• 
  • Find files faster
  • Search within files
  • Search for E-mails
  • Recover deleted files
  • Uncover Recent Activity
  • Collect system information
  • Password recovery
  • Hidden Disk Areas - HPA/DCO
• 
  • Verify and match files
  • Find misnamed files
  • Compare drive signatures
  • Timeline viewer
  • File viewer
  • Binary String Extraction
  • Email viewer
  • Registry viewer
  • File system browser
  • Raw disk viewer
  • Thumbnail cache viewer
  • SQLite database browser
  • ESE database browser
  • Prefetch viewer
  • $UsnJrnl viewer
  • Plist viewer
• 
  • Case management
  • Generate reports
  • Storage device management
  • Drive Imaging
  • Rebuild RAID arrays
  • Portability
  • Secure case logging
  • Support

   

ESE Database Viewer

OSForensics™ includes an ESE database (ESEDB) viewer for databases stored in the Extensible Storage Engine (ESE) file format, including the new Win10 database structure. The ESEDB format, in particular, is used by several Microsoft applications that store data with potential forensics value, including the following:

• Windows (Desktop) Search
• Windows Live Mail
• Microsoft Exchange Server
• Internet Explorer

The ESE database viewer allows the user to search for database records that match a specified criteria, including text phrases, date ranges and numerical values.