OSForensics is a powerful software package used for computer expertise. OSForensics is most often used by investigative bodies, special structures and expert judicial bodies to compile indisputable evidence of illegal activity from the seized computer. It is most often used to make perfectly accurate copies of the disk system, which are examined by independent experts.
Key features of OSForensics:
- Search several times faster than standard Windows search
- Indexing, speeding up search even more
- Search the history of all popular email clients
- Recover deleted files
- View recently used documents
- View computer usage activity
- Collect complete information about computer hardware and software
- View and make an exact copy of RAM
- Retrieve usernames and passwords from browsers
OSForensics can also be used to solve simpler but important tasks, such as searching for lost files, recovering passwords, and detecting various virus infections.
License: Freeware.
Changes in OSForensics 8.0.1005:
- Auto Triage
- Upgraded the screen capture to take screenshots of all running program windows.
- Removed the drive selection drop-down list and changed it to select the OS boot drive to perform live acquisition scanning.
- Case manager
- Fixed an issue when exporting a report using the copy files option, if a source file was read only then multiple error messages could be shown during the file copy process.
- Improved speed of export when large amounts of files are being exported as part of the report
- USEDB viewer
- updated to library code for compatibility with newer helper libraries
- Verify Hash
- Fixed a bug where clicking the “upper case output” option after generating a hash would not update the primary hash and instead replace the secondary hash with the upper case primary
- File system support
- Updated library code for reading E01 and L01 files. While there were multiple changes under the hood, the most visible change should be better support for L01 image files. In particular it fixes a case where a NTFS directory entry in a L01 could point to the wrong file.
Official page
Download: OSForensics 8.0.1005 (197 MB)