OSForensics 3 uncovers even more hidden PC details
PassMark Software has announced the release of OSForensics 3.0, a major update for its excellent PC investigation suite.
A stack of new viewers tell you more about your target system. The Prefetch viewer reveals when (and how frequently) applications have been run; the ThumbCache viewer displays thumbnails cached by Explorer, and the ESE Database viewer gives access to a host of low-level Windows information.
Vastly improved support for deleted files means you can search for them on HFS+ files, they can be displayed in the File System Browser and Search tools (both file name and thumbnail views), their metadata is a couple of clicks away and you’re able to view them on demand.
A much smarter email viewer now supports filtering by date, and searching message bodies.
Compatibility improvements include support for mounting and restoring VHD images, and displaying modified dates on EXT2/HFS file systems, while the Firefox password recovery feature once again works for the latest version of Firefox.
The official OSForensics "What’s New" page lists many other significant additions. Multiple images can be mounted at the same time; the new file indexer supports real-time logging; file details now include their LCN (Logical Cluster Number), showing where they’re located on a drive; the Timeline view has been revamped with even more details on your discoveries, and there’s a pile of bug fixes.
OSForensics 3.0 is available in both a Free (for personal use) and $499 Professional Edition, while Professional upgrades are available for $249.