PassMark OSForensics Professional 7.0 Build 10006 + Portable
PassMark OSForensics Professional 7.0 Build 10006: A Comprehensive Review
If you are looking for a software that can help you access and analyze digital evidence on computer systems, you might want to check out PassMark OSForensics Professional 7.0 Build 10006. This is a new and powerful software that can assist you in discovering relevant data faster, identifying evidence and suspicious activity, and managing your entire digital investigation. In this article, we will review the features, benefits, pros, cons, pricing, and support of this software, as well as show you how to use it effectively.
PassMark OSForensics Professional 7.0 Build 10006
Features and Benefits of OSForensics
OSForensics is a software that can extract forensic data from computers, quicker and easier than ever. It can uncover everything hidden inside a PC, from files and emails to passwords and deleted data. It can also identify evidence and suspicious activity through hash matching and drive signature analysis. Moreover, it can manage your investigation with its new reporting features, allowing you to build custom reports, add narratives, and even attach your other tools' reports to the OSF report. Here are some of the main features and benefits of OSForensics:
Discover data
OSForensics can help you discover relevant data faster through its high performance file searching and indexing capabilities. You can search for files by name, size, date, attributes, content, or hash value. You can also search for emails by sender, recipient, subject, or content. You can even search for passwords stored in web browsers or encrypted files. Additionally, you can recover deleted files from various file systems, such as NTFS, FAT32, exFAT, HFS+, Ext2/3/4, ReFS, UFS1/2.
Identify evidence
OSForensics can help you identify evidence and suspicious activity through its hash matching and drive signature analysis features. You can compare files or drives with known hashes from various sources, such as NSRL (National Software Reference Library), MD5sums (Message Digest algorithm), SHA-1 (Secure Hash Algorithm), or custom hash sets. You can also create drive signatures to identify differences or changes between drives or images. Furthermore, you can view recent activity on the system, such as web browsing history, USB device history, network adapter history, or user login history.
Manage your case
OSForensics can help you manage your entire digital investigation with its new reporting features. You can create and customize reports with various options, such as report title, logo , case number, examiner name, and date. You can also add narratives to explain your findings and conclusions. Moreover, you can attach your other tools' reports to the OSF report, such as EnCase, FTK, X-Ways, Magnet AXIOM, or Autopsy. This way, you can have a comprehensive and consolidated report of your investigation.
How to Use OSForensics
OSForensics is a user-friendly and intuitive software that can be easily installed and activated on your computer. It has a simple and clear user interface that allows you to access the main functions and tools of the software. It also has a case management system that helps you organize and manage your investigations. Here are some of the steps on how to use OSForensics:
Installation and activation
To install OSForensics, you need to download the setup file from the PassMark website. You can choose between the 32-bit or 64-bit version, depending on your system. After downloading the file, you need to run it and follow the instructions on the screen. You can choose the destination folder, create a desktop shortcut, and agree to the license agreement. The installation process should take only a few minutes.
To activate OSForensics, you need to purchase a license from the PassMark website. You can choose between the Standard Edition or the Professional Edition, depending on your needs. The Standard Edition costs $995 USD and allows you to use the software on one computer. The Professional Edition costs $1,495 USD and allows you to use the software on up to three computers. After purchasing a license, you will receive an email with your serial number. You need to enter this serial number in the software and click on Activate.
User interface and navigation
OSForensics has a simple and clear user interface that consists of four main parts: the menu bar, the toolbar, the case explorer, and the workspace. The menu bar contains various options for accessing the software's functions, such as File, Edit, View, Tools, Help, etc. The toolbar contains shortcuts for some of the most commonly used functions, such as New Case, Open Case, Save Case, Search Files, Recover Files, etc. The case explorer shows the list of cases that you have created or opened in the software. You can select a case and view its details in the workspace. The workspace shows the various modules and tools that you can use to collect and analyze data in your case. You can switch between different modules by clicking on their tabs at the bottom of the workspace.
