I Got the Court File. Here Is What It Actually Says.

Oxygen Forensics: The Civil Lawsuit Most People Haven’t Read

While the DFIR world was blowing up this week over the federal arrest of Lee Reiber, I was digging into a different Oxygen Forensics case: a civil docket most people haven’t heard of.

In some ways, it is more interesting because it shows that many of the allegations being argued about today did not suddenly appear when federal agents arrested Lee Reiber. They were already sitting in federal court, buried in a docket few knew about.

I bought most of the court file because I wanted to read it myself, mostly because I questioned most of what was being said on Reddit. You can find the downloads in this post.

Preface: The Litigation World

I’ve worked in the litigation world (both criminal and civil) for a long time. I’ve seen that practically any or every corporation or person risk litigation all the time, some are in constant litigation, and others cross their fingers to hopefully avoid it (they probably won’t).

Companies have problem employees. They also have competitors, fighting over intellectual property and reputation. Almost like a warzone.

Employees have problem employers. They also have competitors fighting over titles and pay. Again, almost like a warzone.

Every party has a version of events, and every version can contain truth, mistakes, omissions, exaggerations, or outright falsehoods. This is your reminder of being the forensic scientist examining facts and putting allegations in their proper place (ie: An allegation stays an allegation until evidence moves it somewhere else).

Settlement ≠ Truth. Agreement ≠ Truth. Adjudication ≠ Truth.

The absolute truth is an elusive bastard. If all parties agree to settle, that does not mean they agreed to the truth, in part or full. Even an adjudication might not be the truth. Even if the person of interest admits to the deed, that does not mean it is true. Absolute truth may still be unreachable, but evidence is the closest thing we have to getting there.

Oxygen Forensics, Inc. v. Max Weissberg,

The civil case is Oxygen Forensics, Inc. v. Max Weissberg, filed August 28, 2026, in the U.S. District Court for the Eastern District of Virginia, Alexandria Division, Case No. 1:26-cv-02826-RDA-LRV.

Weissberg is a former Oxygen employee. He says he worked as a Marketing Campaign Specialist from December 2023 until October 17, 2025.

From Oxygen Forensics’ viewpoint, Weissberg began making false and highly damaging accusations about the company. Oxygen says Weissberg contacted customers, employees, conference organizers, and the public with claims that Oxygen was secretly controlled by Russian interests and the FSB, that its programmers were in Russia, and that Lee Reiber was helping conceal that relationship. Oxygen says those statements were false, defamatory, and commercially destructive, costing it customers, business opportunities, and more than $1.5 million in current and future revenue. It also points to the separate dispute over company laptops and the alleged $210,000 demand as evidence that Weissberg’s conduct was retaliatory rather than legitimate whistleblowing.

From Weissberg’s viewpoint, this is a whistleblower and public-interest case involving a government forensic-software vendor whose Russian history, development, ownership, and control deserved scrutiny. He says Oxygen blurred important distinctions between ownership, control, influence, historical product lineage, and Russian government use, then tried to characterize all of his concerns as one false accusation. He says his communications were based on public records, published reporting, information learned while employed by Oxygen, and material he sent to federal agencies for review. He denies demanding $210,000 for silence and says the laptops were retained as evidence for reports to investigators. In his view, Oxygen’s request for an injunction was an attempt to stop speech before the underlying allegations had been tested and resolved.

Those are serious as allegations for a forensic software company selling products to U.S. law enforcement and government agencies. If they are false, they can destroy a company, but if they are true, customers probably deserve to know.

The federal allegations now deal directly with Russian ownership, Russian software development, corporate control, and representations allegedly made to U.S. government customers about those subjects.

That means the civil case cannot simply be waved away as a disgruntled former employee making noise. There is more there.

Oxygen also claimed that Weissberg caused real financial damage. Reiber declared that the company had lost at least five major customer relationships and more than $1.5 million in current and future revenue because of Weissberg’s statements. He said customers and prospective customers terminated, delayed, or suspended contracts, pilots, renewals, and sales discussions after hearing the allegations.

That is Oxygen’s allegation and it is not a finding by a court.

Oxygen then sought a preliminary injunction to stop Weissberg from continuing to publish or republish certain statements it said were false and defamatory.

Weissberg fought it. And his version of what happened reads almost like a different case.

He describes what he was doing as whistleblower activity, petitioning government agencies, providing source material, discussing published reporting, and making conclusions about corporate lineage, Russian connections, control, and influence.

I do not know which version is true. Neither does anyone else who has not seen the evidence behind those claims.

The laptop dispute is the same problem. Oxygen says an employee refused to return company computers. Weissberg says a whistleblower preserved evidence. Same two laptops with different intent, and intent matters.

Another part of the filings caught my attention because it deals directly with forensic technology.

Oxygen says its software is digital forensic software designed for lawful and authorized extraction and analysis and rejects the characterization that it is hacking software intended to gain unauthorized access.

Weissberg says he used the term “hacking software” partly because of a recorded conversation with an Oxygen employee. According to Weissberg, the employee described the software as “hacking software when you really get down to it” and said it had “built-in malware.”

Anyone who works mobile forensics knows how fast this terminology gets ridiculous.

Consider: Exploit a vulnerability. Escalate privileges. Bypass security. Execute code. Extract protected data.

Did I just describe mobile forensics or a cyberattack? Depends who is doing it, why they are doing it, what legal authority exists, and what the software actually does. The word “hacking” does not answer any of that, but context does.

Then on September 22, Oxygen withdrew its own motion and asked the court to cancel the hearing.

That is interesting but also a great example of exactly the kind of thing people misuse. The withdrawal does not prove Weissberg was right. It does not prove Oxygen believed it was going to lose. It does not prove that the challenged statements were true.

It proves Oxygen withdrew the motion. That is all it proves. The attorneys involved may know exactly why. I do not. So I am not going to invent the missing fact because it makes a better story.

Then the criminal case hit and that changed how I viewed the civil case.

The civil filings already contained disputes about Russian ownership, Russian development, MKO Systems, corporate control, government customers, and representations about those things.

Then federal prosecutors separately alleged concealed Russian ownership and software development. That does not make every statement Weissberg made true.

People can be angry and right, and at the same time, angry and wrong.

Investigators should know this. For investigative purposes, the label ‘whistleblower’ does not make the information true. The person is still a source, and the information still gets vetted.

That is why we investigate.

If someone tells me Bob buried a body in the backyard, I do not decide the allegation is true because the person making it has been labeled a whistleblower. I also don’t throw it out because the source hates Bob either.

I get a shovel and dig to the truth. The Oxygen civil case is messy in exactly that way.

I wanted to see what was actually there rather than read someone else’s version of what was there. And I am making the documents I obtained available for the same reason. That lesson applies to every case and incident you work from here forward.

Read the records, but don’t confuse a document with proof simply because it has a federal court case number at the top or a signed affidavit.

My opinion of the Oxygen situation has changed as more information has become available, as it should.

If new evidence cannot change your opinion, then evidence is not driving your opinion. Your opinion is driving your evidence and you have become an advocate. DFIR requires more than that. We demand provenance from evidence.

Just don’t tell me you investigated the case and came to a conclusion just because you read the headline.

That is not investigation.

That is scrolling.

The downloads:

I’ve attached the civil documents below. Read them, put them next to the federal complaint, and do what we do best: follow the evidence and draw your own conclusions.