OSForensics

Evidence of suspicious activity on a computer can be covered up, but it can be recovered with the right applications. There are numerous applications for this purpose, from data recovery programs to registry viewers or file comparison utilities. If you don't want to install so many applications, you can turn to OSForensics. You can think of this program as a forensics toolbox, with fingerprint powder and other trace detection tools, but for your computer. It includes everything you need to investigate suspicious activity on a computer. You can find and identify files, recover deleted items, gather emails and much more.

OSForensics comes in a Professional version, as well as a free, but restricted edition. It can be used on Windows XP and all later editions, up to Windows 8, including various Server editions. The software can be installed in less than a minute and it can also run from a USB drive. It asks for 30 MB of free disk space and at least 1 GB of RAM, which should not be too much for any modern computer.

The software provides numerous utilities, which are listed on the left side of the user interface. Additionally, the available tools are neatly categorized on a home screen, to make them easier to spot. You can find tools for searching and indexing files, identifying and hashing files, searching for emails, viewing memory information, retrieving system artifacts and passwords and many more.

Tools can be selected by clicking one of the tabs located on the left side of the interface or by clicking their corresponding icons, on the larger area on the right. Although they don't display too many options, the program's tools display a vast range of information, on one or more tabs. Most operations are prepared just by targeting drives, folders, files or extensions and making other simple configurations.

Besides detecting activity traces, you can also manage your cases. Before you start looking for evidence, you can specify a case name, an investigator, an organization and contact details. The software allows you to choose between a live acquisition of the current machine and a disk investigation from another computer. Furthermore, OSForensics can be installed on a USB drive, by selecting one of its tools, located on the left side of the interface or on the home screen. Installing the software on a USB drive gives you the possibility of investigating other computers, without going through multiple installation processes.