Ranked #1 free
forensics tool
Uncover Recent Activity
OSForensics™ scans your system for evidence of recent activity, such as accessed websites, USB drives, wireless networks, recent downloads, website logins and website passwords. This is especially useful for identifying trends and patterns of the user, and any material or accounts which which have been accessed recently.
Web Browser Activity
OSForensics helps you uncover web browser activity from users such as browsing history, cookies and stored usernames from web browsers. The table below shows which items can be retrieved from commonly used web browsers using OSForensics' Recent Activity module:
| Browser Name | Version Numbers | Browsing History | Cookies | Download History | Usernames and Passwords |
| Google Chrome | 8, 9, 10, 11 |  |
|
|
 |
| Microsoft Internet Explorer | 6 | |
|
 |
|
| Microsoft Internet Explorer | 7, 8 | |
|
|
|
| Mozilla FireFox | 2 | |
|
|
|
| Mozilla FireFox | 3, 4 | |
|
|
|
| Apple Safari | 4 | |
|
|
|
| Opera | v9, v10 | |
|
|
|
|
Yes, supported for all users | |
Yes, for current user only | |
Unsupported |
Registry Activity
Most Recently Used (MRU) Lists
OSForensics can retrieve data about recently accessed applications, documents, media and network shares by scanning locations in the registry which store a user's Most Recently Used (MRU) lists. The data which can be tracked by OSForensics includes (but isn't limited to) files accessed in Microsoft Office applications, Microsoft Wordpad, Microsoft Paint, Microsoft Media Player, Windows Search, Connected Network Drives and the Windows Run command.
Connected USB Devices
OSForensics can display the details of USB devices which have been recently connected to the computer, providing information about the last connection date and device information such as Manufacturer Name, Product ID and Serial Number. The types of devices which can be detected include USB Flash Drives (UFDs), Portable Hard Disk Drives and external USB-connected devices such as DVD-ROM drives.
Wireless Network Connections
OSForensics can list the MAC address of wireless networks connected using the Windows Zero Config Service. This feature is available on machines running Windows XP only.
Timeline View
As with many of OSForensics' features, you can use the Timeline View to identify patterns in the system activity.
Read more about Timeline View »
