About this product
OSForensics by PassMark Software is a powerful digital investigation tool designed to help forensic professionals uncover and analyze evidence efficiently.
- Rapid File Search: Quickly locate files on Windows systems or forensic images, significantly outperforming standard search functionalities.
- In-Depth File Content Search: Utilize an advanced indexing engine to perform fast searches within file contents, supporting a wide range of file types including Office documents, PDFs, and emails.
- Email Analysis: Search and analyze email archives from various clients such as Outlook and Thunderbird, enabling efficient examination of communications.
- Deleted File Recovery: Retrieve files that have been deleted or removed from the Recycle Bin, allowing access to data that users may have attempted to destroy.
- User Activity Monitoring: Investigate recent user actions, including accessed websites, connected USB devices, and downloaded files, to build a comprehensive activity profile.
- Password Recovery: Extract and recover passwords from web browsers, email clients, and Wi-Fi networks, facilitating access to protected information.
- Hidden Disk Area Detection: Expose hidden areas on hard disks, such as HPA and DCO, which can be used to conceal data, ensuring no information remains hidden.
- Volume Shadow Copy Access: Browse and analyze Volume Shadow Copies to view past versions of files and detect changes over time.
- File Verification and Hash Matching: Verify file integrity using MD5, SHA-1, and SHA-256 hashes, and identify misnamed files where contents don't match their extensions.
- Drive Signature Comparison: Create and compare drive signatures to detect differences and changes on a system, aiding in identifying unauthorized modifications.
- Timeline Visualization: Utilize the Timeline Viewer to graphically represent file and system activity over time, helping to pinpoint significant events.
- Comprehensive File Analysis Tools: Access a suite of tools including file viewers, email viewers, registry viewers, and raw disk viewers for thorough examination of various data types.
- Case Management and Reporting: Organize evidence into secure case files and generate customizable reports to present findings effectively.
- Drive Imaging and RAID Reconstruction: Create and restore disk images, and rebuild RAID arrays from individual disk images, ensuring data integrity during analysis.
- Portable Operation: Run OSForensics from a USB drive, allowing investigations to be conducted directly on target systems without installation.