Case management
OSForensics has a case management system that helps you organize and manage your investigations. You can create multiple cases in the software and store them in different locations. You can also open, edit, or delete existing cases as needed. To create a new case, you need to click on New Case in the menu bar or toolbar. You will then need to enter some basic information about your case, such as case name, case number, examiner name, organization name, description, etc. You can also choose where to save your case folder and whether to encrypt it or not. After creating a new case, you will see it in the case explorer and in the workspace.
To open an existing case, you need to click on Open Case in the menu bar or toolbar. You will then need to browse for your case folder and select it. You will see it in the case explorer and in the workspace.
To edit an existing case, you need to select it in the case explorer and click on Edit Case in the menu bar or toolbar. You will then be able to change some of the information about your case, such as case name, case number, examiner name, organization name, description, etc. You can also change the location or encryption of your case folder.
To delete an existing case, you need to select it in the case explorer and click on Delete Case in the menu bar or toolbar. You will then need to confirm your action and choose whether to delete the case folder or not.
Data collection and analysis
OSForensics has various modules and tools that you can use to collect and analyze data in your case. You can access these modules by clicking on their tabs at the bottom of the workspace. Some of the main modules are:
File System Browser: This module allows you to browse the files and folders on a drive or an image. You can view the file properties, contents, metadata, and hex values. You can also copy, move, delete, or export files as needed.
Search Files: This module allows you to search for files by name, size, date, attributes, content, or hash value. You can also filter your search results by various criteria, such as file type, file extension, file owner, etc.
Recover Files: This module allows you to recover deleted files from various file systems, such as NTFS, FAT32, exFAT, HFS+, Ext2/3/4, ReFS, UFS1/2. You can also preview the recovered files before saving them.
Email Viewer: This module allows you to view and search for emails from various email clients, such as Outlook, Thunderbird, Eudora, etc. You can also export the emails as EML or MSG files.
Password Recovery: This module allows you to recover passwords stored in web browsers or encrypted files. You can also use brute force or dictionary attacks to crack passwords.
Hash Matching: This module allows you to compare files or drives with known hashes from various sources, such as NSRL (National Software Reference Library), MD5sums (Message Digest algorithm), SHA-1 (Secure Hash Algorithm), or custom hash sets. You can also create your own hash sets from files or folders.
Drive Signature: This module allows you to create drive signatures to identify differences or changes between drives or images. You can also compare drive signatures with each other or with known signatures from various sources.
Recent Activity: This module allows you to view recent activity on the system, such as web browsing history, USB device history, network adapter history, or user login history. You can also export the activity data as CSV or HTML files.
Report Generator: This module allows you to create and customize reports with various options, such as report title, logo , case number, examiner name, and date. You can also add narratives to explain your findings and conclusions. Moreover, you can attach your other tools' reports to the OSF report, such as EnCase, FTK, X-Ways, Magnet AXIOM, or Autopsy. You can also export the report as PDF or HTML files.
Pros and Cons of OSForensics
OSForensics is a powerful and versatile software that can help you conduct digital investigations faster and easier. However, like any software, it also has its pros and cons. Here are some of the advantages and disadvantages of using OSForensics:
Pros
It has a high performance file searching and indexing engine that can find relevant data quickly and accurately.
It has a wide range of modules and tools that can cover various aspects of data collection and analysis, such as file system browsing, email viewing, password recovery, hash matching, drive signature, recent activity, etc.
It has a new reporting feature that can help you create and customize reports with various options, such as report title, logo, case number, examiner name, date, narratives, attachments, etc.
It has a user-friendly and intuitive user interface that allows you to access the main functions and tools of the software easily.
It has a case management system that helps you organize and manage your investigations efficiently.
It supports various file systems, such as NTFS, FAT32, exFAT, HFS+, Ext2/3/4, ReFS, UFS1/2.
It supports various email clients, such as Outlook, Thunderbird, Eudora, etc.
It supports various hash sources, such as NSRL (National Software Reference Library), MD5sums (Message Digest algorithm), SHA-1 (Secure Hash Algorithm), or custom hash sets.
