PassMark Software has unveiled OSForensics 4, a major update for its powerful PC forensics tool.
There’s bad news: the “free for personal use” edition has been replaced by a 30-day trial.
The trial has more than enough power to run one or two quick investigations, though, and the latest additions deliver even more information about your target PC.
Password recovery is a major highlight, with OSForensics 4 now finding and decrypting stored logons for Windows accounts, wireless networks, Outlook and Windows Live Mail accounts.
There are new options to choose a dictionary for brute force attacks on account passwords, and GPU-accelerated hardware support for brute force recovery on Office documents, PDFs and archives.
There are tools to investigate files, emails, web history, your Registry, passwords and more
New NTLM hash cracking support helps identify common Windows login passwords, and bonus recovery features include the decryption of Microsoft product keys.
File system imaging improvements include long-awaited exFAT support, and the ability to preserve owner, group and permission metadata when creating a “Forensic Copy”.
New search tools include a preset for locating peer-to-peer files, BCC searching for emails, and image file EXIF header indexing for Camera Make, Model, GPS date/time, GPS Latitude, and GPS Longitude.
The video previewer can now play GP, ASF, ADTS, MPEG-4, SAMI, AAC, WMA, DV Video, H.264/H.263 and WMV movies.
The Reporting tool sums all this up faster than ever, in a redesigned and streamlined layout, with new PDF output (at last) simplifying the task of sharing it with others.
Okay, yes, the price for all this is $899, but if you really need to understand how someone’s been using a PC then even the trial will be very, very useful.
OSForensics 4 requires Windows XP or later.