OSForensics - Free Forensic Software

OSForensics is a free forensic software. It contains an entire forensic toolkit with the ability to create cases, discover and read files, recover deleted files, find good and bad files using known hashes, search within files and much more. It also includes several useful digital forensics tools that enable users to easily extract forensic data from computers for study and review of evidence.

It also features a built in tool for copying the software to a USB device, essentially enabling you to create a Portable Forensic Lab that you can bring with you on a USB drive.

OSForensics Portable Forensic Toolkit

OSForensics Free Portable Forensic Toolkit

OSForensics is a digital forensics and investigative software. It is designed to assist in the analysis and investigation of computer systems, helping forensic professionals and investigators collect and analyze digital evidence from various sources.

Key features include:

  • File Search and Indexing: Provides powerful file search capabilities, allowing users to quickly locate files and folders on a computer or storage device. The software can create an index of file metadata to speed up search operations.
  • File Signature Identification: The tool can identify files based on their unique signatures, helping investigators identify and categorize files on a system.
  • Disk Imaging: Supports the creation of forensic disk images. Disk imaging is crucial for preserving the state of a storage device for analysis without modifying the original data.
  • System Profiling: The software can generate detailed reports about a computer system, including hardware specifications, installed software, user accounts, and other system information.
  • Registry Analysis: Allows investigators to analyze the Windows registry, which contains critical information about the configuration and operation of a Windows system.
  • Password Recovery: The tool includes features for recovering passwords stored on a system, providing access to encrypted files and user accounts during an investigation.
  • Timeline Analysis: Enables investigators to create timelines of system activity, helping to establish a chronological order of events on a computer.
  • Web Browser History Analysis: The software can analyze web browser history and cache, providing insights into the user's online activities.
  • Email Forensics: Supports the analysis of email data, including the recovery of deleted emails and attachments.
  • Hashing and Integrity Verification: Can compute and verify hash values for files, ensuring data integrity during forensic analysis.

Specifications | Official Project Page

  • Authors Website: OSForensics Page
  • Developer: developed by PassMark Software
  • License: Beta version is Freeware
  • Installed Size: 33 MB

How to run OSForensics Portably from USB

To make OSForensics portable:

  1. Download OSForensics and run the installer, installing to your PC.
  2. Launch the program from your computer, and select the "install to USB" option under housekeeping.
  3. Use osf.exe to run the program from your USB flash drive.