It supports various drive signature sources, such as NIST (National Institute of Standards and Technology), PassMark (PassMark Software), or custom signatures.
It supports various other tools' reports, such as EnCase, FTK, X-Ways, Magnet AXIOM, or Autopsy.
Cons
It is relatively expensive compared to some other similar software. The Standard Edition costs $995 USD and the Professional Edition costs $1,495 USD.
It requires a license activation for each computer that you want to use the software on. The Standard Edition allows you to use the software on one computer and the Professional Edition allows you to use the software on up to three computers.
It does not have a built-in image acquisition feature that can help you create forensic images of drives or devices. You need to use another tool to create images before using OSForensics.
It does not have a built-in memory analysis feature that can help you analyze volatile data from RAM. You need to use another tool to capture memory dumps before using OSForensics.
It does not have a built-in network analysis feature that can help you analyze network traffic or packets. You need to use another tool to capture network data before using OSForensics.
Pricing and Support of OSForensics
OSForensics is a paid software that requires a license to use. There are two license options available: the Standard Edition and the Professional Edition. The Standard Edition costs $995 USD and allows you to use the software on one computer. The Professional Edition costs $1,495 USD and allows you to use the software on up to three computers. You can purchase a license from the PassMark website using various payment methods, such as credit card, PayPal , drive signature sources, and other tools' reports. OSForensics is also supported by various support options, such as user manual, FAQ, forum, email, and phone.
FAQ
Here are some of the frequently asked questions about OSForensics:
What are the system requirements for OSForensics?
The minimum system requirements for OSForensics are:
Windows XP SP3 or later (32-bit or 64-bit)
Pentium 4 or later processor
1 GB of RAM
200 MB of free disk space
USB port or CD/DVD drive (for bootable disk)
The recommended system requirements for OSForensics are:
Windows 10 (64-bit)
Core i5 or later processor
8 GB of RAM
1 TB of free disk space (for indexing and case storage)
USB 3.0 port or CD/DVD drive (for bootable disk)
How can I create a bootable disk with OSForensics?
You can create a bootable disk with OSForensics by using the OSFClone tool that is included in the software. You can access the OSFClone tool from the Tools menu or the toolbar. You will then need to select a source image file (ISO) and a destination device (USB or CD/DVD). You will also need to choose whether to enable persistence mode or not. Persistence mode allows you to save changes and data to the bootable disk. After selecting the options, you need to click on Start Clone to create the bootable disk.
How can I update OSForensics to the latest version?
You can update OSForensics to the latest version by using the Check for Updates feature that is included in the software. You can access the Check for Updates feature from the Help menu or the toolbar. You will then need to click on Check Now to see if there are any updates available. If there are any updates available, you will see a message with the details of the update and a link to download it. You need to click on Download Update to download and install the update.
How can I get more training on OSForensics?
You can get more training on OSForensics by enrolling in the online courses that are offered by PassMark. You can access the online courses from the PassMark website. There are two courses available: OSForensics Fundamentals and OSForensics Advanced. The OSForensics Fundamentals course covers the basics of using OSForensics, such as installation, activation, case management, file system browsing, file searching, file recovery, email viewing, password recovery, hash matching, drive signature, recent activity, report generation, etc. The OSForensics Advanced course covers more advanced topics of using OSForensics, such as registry analysis, event log analysis, prefetch analysis, shellbag analysis, timeline analysis, malware analysis, memory analysis, network analysis, etc. Each course costs $495 USD and includes access to videos, quizzes , exercises, and a certificate of completion. You can also get a discount if you enroll in both courses at the same time.
How can I contact PassMark for feedback or suggestions?
You can contact PassMark for feedback or suggestions by using the Feedback feature that is included in the software. You can access the Feedback feature from the Help menu or the toolbar. You will then need to enter your name, email address, and feedback message. You can also choose whether to include your system information or not. After entering your feedback, you need to click on Send Feedback to send it to PassMark.
This is the end of the article. I hope you enjoyed reading it and learned something new about OSForensics. If you have any questions or comments, please feel free to contact me. Thank you for your time and attention. dcd2dc6462