OSForensics

OSForensics suits investigators who need to examine varied computer evidence and document their work in one Windows-based workflow. Its range of search, activity-review and case tools is a clear strength; its substantial license costs make it harder to justify for occasional use.

Overview

OSForensics brings file search, evidence identification, activity analysis, password recovery, disk imaging and case reporting together. It can work with evidence from Windows, Mac, Linux, Android and iOS/macOS file systems, as well as disk images, memory dumps, emails, browser data, registry hives, SQLite and ESE databases. That breadth is useful when a case crosses evidence types, though the software itself is designed for Windows.

It supports Windows 7, 8, 10 and 11, plus Windows Server 2012, 2016, 2019 and 2022; 32-bit support is deprecated. The minimum is 2 GB of RAM, with 16 GB or more recommended, and 500 MB of free disk space unless running from USB. USB portability is practical for field work, but does not change the Windows system requirement.

Key features

Search and indexing cover files, document contents and email archives, and the software attempts to recover deleted files. Hashing can verify files or match them against known files, while extension checks can flag files whose names do not match their type. These tools help narrow large evidence collections, but recovery is an attempt, not a guarantee that deleted material can be restored.

Activity analysis can surface opened documents, web history, connected USB devices and network shares, giving investigators a way to review traces of recent user activity. Password tools can recover passwords from commonly used web browsers and use rainbow tables to retrieve passwords from hashes. Their scope is specific; they should not be mistaken for a promise to unlock any account or encrypted data.

Case files group evidence, hash data cryptographically and produce reports readable as HTML or PDF, with narratives and external reports. An automatically maintained secure audit trail records investigation activity. Together, these features support a documented workflow rather than leaving findings scattered across separate searches.

Disk imaging can create and restore images so analysis can proceed without risking the integrity of original evidence. OSForensics can also browse popular email formats such as PST and SQLite databases used by iPhone, Firefox and Chrome. Export formats include HTML, PDF, CSV and MHT.

Pricing

The free plan costs nothing, with feature differences from paid editions. It is the no-cost option to consider first, but does not promise the full feature set. The OSForensics Trial Edition is also free for a 30-day trial; it is feature-restricted, allows 1 install, includes free public forum support and has no upgrades.

The Subscription costs $95 a month, billed per user per month. It includes the latest version and updates, plus priority support, but the license stops working when the subscription expires. It fits users who want current software without a perpetual purchase, provided they can accept the ongoing fee and loss of access at expiry.

The Perpetual License (12 months support) costs $1,680, paid once, per user. The software does not expire, and the license includes 12 months of support, 2 machine installs and 1 USB install for the same user. At $3,675, paid once, the Perpetual License (36 months support) offers the same install allowances, but extends included support to 36 months. These suit sustained casework better than a short-term subscription, though both require a significant upfront commitment.

The Site License uses custom pricing, tiered by estimated users within an organization. Purchases include business-hours support by phone, email or online forums; the trial has free public forum support. The published starting note of From $89/mo does not match the listed subscription price of $95 a month, so buyers should confirm the applicable quote before committing.

Platforms

The supported operating systems are Windows 7, 8, 10 and 11, and Windows Server 2012, 2016, 2019 and 2022. Although evidence sources include Mac, Linux, Android and iOS/macOS file systems, those are evidence types rather than supported desktop platforms for running OSForensics. The download can run from a USB drive, with no installation disk-space requirement in that mode.

Who it's for

OSForensics is best suited to professional investigators who regularly search mixed evidence collections, review user activity, image drives and prepare case reports. Its audit trail and report exports matter where findings need a documented record. Occasional users may find the paid licenses difficult to justify, while teams needing to run their primary forensic software on macOS or Linux should look elsewhere.

Pros and cons

• Pros: Search, activity analysis, imaging, password tools and case reporting sit in one investigation workflow, reducing the need to assemble separate tools for these tasks.
• Pros: Broad evidence sources include mobile file systems, memory dumps, emails and databases, useful for cases that span several formats.
• Pros: Cryptographic case hashing, an audit trail and HTML/PDF reports help preserve and communicate investigation work.
• Cons: The perpetual licenses cost $1,680, paid once or $3,675, paid once per user, a steep entry price for occasional work.
• Cons: The software's system requirements are Windows-only, despite its ability to process evidence from other operating systems.
• Cons: The trial is feature-restricted and lasts 30 days, so it may not represent the complete paid workflow.

Alternatives

Compare digital forensics software if you want to weigh tools across the category.

• Hayabusa is a free choice for investigators who want a tool available on Linux, macOS and Windows.
• NetworkMiner offers a free edition and GPLv2 open-source software for readers seeking an open-source alternative.
• Paraben E3 Forensic Platform is worth considering for broader platform support, with Android, iOS, Linux, macOS and Windows listed, and monthly plans starting at $60 a month.
• Plaso is a free option for readers seeking a tool available on Linux, macOS, Windows and self-hosted environments.
• Volatility 3 is a free and open-source option for readers focused on memory forensics.
• CAINE offers a free ISO image for readers who prefer a Linux and Windows forensic environment.
• Exterro FTK Imager is a free Windows-only choice when forensic imaging and preview are the priority.
• The Sleuth Kit is a free, open-source option for readers looking for forensic tools and a C library.

Verdict

Choose OSForensics if your regular Windows casework benefits from broad evidence search, activity review, imaging and documented reporting in one suite. Its strongest reason to buy is that integrated investigation workflow; its strongest reason to look elsewhere is the high per-user license cost, especially for occasional use or teams that need a non-Windows desktop platform.