close the cost column from the actual contract documents, not from a blog post.

Step 1: Inventory the tools and measure their real footprint

Do this before you touch any evidence. Create a working folder, an inventory CSV and the usage-share calculation:

mkdir -p ~/dfir-review && cd ~/dfir-review

cat > inventory.csv <<'CSV'
tool,vendor,host,network_access,actions_last_12m
Oxygen Forensics,Oxygen Forensics,case-ws-01,offline,<count>
NOIR v0.1.1,Verlintas/NOIR,analyst-laptop,first_run_only,<count>
VD-Google,open source,test-phone,none,<count>
CSV

awk -F, 'NR>1 {printf "%-18s %s\n", $1, $5}' inventory.csv

Then turn your export into a share rather than a feeling:

TOTAL=23000; TOOL=46
awk -v t=$TOOL -v a=$TOTAL 'BEGIN{printf "usage share: %.2f%%\n", 100*t/a}'
# usage share: 0.20%

The 0.20% above reproduces the Met's published ceiling of under 0.2% of more than 23,000 actions. Replace TOTAL and TOOL with your own numbers — the point is that the figure comes from a measured export, not an estimate. If the artifacts you pull later turn into a labelled dataset, treat cleaning and labelling as a separate, documented step with its own review.

Check: column -s, -t inventory.csv prints three aligned rows, and the awk line prints a single percentage. If any <count> is still a placeholder, the review is not finished.

Step 2: Isolate the workstation and run the free analogues

Isolation is the control the Met leaned on: the tool ran on a closed IT system with no internet connection. Reproducing that setup is what turns a high-risk-vendor finding into a contained exercise instead of a data-egress incident.

Linux first, then Windows:

ip -br link
sudo ip link set <iface> down

New-NetFirewallRule -DisplayName "DFIR-offline-outbound-block" -Direction Outbound -Action Block -Profile Any

Unpack NOIR, run the first launch while the machine is still online, then move the folder to the isolated host:

tar -xzf NOIR-0.1.1-<platform>.tar.gz    # archive name is on the release page
cd NOIR-0.1.1 && ./<noir-binary> --help  # exact flags: verify in the repo README

Device checks plus a manual endpoint sweep:

adb devices
adb shell getprop ro.build.version.sdk
adb shell su -c id        # only needed for VD-Google

adb shell pm list packages -3
adb shell pm path com.example.app
adb pull /data/app/.../base.apk ./evidence/base.apk   # debug builds; root for the rest
unzip -o evidence/base.apk -d evidence/apk
grep -Eoh 'https?://[a-zA-Z0-9._/-]+' -r evidence/apk | sort -u | head -20

That grep sweep works because an APK is just a ZIP archive: URLs baked into classes.dex and resources stay in plain text, which is exactly why a tool can list endpoints without ever executing the app. NOIR adds permissions and a risk score on top of that; VD-Google reads device-side RCS, Wallet and Play Integrity data from a rooted phone.

Check: adb devices lists your serial with the word device (not unauthorized), and the grep prints at least one URL line. An empty grep usually means a wrong APK path, not a clean app.

Step 3: Verify isolation, hash the evidence and record the decision

An auditor will not accept 'we unplugged it'. They accept command output and a checksum:

ss -tunap | grep -v '127.0.0.1'      # expected: no output
curl -m 5 https://example.com
# curl: (6) Could not resolve host: example.com

sha256sum evidence/base.apk > evidence/base.apk.sha256
sha256sum -c evidence/base.apk.sha256
# evidence/base.apk: OK

Then close the decision in one file with this checklist:

• [ ] inventory.csv filled with real action counts and a measured usage share
• [ ] ss output captured showing no non-loopback connections
• [ ] SHA-256 recorded before and after analysis
• [ ] NOIR output saved with permissions, endpoints and risk score
• [ ] Cost column closed: Oxygen Forensics price taken from vendor documents, NOIR and VD-Google listed as free/open source
• [ ] Residual risk noted — the NOIR project does not guarantee completeness, and it audits apps, not full device images

Check: ls -1 shows inventory.csv, evidence/, the .sha256 file and the decision file, and sha256sum -c returns OK.

Troubleshooting

The phone is connected but nothing shows up. You get adb: no devices/emulators found. USB debugging is off, the cable is charge-only, or the RSA fingerprint prompt was dismissed on the device. Re-enable debugging, unlock the phone, accept the fingerprint, then run adb kill-server && adb start-server && adb devices.

VD-Google installs but collection is empty. You see /system/bin/sh: su: not found. The device is not rooted, or the shell has no root grant — VD-Google requires root and Android 8.0 (API 26)+. Confirm with adb shell getprop ro.build.version.sdk (must be 26 or higher) and grant root to the shell in your root manager; if the phone cannot be rooted, use a dedicated rooted test device.

NOIR's first launch dies while fetching its tools. An error shaped like java.net.UnknownHostException: <host>. The first launch downloads adb and jadx, but the workstation was already isolated. Run the first launch while the machine still has internet, then move the folder and cut the network.

Takeaway

The decision record matters more than the comparison table. A suite with a real price, a measured 0.2% share and a documented isolation procedure is a defensible choice; the same suite with an unmeasured share and a verbal promise that it stays offline is a liability. Free alternatives like NOIR and VD-Google cover narrow, specific jobs — app-level audits and Google-side records — and the checklist above tells you quickly whether those are the jobs you actually have.

This article was originally published on AI Release — https://ai-release.org. More guides and release breakdowns land on the channel: https://t.me/ai_release1.