David Ratkovich, Director at ETS Intelligence, is a licensed private detective, security contractor, and law enforcement officer with more than 20 years of experience. David and his ETS Intelligence team provide investigative, security, sci-tech, consulting, and training services to clients throughout the United States.
When promising to deliver superior digital forensic results to a wide range of clients and cases, David and ETS Intelligence have turned to Oxygen Forensic® Detective for more than a decade.
“So, I use Oxygen almost every day, and I’ve been using it since about 2011. It has become my primary go-to tool for data analytics. It is a very versatile tool within our toolbox,” David said. “My company does corporate and government-based investigations primarily. So, everything from a financial fraud case to a partner dispute. There’s lots of funds and technology involved in all those cases.”
Unpacking and parsing more data
Parsing volumes of data can require time-intensive unpacking and analysis, and still not render a clear view of the evidence within. Oxygen Forensic® Detective has provided David and ETS Intelligence more data and deeper analytic perspective when parsing out the same ingested data extracted from another tool.
“I understand the importance of getting the data. And when we’re working with government cases, the government often provides us with data. It’s packaged differently from a different tool. So, it’s beneficial that I can ingest those other tools into the Oxygen tool and then unpack it and parse it out,” David said.
“And I will be able to read things in the Oxygen tool from an analytic perspective that I can’t see in the competitor tool, and that doesn’t mean the data is not there. It just means that it’s not being viewed or parsed the same way. So, I use it as my primary parsing and analytic tool, regardless of where the extraction was done or for that matter, who did the extraction.”
“If I analyze it with Oxygen, I will get a lot more data from an analytic perspective from the same data set versus another tool. I’ve had very good luck with that. And it is probably the most valuable feature that I use on a daily basis.”
Powerful facial categorization import and parsing
Oxygen Forensic® Detective’s built-in facial categorization module can correctly detect images extracted from mobile devices, cloud services, or computers. Users can create multi-thread categorization face sets to make searching in extracted evidence faster and easier.
“Facial recognition is a very powerful tool. And over time we’ve built our own databases. So, when we’re searching, we have to have something to reference against. So, the bigger our library gets, the more likely we are to get a hit. So, we are constantly building that dictionary of faces the same way we would build dictionaries for pass code breaking or for keyword searching,” David said.
“And they’re not always criminals or suspects. In civil cases we can use facial categorization to see how a person interplays into the rest of our investigation. Are they showing up in other people’s phones and other people’s social media? So, the facial recognition component has been very valuable in helping us cull through that volume of data to get to some of those more finite answers that we’re looking for.”
Decrypting and collecting Telegram data
The increasingly widespread use of popular instant messaging services like Telegram can present privacy and encryption challenges for investigators. David and ETS Intelligence rely on Oxygen Forensic® Detective’s capabilities for decrypting and collecting Telegram data to solve cases and catch the bad guys.
“We had a case where he was a, criminal investigation case, and the guy and his partner in crime were stealing credit cards, making her own credit cards, and they were transmitting them through Telegram, and they thought, ‘Oh, Telegram’s encrypted, so we’re never going to get caught.’ Wrong answer,” David said.
“I was able to get the phone and decrypt Telegram using the Oxygen tool. It had two factor authentication on this. We had to go through the process of getting them, to reactivate the phone to get it to authenticate. But once we did that, we had everything. And so that I was able to take those data sets, i.e. the pictures and communications between the two of them. And that was the end of the case right there. They were done. So, it was a very, very effective use of that process.”
Great processing speed for cloud extractions
Oxygen brought the first cloud extraction tool to the forensic industry in 2014. A decade later, Cloud Extractor in Oxygen Forensic® Detective still provides industry-best capabilities for David and the ETS Intelligence team.
“I love cloud extractions because there’s so much data in the cloud. And even if the data is on the phone, it’s better to get it from the cloud. Many times the data itself, like in a WhatsApp backup on an iPhone, is not really on the phone and difficult to get. So, it’s easier to authenticate to a cloud and do a backup,” David said. “Oxygen’s processing speed for cloud extractions is great.”
Critical malware scan capabilities
Oxygen Forensic® Detective enables users to detect malware in extracted files and email databases at no additional cost. David was excited to discover the built-in malware scan capabilities that don’t require downloading.
“Malware is an interesting topic. I was so happy to open an Oxygen update recently and see, ‘oh wow, look, there’s a malware scan in here now.’” David said. “There are other ways to check for malware, but in terms of increasing efficiency and workflow, having that malware scan built in there and an updated database for it is just a critical baseline tool. It was an excellent addition.”
Responsive training and support
David’s experiences with Oxygen Forensics’ customer-centric, client-first culture align with the 98% satisfaction rating for our superior technical support.
“Professional development is very important within my agency. I’ve really loved the continuing education Oxygen provides. [Oxygen CEO Lee Reiber] has this focus on everybody continuing to get better, and I agree with that philosophy. There’s always that thirst to learn and grow. So, I’m happy that Oxygen has a culture that supports that same mindset,” David said.
“Another thing I love about Oxygen’s business model is that the training is all part of the LMS system. Oxygen creates regular content, like webinars, to answer common user questions. And all that content is available just by being part of the ecosystem, right? Oxygen’s products and training are very well supported.”
“I have never had a problem with Oxygen not being responsive. I’ve had a few tech support questions over the years and I’ve always gotten a response and that’s really critical. I’ve enjoyed going through the training classes and getting the instructor certification, and it’s a continuous journey.”
Increasingly valuable price point
As competitors steadily increase user costs by charging add-on prices for capabilities, Oxygen Forensics’ perpetual licensing model benefits users with better cost of ownership and added tools that don’t require additional fees.
“The price point for Oxygen Forensic® Detective is excellent. And comparatively, within the industry, it’s more valuable than it’s ever been because many of the larger competitors are increasing their prices at very, very high rates. So, Oxygen’s price point is becoming that much more valuable to us,” David said.