Oxygen Forensics news vol. 18

By now, we’ve all heard of TikTok, the short-form video-sharing network that gradually took over the internet upon its release in 2016. In 2019, we published a blog announcing the implementation of data extraction capabilities to Oxygen Forensic® Detective. Since then, things have changed.

A Surge in Popularity

Today, over 18% of global internet users are on TikTok, a significant increase from the  11% reported in 2019. Equally as impressive, the application’s monthly active audience has increased from 508 million in 2019 to 689 million as of July 2020, and it is expected to reach 1.2 billion by 2021.

It is no longer an app that is mostly used by teens. The percentage of TikTok users over 30 continues to grow steadily. Additionally, the amount of time users spend on the app has also increased. US TikTok users spend twice as much more time on the app than they used to back in 2019. To conclude, TikTok is an app investigators can expect to see more and more of s in their work.

Security and Privacy Concerns

In 2019, TikTok was investigated in the US over national security and user privacy concerns. In response to the accusations, TikTok released a transparency report, claiming that no user information was requested by China and that the US TikTok app was separate from the Chinese version of the app. Nevertheless, in August 2020, former President Trump issued an executive order against any firms doing business with TikTok.

In civilian cases, there was an instance involving a group of teens that found a bag of human remains on a Seattle shore and uploaded the footage to TikTok, immediately prompting a murder investigation by police. In cases like this, videos uploaded to TikTok accounts become evidence for crimes, from donning police uniforms to tortures.

The Addition of TikTok to the  Oxygen Forensic® Cloud Extractor

To start the extraction, open Oxygen Forensic® Cloud Extractor in the Oxygen Forensic® Detective home menu and select TikTok in the list of apps.

There are several ways to authorize a TikTok cloud account. An investigator may use:

• Username and password
• Phone number and SMS
• Username and Google password
• Google master token obtained by ‘username and password’ authorization
• Google master token for Android devices
• Token obtained by ‘user name and password’ authorization;
• iOS or Android device token

If an account is secured with two-factor authentication (2FA), Oxygen Forensic® Detective has this covered. The investigator may obtain an SMS code on the device or get the code on the account owner’s e-mail. It is also possible to extract data utilizing a proxy.

Alternatively, an investigator can import credentials or tokens from the Oxygen Forensic® Detective Accounts and Passwords section of an extraction by clicking on Extract with Cloud Extractor button located on the toolbar.

Once authorized, investigators can proceed to extract data, such as user account information, contacts, coins, login history, notifications, private messages, uploaded content, liked posts,  comments, and files.

Cloud vs App

Both iOS and Android TikTok apps are supported in Oxygen Forensic® Detective. We recommend extracting data from both the app and cloud since the datasets slightly differ. For example, cookies and cache can only be extracted from a mobile device, whereas notifications and all liked posts are only available from the cloud because they are not stored locally on the device.

TikTok app (iOS)

TikTok cloud