FAQs and Tutorials

Get answers for commonly asked questions about OSForensics.

Price and Installation

How much does OSForensics cost?
How many OSForensics Licenses Will I Need?
How to install OSForensics on a USB drive
How to boot into OSForensics with WinPE
Replacing Microsoft Cofee with OSForensics

Disk Drives and Images

Why can't I see networked drives in OSForensics?
How to examine Mac and Linux hard drives with OSForensics?
How to acquire an image of a Chromebook hard disk?
How to Create an image of a network location
How to determine if my disk is MBR or GPT?
Why can't I access mounted drives in Windows?
How to determine if there are hidden partitions on a drive?
How to determine if there are unallocated sectors on a drive?
How to determine if there are extended partitions on a drive?
Booting a forensics image on a Virtual Machine

Viewing Files and File Operations

How to view files with NTFS streams
How to copy a locked file in Windows
How to view the size of a directory
How to view files fragmentation
How do I view hidden NTFS files?
How to scan NTFS $I30 (directory) entries for evidence of deleted files?

Integration with External Tools

Using OSForensics with RegRipper
Using OSForensics with Volatility

Searching and Indexing

If I index a hard disk does it include the deleted files?
How to list all files and emails on a disk
Which e-mail formats are compatible with OSForensics?
How to search and sort images by color
How to Create Custom Search Presets in the File Name Search Module

Password Recovery and File Decryption

How to perform File Decryption & Password Recovery
How Recover Windows Login Passwords


Scanning Standalone Registry Files for Recent Activity
How to Identify Uninstalled Software
How to run in Debug Mode
How to customize the Appearance of Case Reports
How to check an MD5 hash checksum of a file (or SHA1)
How to Import NSRL hash sets from NIST
How to check the MD5 (or SHA1) hash checksum of an entire volume, disk or image