In the rapidly evolving landscape of digital forensics, the objects of our investigations often move faster than our tools. While the industry is currently focused on the latest “Mixed Reality” headsets, a significant volume of digital evidence still resides on legacy devices. With the recent announcement of the fall of the Metaverse many felt that Oculus would also fall. That might not be the case as some platforms have decided to keep using the headsets. With that in mind here are some specific areas to look for digital evidence artifacts when working with an Oculus.

Forensic Challenges of the Oculus Ecosystem

Investigating an Oculus device is fundamentally different from a standard Android or Windows analysis.

1. The Android-Based Standalone vs. PC-Tethered

• Oculus Go/Quest: These are specialized Android-based units. Forensic acquisition often requires enabling Developer Mode, which can be a hurdle if the investigator does not have access to the linked mobile device.
• Oculus Rift/Rift S: These are “dumb” peripherals. The evidence doesn’t live on the headset but on the host PC. Artifacts are scattered across AppData\Local\Oculus, registry keys, and browser caches.

2. Physical and Logical Extraction

Traditional forensic tools often struggle with the proprietary file structures of VR headsets. Research has shown that even when using standard ADB (Android Debug Bridge) methods, the data is often “locked down” to prevent rooting, making physical imaging nearly impossible without a risk to your evidence. With that in mind let’s focus on what you can get without a risk of losing access to the device data.

When looking at an Oculus device you can process it as a media device in different forensic tools. Below is the structure to expect from the device based on an acquisition with Paraben’s E3:UNIVERSAL software.

Expected data can include anything from pictures, screenshots, videos, and more from the virtual space as well as other data they have uploaded onto the device because it can mount as a media device on a computer.

Data associated with activities on the device can be found through the Android portion. Each represents different activities and selections made with the Oculus device while in the Metaverse.

The secondary data available for an Oculus comes with the compliance archive. This data can be requested via the Metaquest account.  Once the data request has been made the information is available to download for 4 days. Multiple requests can be made.

Note that if 2 Factor Authentication is setup to your Facebook account associated with the Oculus you will have to go through a verification step.

Once downloaded the data was processed through the Compliance Archive function in Paraben’s E3:UNIVERSAL. The data shown was not seen in the image that was completed with the Oculus unit. These artifacts include voice recordings by the user and their avatar.

The final information found in the compliance archive focuses on the activities while on the device. They are seen in the data section with details of what areas were accessed while using the device. In addition, the data of what was granted access to the Oculus device. Hopefully this gives you some options for looking at artifacts from the Oculus devices that can help in your digital investigation.

To get a trial of the E3 Forensic Platform go to here.