Can You Defend Your Next Oxygen Forensics Report?
The issue is no longer simply whether Oxygen Forensics works. The question is whether you are prepared to explain and defend its continued use.
Digital forensic examiners routinely rely on specialized software to acquire, parse, analyze, and report electronic evidence.
But forensic software does not testify.
The examiner does.
That distinction has become particularly important for organizations that continue to rely on Oxygen Forensics following the September 2026 federal action involving Oxygen Forensics Inc. and its leadership.
On September 23, 2026, the U.S. Department of Justice announced federal criminal charges against Oxygen Forensics CEO Lee Reiber and Russian national Oleg Sergeyevich Davydov. The criminal complaint alleges that Oxygen concealed Russian ownership and control and misrepresented where its forensic software was developed while obtaining contracts from U.S. government agencies.
According to the Justice Department, federal authorities also seized approximately 57 domains and other cyber infrastructure associated with the alleged conduct.
These are allegations. The defendants are presumed innocent unless proven guilty.
Just as importantly, the Justice Department expressly states that the complaint does not allege that Oxygen software contained malicious code or that it was used to gain unauthorized access to customer systems or data.
That distinction should not be overlooked.
But neither should the question now facing every examiner or organization continuing to use the product:
Can You Defend the Decision to Continue Using It?
That is a different question from asking whether Oxygen generated correct results in the past.
There is no factual basis for automatically concluding that historical Oxygen examinations are incorrect, compromised, or inadmissible.
The more immediate concern is future reliance.
When an examiner signs a forensic report, submits findings to an attorney, provides evidence to an investigative agency, or offers testimony, the examiner assumes responsibility for the methodology used to reach those conclusions.
The software company does not defend the report.
It is defended by the examiner.
Imagine the Questions
Consider an examination performed after the federal allegations became public.
An opposing attorney or another forensic expert may reasonably ask:
What forensic software did you use?
Which version did you use?
Was that version current?
Was the product still being actively supported?
Were software updates available?
Was the vendor's update infrastructure operational?
Were new device and application versions supported?
Did you independently validate your findings?
Could you reproduce the material findings using another forensic platform?
Were you aware of the federal action involving the software vendor when you performed the examination?
If so, what steps did you take before continuing to rely upon that software?
None of these questions proves that an Oxygen result is wrong.
But they are now foreseeable questions.
And foreseeable questions should be addressed before issuing a report, not for the first time during deposition or testimony.
Forensic Software Is a Tool, Not the Conclusion
Experienced examiners already understand an important principle of digital forensics:
Tool output should not substitute for examiner judgment.
A forensic application may identify a message, timestamp, database record, browser artifact, deleted file, location entry, or application event.
The examiner still has to determine:
where the artifact originated;
how it was parsed;
whether the timestamp is interpreted correctly;
whether the artifact is consistent with other evidence;
what limitations apply;
and whether another method or tool can corroborate the finding when the finding is material.
This is why cross-validation has always been good forensic practice.
The current Oxygen situation makes that principle substantially more important.
Reproducibility Is the Strongest Answer
The most effective response to questions about a forensic tool is often not:
“I trust the software.”
It is:
“The material finding was independently reproduced.”
Suppose an Oxygen examination identifies a series of communications that becomes central to a criminal investigation, civil dispute, employment matter, or regulatory inquiry.
If those communications can also be located and interpreted independently using another validated forensic platform, the evidentiary conclusion becomes less dependent upon the reputation, availability, or continued operation of one vendor.
The same principle applies to:
timestamps;
browser history;
application databases;
deleted artifacts;
geolocation data;
call records;
messaging applications;
cloud artifacts;
documents;
operating-system activity;
and other material findings.
This does not mean every artifact in every historical case needs to be processed again.
It means the organization should identify what matters and determine whether independent validation is appropriate.
What About Reports That Have Already Been Issued?
Organizations should not assume that every historical Oxygen report suddenly requires re-examination.
A risk-based review is more appropriate.
Consider:
Is the matter still active?
A closed internal investigation presents a different risk profile from a criminal prosecution, pending civil case, regulatory matter, or upcoming expert deposition.
Is the Oxygen analysis central to the conclusion?
If the conclusion rests heavily on artifacts parsed exclusively through Oxygen, independent confirmation may deserve greater consideration.
Does the original evidence still exist?
Original forensic images, mobile acquisitions, cloud exports, hashes, and other source evidence should be preserved whenever possible.
Can another forensic platform process the same evidence?
Where practical, cross-platform validation can significantly reduce dependence upon the original application.
Is testimony expected?
If an examiner expects to testify about the examination, the methodology and tool-selection decision should be reviewed before testimony preparation begins.
The Examiner Should Preserve More Than the Final PDF
One common mistake in forensic transitions is focusing on the final report while overlooking the environment that produced it.
