OSForensics™ provides an explorer-like File System Browser of all devices that have been added to the case. Unlike Windows Explorer, the File System Browser is able to display additional forensic-specific information, as well as allow analysis to be performed using OSForensics' integrated tools.
Supported file systems are:
- NTFS (Windows)
- FAT16 / FAT32 / exFAT (DOS/Windows)
- Ext2 / Ext3 / Ext4 (Linux/Android)
- HFS+ / HFSX (Mac/iPhone/iPad)
- APFS (Mac/iPhone/iPad)
Forensics-related operations can be performed directly on the files/folders, such as hash set lookup, indexing, viewing with built-in file viewer, and adding files to a case.
Other features include
- Listing deleted files in the current folder.
- NTFS file permissions are completely bypassed
- Viewing $I30 slack space file names
- Displaying NTFS Steams & stream size for each file
- Showing fragmentation state for each file
- Viewing hidden system files, such as $Attdef, $BadClus, $Bitmap & $MFT
- Recursive calculation of directory sizes
- Precise display of all file system dates / times
