Nowadays, computer forensics is used more frequently by security and law-enforcing agencies to detect traces of wrongdoings among employees and particular users. This program performs an in-depth analysis of systems to detect evidence that can convict cyber criminals and other delinquents.
Although its functions are very specialized, it is really easy to use. You can start by creating a case by typing its name and that of the investigator, as well as other data regarding the custody of information, the body requesting the investigation, and so on. The program has powerful capabilities. You can search files by name and select those you want to inspect. This process is done in mere seconds, unlike other file search methods, which can take several minutes or even hours. You can also search among the deleted files those that were destroyed by the delinquent to erase any evidence. This process takes a while, since, as I've said, it is a very in-depth search.
The program has many other functions, such as a recent activity research function, a built-in web browser so you don't need to perform Internet functions outside the program, and much more. Thus, you will need to read the full manual to become familiar with all the program's functionalities.
Since the program is aimed at corporate and law-enforcing users, its cost is not affordable for common users. Nevertheless, if you need to research a computer in search of specific data for security purposes, then you may find it useful.
You can use the shareware version of the program during 30 days. If you find it useful and want to use it longer, then you will need to purchase a license.
v2.0 [Jan 30, 2013]
-Forensic Copy:
-Fixed Forensic File Copy not copying folder 8.3 short names.
-Made change to handle setting 8.3 short file names on files that have a read-only flag.
-Added fractions of seconds to internal viewer file properties output.
-Recent Activity - Now also searches registry location for typed IE URLs.
-System information:
-Changed the dialog title to reflect that a command is being edited rather than a new command.
-Fixed a bug where if the first entry in the list was editable then it wasn't loading correctly and defaulting to the new command dialog.
-Fixed a bug where if the list management dialog was closed using the X button rather than OK the current command window display was not being updated to reflect any changes.
-Added new system information functions (Get User Info, Get Timezone, Get computer name, Get network info) that can query the registry for information, these functions can be used on the local system as well as disk images and other system drives.
-Navigation Bar - Added 'Registry Viewer' button.
-Start Page - Dialog for selecting registry file now closes when the Registry Viewer is opened.
-Registry Viewer:
-Correct icon is now displayed for Find/Goto windows.
-All search types now selected by default in Find window.
-and keys now work properly for Find/Goto windows.
-Cancel button now works properly for Find/Goto windows.
-Find/Goto windows stay open after search.
-Added splitter bar and fixed resizing issues.
-Added shortcut keys for searching (Ctrl F, F3, Ctrl G).
-Find/Find next now traverses the tree in order according to currently selected entry.
-Added support for opening multiple registry files in one viewer.
-Added icons for tree view.
-Email Viewer:
-Fixed bug with retrieving the HTML body using the MVCOM library. Should use _bstr_t instead of BSTR.
-Changed header fields to Edit controls to fix redraw issues when resizing.
-Improved parsing of Data/Time strings.
-Hex View:
-Added Ctrl C (copy hex) and Ctrl A (select all) keyboard shortcuts.
-Fixed crash carving data.
-Changed string extraction so that it no longer separates URL strings into components (eg. 'http', 'www'), this was preventing the URL filter be useful.
-Password Recovery:
-Changed behaviour when recovering Firefox passwords so that is a firefox install isn't found on the drive being scanned OSForensics will also check for a FireFox install on the system drive.
-If a FireFox location is not found an error message is now displayed.,
-Added warning to password recovery and system information functions when running on a live system and the permissions of the SAM registry files need to be changed.
Share images, video and music between your Android and Windows devices
