Download App

Passmark OSForensics Professional v3.1.1004 Portable | 125 Mb


OSForensics is a new digital investigation tool which lets you extract forensic data or uncover hidden information from computers. OSForensics has a number of unique features which make the discovery of relevant forensic data even faster, such as high-performance deep file searching and indexing, e-mail and e-mail archive searching and the ability to analyze recent system activity and active memory. OSForensics can build and let you view an events timeline which shows you the context and time of activities. You can even recover data and files that have been deleted by users. OSForensics comes with a built-in file viewer which lets you examine a file contents, properties and meta-data, as well as an e-mail viewer which is compatible with most popular mail client formats.

Search within Files
If the basic file search functionality is not enough, OSForensics can also create an index of the files on a hard disk. This allows for lightning fast searches for text contained inside the documents. Powered by the technology behind Wrensofts acclaimed Zoom Search Engine.

Search for Emails
An additional feature of being able to search within files is the ability to search email archives. The indexing process can open and read most popular email file formats (including pst) and identify the individual messages.
This allows for a fast text content search of any emails found on a system

Recover Deleted Files
After a file has been deleted, even once removed from the recycling bin, it often still exists until another new file takes its place on the hard drive. OSForensics can track down this ghost file data and attempt to restore it back to useable state on the hard drive.

Uncover Recent Activity
Find out what users have been up to. OSForensics can uncover the user actions performed recently on the system, including but not limited to:
Opened Documents
Web Browsing History
Connected USB Devices
Connected Network Shares

Collect System Information
Find out whats inside the computer. Detailed information about the hardware a system is running on:
CPU type and number of CPUs
Amount and type of RAM
Installed Hard Drives
Connected USB devices
and much more.

View Active Memory
Look directly at what is currently in the systems main memory. Attempt to uncover passwords and other sensitive information that would otherwise be inaccessible.
Select from a list of active processes on the system to inspect. OSF can also dump their memory to a file on disk for later inspection.

Extract Logins and Passwords
Recover usernames and passwords from recently accessed websites in common web browsers, including Internet Explorer, Firefox, Chrome and Opera.

Whats New in This Release:
Email Viewer
• Added handling of rfc2047 encoding in subject/address fields of MIME headers
• Fixed buffer overflow in status message while recovering deleted e-mails in PST files
• Fixed S shortcut key being processed instead of Ctrl+S to add attachments to case
• Fixed a bug with saving embedded message in PST/OST files as .msg. LIBPFF_ENTRY_TYPE_ATTACHMENT_DATA_OBJECT property was being saved as a stream instead of storage
ESEDB Viewer
• Fixed population of known ESEDB files to use localised folder names instead of hard-coded locations
File Indexing
• Pre-scanning can now be cancelled while scanning PST messages
• Updated Zoom indexer to fix some crash issues
• Updated Zoom Office XML plugin
• Improved length limit for meta fields in email files (used for FROM/TO/CC/BCC) from 255 characters to 65,535 characters.
• During indexing, fixed Total Bytes/Peak Physical Memory/Peak Virtual Memory not updating properly when > 2GB
• Fixed crash bug with buffer overflow and infinite add URL when indexing .MSG file with many attachments
• Fixed bug with only using last filename for all attachments of the same .MSG file
• Fixed bug with losing generated body text with attachment filenames "Attachment(s): ... , ..." for .MSG file indexed.
• Fixed bugs with indexing plain text emails in .MSG files
• Fixed bugs with indexing Chinese PST files (metafield length limit caused Unicode corruption)
• Fixed bug with possible Unicode string corruption when longer than available buffer (with languages such as Chinese with 4 char MB UTF-8 characters)
• Fixed a bug with files sizes not being indexed in offline mode
• Fixed a potential crash caused by long URLS
• Fixed a crash during pre-scanning when indexing unallocated clusters
• Fixed bug with search index failing on old format index files after a search with new format index files.
• Fixed DOCX plugin that split words incorrectly due to revision history
• Fixed crash bug with XLS files with invalid cell.templateID values
Import Hash
• Fixed String/Buffer overflow during import progress updates (if import folder name is too long) by increasing string size
Internal Viewer
• If viewing an excel document that is password protected it will now display a relevant error message
Password Recovery
• Shadow copy now used if registry file is locked
Recent Activity
• Now attempting to get the localised name for the "Documents and Settings" folder from the registry when starting a recent activity scan so more information will be retrieved on non-english Windows installations.
• Shadow copy now used if registry file is locked
• Should now resolve shortcut (.lnk) files in Users Recent Items folder (when not using live acquisition scan option).
• Fixed scanning of system registry hives when no user hives are found
Search Index
• Fixed processing of FILETYPE_MSG and FILETYPE_ATTACHMENT_MSG index results
System Information
• Shadow copy now used if registry file is locked
ThumbCache Viewer
• When looking up default Windows.edb location, now using localised folder names instead of hard-coded locations
WinPE Builder
• Updated build of WinPE Builder. (Allows user to set NTFS filesystem with command line argument -f. Not enabled by default, since FAT32 supports booting both BIOS-based and UEFI-based PCs. UEFI based systems require that the boot files reside on FAT32 partition. If they are not on FAT32 the system may not see the device as bootable.)
Misc
• Fixed bug with handling of NTFS files with mix of compressed/non-compressed fragments
• Help file updates