File System Browser

Explorer-like Navigation of supported file systems on physical drives, volumes and images

OSForensics™ provides an explorer-like File System Browser of all devices that have been added to the case. Unlike Windows Explorer, the File System Browser is able to display additional forensic-specific information, as well as allow analysis to be performed using OSForensics' integrated tools.

Supported file systems are:

  • NTFS (Windows)
  • FAT16 / FAT32 / exFAT (DOS/Windows)
  • Ext2 / Ext3 / Ext4 (Linux/Android)
  • HFS+ / HFSX (Mac/iPhone/iPad)

Forensics-related operations can be performed directly on the files/folders, such as hash set lookup, indexing, viewing with built-in file viewer, and adding files to a case.

Other features include

  • Listing deleted files in the current folder.
  • NTFS file permissions are completely bypassed
  • Viewing $I30 slack space file names
  • Displaying NTFS Steams & stream size for each file
  • Showing fragmentation state for each file
  • Viewing hidden system files, such as $Attdef, $BadClus, $Bitmap & $MFT
  • Recursive calculation of directory sizes
  • Precise display of all file system dates / times
Conference banner