OSForensics™ lets you create a forensic signature of a hard disk drive, preserving information about file and directory structures present on the system at the time of signature creation. Identify changes to directories and files by comparing signatures created at different times.
Create Signatures
Creating a signature generates a snapshot of the directory structure of the drive at the point of creation. This information includes data about a file's directory path, file size and file attributes. OSForensics can be configured to include or exclude different drives and directories when creating a drive signature, or even calculate SHA1 hashes for each file on the system.
Analyze Signatures
OSForensics can compare newer signatures with previously generated signatures, letting you quickly identify any suspicious changes to files or directory structure. OSForensics can also use file signatures to indentify duplicate files. Comparing two signatures produces an accessible summary of all file differences, which can be sorted by file name, difference type, file attributes, SHA1 hash (where configured) and more. The summary view can also be filtered to only show files that have been modified, new or deleted. All comparison results can be easily exported to your local drive for future reference.
