Oxygen Review Center integrates with Oxygen Remote Explorer to support enterprise-grade Digital Forensics Incident Response (DFIR) and investigation workflows. For security operations, corporate investigations, and eDiscovery teams, this enables consistent forensic review collaboration, clear ownership of review decisions, and defensible handling of digital evidence annotations across distributed stakeholders.
Data extracted via Oxygen Remote Explorer can be forwarded to Oxygen Review Center for team reviews. After the review, it can be sent back with added comments, essential findings, and labeling.
Below is the end-to-end workflow, with a focus on how to export annotations and transfer them between systems without disrupting case continuity.
Data extracted in Oxygen Remote Explorer can be transferred to Oxygen Review Center in two ways:
- Directly push data by right-clicking a case or unassigned device and selecting the items for export
- Save data as an .ofbr backup and upload it to Oxygen Review Center
After importing data into Oxygen Review Center, reviewers can begin triage and analysis. They can apply tags, designate key evidence, and add notes to support downstream reporting and decision-making.
All annotations are centralized in the Annotations panel on the right panel of the software. Users can add multiple notes to each reviewed item. Every note is automatically labeled with the username and timestamp, making it straightforward to attribute and audit digital evidence annotations in regulated or high-scrutiny environments.
An extensive activity log documents who added or removed essential markups, tags, or notes, helping teams maintain traceability and governance throughout the review lifecycle.
Once the review is complete, annotations can be sent back to Oxygen Remote Explorer to consolidate findings in the primary investigative workspace. To transfer annotations, click the Export to OFD/ORE button on the Devices or Cases page and select one of the options – as a file or via direct export.
If you chose the first option the exported .orc file will appear in the Export section. Then you can download and upload it to Oxygen Remote Explorer.
If you choose the second export option a dialog window will appear. Choose a computer available on your local network and select the annotations you want to send.
Remember that for Oxygen Remote Explorer to appear in the Select computer menu, it must be running on this computer.
After you export, all the entries that include key evidence items, tags, and notes will show up in a special ORC Annotations section within Oxygen Remote Explorer.
You can filter by reviewer, source, or tag. Additionally, you can view which users added annotations and the dates when each annotation was created.
If you import multiple .orc files associated with the same backup, they will all be displayed in the History section.
To sync key evidence, tags, and user notes from the ORC Annotations section with other sections, choose the version of the imported .orc you want.
file and right-click on it. You will have two options: add data or replace it.
The first option preserves the current key evidence, tags, and user notes while adding the corresponding data imported from Oxygen Review Center. The second option replaces the existing key evidence, tags, and user notes with the data imported from the .orc file. Any existing entries will be overwritten. These actions cannot be undone.
In enterprise environments, maintaining a stable case structure is critical for continuity and defensibility. Specific requirements must be met to ensure exported data is accurately matched when it is returned from Oxygen Review Center to Oxygen Remote Explorer.
To avoid any issues, please follow these guidelines:
- Do not modify cases or devices in Oxygen Remote Explorer (e.g., by adding or removing devices from cases).
- Do not re-analyze case or device data in Oxygen Remote Explorer.
- Ensure you are using Oxygen Remote Explorer version 2.2 or later when sending data to Oxygen Review Center.
- If data was saved as an .ofbr backup in Oxygen Remote Explorer, you must first upload the .ofbr backup before importing the .orc file. If data was pushed directly from Oxygen Remote Explorer to Oxygen Review Center, you can upload only the .orc file when sending it back.
Collect data, collaborate review, capture annotations in an enteprise workflow using the Oxygen Ecosystem
By moving data from Oxygen Remote Explorer to Oxygen Review Center, teams can standardize review across functions and locations, support collaborative digital forensics, and maintain reviewer attribution through usernames, timestamps, and a centralized activity log.
When the review is finished, exporting annotations back to Oxygen Remote Explorer (as an .orc file or via direct export) ensures findings, tags, and notes remain connected to the primary investigation and reporting workflow.
To prevent mismatches, maintain the original structure of the case/device. Do not re-analyze the data and adhere to the .ofbr/.orc import order as it was originally provided.
Frequently Answered Questions
Question: How can I transfer extracted data from Oxygen Remote Explorer to Oxygen Review Center?
There are two ways you can proceed: (1) you can directly push data by right-clicking on a case or an unassigned device in Oxygen Remote Explorer and choosing the items you want to export, or (2) you can save the data as an .ofbr file backup in Oxygen Remote Explorer and upload that .ofbr file to Oxygen Review Center.
Question: What annotations can reviewers add in Oxygen Review Center, and how are they tracked?
Reviewers can add tags, mark items as key evidence, and leave multiple notes per item. All annotations appear in the right-side Annotations panel. Each note is automatically labeled with the username and timestamp, and an activity log records who added or removed key evidence markups, tags, or notes to maintain visibility and defensibility across digital evidence annotations.
Question: How do I send annotations back to Oxygen Remote Explorer from Oxygen Review Center?
Short answer: Click Export to OFD/ORE on the Devices or Cases page and choose either: (1) export as a file (.orc), which then appears in the Export section for download and later import into Oxygen Remote Explorer, or (2) direct export over the local network, where you select an available computer.
To enable direct export, ensure that Oxygen Remote Explorer is active on the target machine so it shows up in the Select computer list.
Question: Where do imported annotations appear in Oxygen Remote Explorer, and how do I apply them to the case?
Imported .orc files appear in a specific ORC Annotations section. Here, you can filter annotations by reviewer, source, or tag. You can also view who made each annotation and the date it was created.
Multiple .orc files for the same backup are shown in the History section. To apply them elsewhere in the case, select the desired .orc version, right‑click, and choose Add (merge with existing key evidence, tags, and notes) or Replace (overwrite existing items). Replace is irreversible.
Question: What requirements ensure annotations match correctly when returning to Oxygen Remote Explorer?
Please refrain from modifying cases or devices in Oxygen Remote Explorer. This includes adding or removing devices and re-analyzing the data.
Use Oxygen Remote Explorer version 2.2 or later. If the data was saved as an .ofbr backup, upload that .ofbr first, then import the .orc. If data was pushed directly from Oxygen Remote Explorer to Oxygen Review Center, you can import only the .orc when sending it back.
Question: How does this workflow support forensic review collaboration across teams?
By centralizing review in Oxygen Review Center and returning findings to Oxygen Remote Explorer through exported annotations, organizations can preserve attribution, reduce rework, and keep review outcomes aligned with investigation and compliance requirements.
