OSForensics V10

by PassMark Software
Home » Computer Forensics » Software » OSF Forensics

Digital Investigation for a New Era


Discover relevant data faster through high performance file searching and indexing. Extract passwords, decrypt files and recover deleted files quickly and automatically from Windows, Mac and Linux file systems.

For Windows

  • Identify suspicious files and activity
  • Extract evidence from computers quick
  • Manage your investigation

Complete Suite for Forensic Investigation

Search Files Fast

OSForensics™ provides one of the fastest and most powerful ways to locate files on a Windows computer. You can search by filename, size, creation and modified dates, and other criteria.

Extensive File Type Support

OSForensics™ includes one of the fastest and most powerful ways to search within the contents of all the files on a hard disk, powered by the acclaimed Zoom Search Engine.

Password Recovery

With OSForensics you can recover browser passwords from Chrome, Edge, IE, Firefox, and Opera. This can be done on the live machine or from an image of a harddrive. Data recovered includes, the URL of the website (usually HTTPS), the login username, the site’s password, the browser used to access the site & the Window’s user name.

Uncover User Activity

OSForensics™ scans your system for evidence of recent activity, such as accessed websites, USB drives, wireless networks, recent downloads, website logins and website passwords. This is especially useful for identifying trends and patterns of the user, and any material or accounts which have been accessed recently.

Browse Volume Shadow Copies

OSForensics™ includes built-in support for accessing Volume Shadow Copies. Shadow copies provide a glimpse of the volume at a point in time in the past. This will allow for discovery of changes to files and even view possible deleted files.

Reveal Hidden Areas on a Hard disk

OSForensics™ can discover and expose the HPA and DCO hidden areas of a hard disk, which can used for malicious intent including hiding illegal data. The Host Protected Area (HPA) and Device Configuration Overlay (DCO) are features for hiding sectors of a hard disk from being accessible to the end user.

Recover Deleted Evidence

OSForensics™ allows you to recover and search deleted files, even after they have been removed from the Recycle Bin. This allows you to review the files that the user may have attempted to destroy.

Request a Quote

    If possible, please use a valid agency/company email.

    RCMP DMFT Program?

    This is necessary to quote accurate shipping costs.