OSForensics

OSForensics lets you discover all relevant forensic evidence from a system, quickly and easily. OSForensics™ allows you to search for files many times faster than the search functionality in Windows.

Results can be analyzed in the form of a file listing, a Thumbnail View, or a Timeline View which allows you to determine where significant file change activity has occurred

After a file has been deleted, even once removed from the recycling bin, it often still exists until another new file takes its place on the hard drive. OSForensics can track down this ghost file data and attempt to restore it back to useable state on the hard drive.

Look directly at what is currently in the systems main memory. Attempt to uncover passwords and other sensitive information that would otherwise be inaccessible.

Select from a list of active processes on the system to inspect. OSF can also dump their memory to a file on disk for later inspection.