• 
  • Find files faster
  • Search within files
  • Search for E-mails
  • Recover deleted files
  • Uncover Recent Activity
  • Collect system information
  • Password recovery
  • Hidden Disk Areas - HPA/DCO
• 
  • Verify and match files
  • Find misnamed files
  • Compare drive signatures
  • Timeline viewer
  • File viewer
  • Binary String Extraction
  • Email viewer
  • Registry viewer
  • File system browser
  • Raw disk viewer
  • Thumbnail cache viewer
  • SQLite database browser
  • ESE database browser
  • Prefetch viewer
  • $UsnJrnl viewer
  • Plist viewer
• 
  • Case management
  • Generate reports
  • Storage device management
  • Drive Imaging
  • Rebuild RAID arrays
  • Portability
  • Secure case logging
  • Support

   

File System Browser

OSForensics™ provides an explorer-like File System Browser of all devices that have been added to the case. Unlike Windows Explorer, the File System Browser is able to display additional forensic-specific information, as well as allow analysis to be performed using OSForensics' integrated tools.

Supported file systems are:

• NTFS (Windows)
• FAT16 / FAT32 / exFAT (DOS/Windows)
• Ext2 / Ext3 / Ext4 (Linux/Android)
• HFS+ / HFSX (Mac/iPhone/iPad)

Forensics-related operations can be performed directly on the files/folders, such as hash set lookup, indexing, viewing with built-in file viewer, and adding files to a case.

Other features include

• Listing deleted files in the current folder.
• NTFS file permissions are completely bypassed
• Viewing $I30 slack space file names
• Displaying NTFS Steams & stream size for each file
• Showing fragmentation state for each file
• Viewing hidden system files, such as $Attdef, $BadClus, $Bitmap & $MFT
• Recursive calculation of directory sizes
• Precise display of all file system dates / times