For significant active or historical matters, organizations should consider preserving:
the original source evidence;
forensic images and acquisitions;
hash values;
chain-of-custody documentation;
Oxygen case files;
exported artifacts;
examiner notes;
software version information;
configuration information;
license information;
report-generation dates;
and relevant standard operating procedures.
A PDF report may document the conclusion.
It may not contain everything required to reconstruct how that conclusion was reached.
Continued Use Creates a Different Question
An examiner who used Oxygen before September 2026 may be asked why the tool was selected then.
An examiner who continues using Oxygen after the federal action may face a more difficult question:
Why did you continue relying upon it after the circumstances surrounding the vendor became publicly known?
Again, this does not establish that continued use is automatically improper.
But it means the decision should be deliberate, documented, and technically supportable.
Forensic organizations should evaluate:
availability of current support;
continuing software updates;
licensing dependencies;
device and operating-system compatibility;
security and update infrastructure;
ability to access existing cases;
ability to reproduce material findings;
and availability of a supported alternative.
Simply continuing because “the software still opens” is a substantially weaker position.
A Replacement Platform Should Strengthen the Methodology
Moving away from Oxygen should not simply transfer dependency from one product to another.
A replacement platform should be evaluated against the organization's actual forensic requirements.
Can it:
Acquire?Preserve?Parse?Analyze?Validate?Report?Support testimony?
For organizations evaluating Belkasoft X, the platform provides acquisition and analysis capabilities across computers, mobile devices, cloud sources, and other evidence types, together with reporting and evidence-review functions.
Belkasoft continues to actively develop the platform. Version 2.12, released in September 2026, added additional Android acquisition capabilities, expanded artifact support, SQLite forensic functionality, offline evidence translation, and other enhancements.
Belkasoft X also provides reporting from artifacts, timelines, search results, maps, connection graphs, databases, and other investigative views, with output formats including PDF, DOCX, HTML, CSV, XLSX, and XML.
But the most important question remains the same:
Does the platform allow the examiner to produce findings that can be understood, reproduced, documented, and defended?
DUOLARK's Approach: Validate Before You Depend
DUOLARK is an authorized Belkasoft reseller, but our role extends beyond providing software licenses.
We perform digital forensic examinations.
That experience changes how we approach a transition.
For an organization moving away from Oxygen, we recommend considering four separate issues:
1. Preserve
Protect the original evidence, existing cases, reports, examiner notes, and supporting documentation before changing the environment.
2. Validate
Identify material findings in active or significant historical matters and determine whether independent confirmation is appropriate.
3. Transition
Select and deploy a supported forensic platform based upon the organization's actual acquisition, analysis, reporting, and investigative requirements.
4. Document
Record the transition methodology so future examiners, attorneys, auditors, or courts can understand what changed, why it changed, and how you maintained evidentiary continuity.
The Best Time to Answer the Hard Questions Is Before They Are Asked
Digital forensic reports often remain relevant long after the examination is completed.
They may be reviewed months or years later by people who were not involved in the original investigation.
Those reviewers will see the report.
They may see the software used.
And increasingly, they may know what happened to the company behind that software.
The examiner should be prepared for that.
The strongest position is not to argue that a particular forensic vendor should simply be trusted.
The stronger position is to demonstrate that:
the original evidence was preserved;
the methodology was documented;
significant findings were validated where appropriate;
the forensic platform was supported and current;
and the conclusions did not depend solely upon an unexplained software output.
So, Can You Defend Your Next Oxygen Report?
If the answer requires explaining why the organization continues to rely on Oxygen, now is the appropriate time to evaluate that decision.
Not during discovery.
Not during deposition preparation.
Not when opposing counsel asks the question.
And not when an examiner discovers during an active investigation that the software, updates, licensing, or support environment can no longer meet operational requirements.
Address the issue before issuing the next report.
How DUOLARK Can Help
DUOLARK Digital Forensics assists organizations evaluating their continued reliance on Oxygen Forensics and considering a transition to Belkasoft X.
Our services can include:
Oxygen environment assessment
evidence and case preservation
independent validation of material findings
Belkasoft X licensing and implementation
workflow transition
forensic reporting support
examiner assistance
procedure and documentation development
litigation-oriented forensic review
We don't simply sell forensic software. We use it.
If your organization is evaluating whether it can confidently support and defend its next Oxygen-generated report, the first step is to review the forensic environment before the next examination begins.
Confidence. Continuity. Defensibility.
DUOLARK Digital Forensicsduolark.ioinfo@duolark.com
Primary Source
U.S. Department of Justice, U.S. Attorney's Office for the Central District of California, Tech CEO, Russian National Arrested on Complaint Alleging They Hid Russian Ownership and Development of Software Sold to U.S. Government, September 23, 2026.
Additional product information concerning Belkasoft X is available at:
Comments