Oxygen Forensic KeyScout - Keys To The Kingdom: Part 1

Author: Forensic Focus: Digital Forensics & DFIR Talk - Bewertung: 0x - Views:4

Join us for an in-depth walkthrough of Oxygen Forensic KeyScout, where Keith Lockhart reveals how to use one of the most powerful triage and live-response tools in modern digital forensics. From building highly targeted collection profiles to extracting passwords, tokens, encrypted data, and memory artifacts, this session shows exactly how to turn a simple USB or OTG device into a full-scale “keys to the kingdom” acquisition platform.



In this webinar, you’ll learn how to:



- Deploy KeyScout to removable media and carry a multi-platform triage toolkit in your pocket



- Run live system collections against Windows, macOS, and Linux machines without a license



- Build custom profiles with precise search paths, file rules, hash sets, and exclusions



- Use supplied passwords to decrypt DPAPI stores, backups, and protected credential containers



- Target applications and system artifacts including browsers, USB history, shellbags, recycle bin, and more



- Collect memory artifacts such as process lists, BitLocker keys, file handles, and crypto material



- Acquire full disk images (E01 or DD) with compression, verification, and splitting options



- Review and export findings to Oxygen Detective for deeper analysis and reporting



- Triage large environments quickly to identify the machines that really matter



Whether you’re performing live response in the field, scanning external drives, or re-processing legacy evidence in the lab, this session delivers a practical, no-nonsense guide to mastering KeyScout and dramatically accelerating your forensic investigations.