Discover relevant forensic evidence faster.
Find files quickly
OSForensics™ allows you to search for files many times faster than the search functionality in Windows.
Results can be analyzed in the form of a file listing, a Thumbnail View, or a Timeline View which allows you to determine where significant file change activity has occurred.

OSFClone is a free, self-booting solution which enables you to create or clone exact raw disk images quickly and independent of the installed operating system. In addition to raw disk images, OSFClone also supports imaging drives to the open Advance Forensics Format (AFF). AFF is an open and extensible format to store disk images and associated metadata.

Use ImageUSB to write an image to multiple USB Flash Drives! Designed for use with OSForensics.
ImageUSB is a free utility which lets you write an image concurrently to multiple USB Flash Drives. Capable of creating exact bit-level copies of USB Flash Drive (UFDs), ImageUSB is an extremely effective tool for the mass duplication of UFDs. ImageUSB also supports writing of an ISO file byte by byte directly to an USB drive (*). ImageUSB can also be used to install OSFClone to a USB Drive for use with PassMark OSForensics™.

OSFMount allows you to mount local disk image files (bit-for-bit copies of a disk partition) in Windows with a drive letter. You can then analyze the disk image file with PassMark OSForensics™ by using the mounted volume's drive letter. By default, the image files are mounted as read only so that the original image files are not altered.

7f0K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3!0K6k6X3!0J5k6h3&6K6K9h3y4K6i4K6u0W2j5$3!0E0i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2Z5N6r3#2D9

v1.2.1003 - 3rd of October 2012
-Fixed indexing for drive root.

Setup:
e9aK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3!0K6k6X3!0J5k6h3&6K6K9h3y4K6i4K6u0W2j5$3!0E0i4K6u0r3k6r3!0%4L8X3I4G2j5h3c8K6i4K6u0r3L8%4y4X3i4K6u0W2k6i4S2W2

[培训]科锐逆向工程师培训第53期2025年7月8日开班！