Download OSForensics (latest 2021) for Windows 10, 8, 7

OSForensics allows you extract forensic data from computers fast with high-performance file searches and indexing. Identify suspicious files and activity with hash matching, disk signature comparisons, e-mail, memory, and binary data. Manage your digital research and generate reports from collected forensic data. Enjoy!

OSForensics can index the contents of a huge variety of file formats. This includes: DOC, DOCX, PDF, PPT, XLS, RTF, WPD, SWF, DJVU, JPG, GIF, PNG, TIFF, MP3, DWF, DOCX, PPTX, XLSX, MHT, zipper, PST, MBOX, MSG, DBX, ZIP, ZIPX, RAR, ISO, TAR, 7g and more. Retro containers are also supported. It is therefore possible to properly index a DOCX file that is attached to an E-mail to a PST file which in turn is compressed into a ZIPX file.

It provides one of the fastest and most powerful ways to locate files on a Windows computer. You can search by file name, size, creation and modification dates, and other criteria. The results are returned and available in many different useful views. This includes Timeline View which lets you sift the games on a schedule, making the pattern of user activity on the machine visible.

The first step in being able to search for emails is the indexing of these files. This may take some time, but it does allow for repeated quick searches later. OS Forensics Allows you to search full text within e-mail files used by many popular e-mail programs, such as e.g. Microsoft Outlook, Mozilla Thunderbird, Outlook Express and more.

OSForensics allows you to retrieve and search for deleted files, even after being removed from the Recycle Bin. This allows you to control the files that the user may have tried to corrupt. Each deleted file found is displayed with a corresponding quality index between 0-100. A value of 100 means that the deleted file is largely intact, with only a few data sets missing.

OSForensics scans your system for recent activity items, such as sites you have access to, USB drives, wireless networks, recent downloads, site links, and site passwords. This is especially useful for tracking user trends and patterns, as well as any recently accessed material or accounts.

With the program, you can retrieve browser passwords from Chromium, Edge, IE, Firefox, and Opera. This can be done on the live machine or from an image on a hard drive. The data retrieved includes the site URL (usually HTTPS), the login username, the site password, the browser used to access the site, and the Windows username. Blacklisted URLs also indicate that the user has visited the site but has chosen not to save a password in the browser.

It can discover and expose the hidden HPA and DCO areas a hard drive that could be used for malicious intent, including hiding illegal data. Host Protected Area (HPA) and Device Configuration Overlay (DCO) are options for hiding sectors of a hard drive from end-user access.

The application includes built-in support for access Volume shadow copies. Shadow copies provide a taste of the intensity of a time in the past. This will allow you to detect changes in the files and even view possible deleted files.

Provides one basic web viewer with the ability to load web pages from the web and save web screen recordings in the case.
The Browser can be optionally configured to list web pages from a list of user-defined URLs. Additionally, the web browser can record all or a subset of linked pages (up to one level)

Characteristics and main points

• Import and export hash sets
• Customizable system information collection
• There are no restrictions on the number of cases managed through OSForensics
• Restore multiple deleted files to one function
• List and search for alternative file streams
• Sort image files by color
• Indexing and searching disks is not limited to a fixed number of files
• There is no watermark in the web logs
• Multi-core acceleration for file decryption
• Customizable system information collection
• Find files faster, search by file name, size and time
• Search within file content using the Zoom search engine
• Search through email files from Outlook, ThunderBird, Mozilla and more
• Recover and search for deleted files
• Discover recent activity of visits, downloads and links to the site
• Gather detailed system information
• Recover password from web browsers, decrypt office documents
• Discover and reveal hidden areas on your hard drive
• Browse volume shadow copies to see previous versions of files

Note: 30 days trial version. Limited functionality.