Why can't I see networked drives in OSForensics?

On Windows Vista and later there is an issue relating to the User Access Control (UAC) and mapped network drives. Mapped network drives are not visible when running  as elevated administrator, which is what OSForensics is running in the majority of the time.

For most operations you should be able to simply browse to the location the network drive points to and access the files that way.

There is a workaround available that makes network drives available with elevated admin, and by extension available for use in OSForensics.

  1. Click Start, type regedit in the Start Search box, and then press ENTER.
  2. Locate and then right-click the following registry subkey:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  3. Point to New, and then click DWORD Value.
  4. Type EnableLinkedConnections, and then press ENTER.
  5. Right-click EnableLinkedConnections, and then click Modify.
  6. In the Value data box, type 1, and then click OK.
  7. Exit Registry Editor, and then restart the computer.

A more complete description of this issue and the workaround as explained by Microsoft can be found here http://support.microsoft.com/kb/937624

Alternatively you can run OSF in non-elevated admin mode by running either OSF32.exe or OSF64.exe (depending on your environment) from the OSF install directory. Keep in mind some functionality may be disabled when running as non-elevated admin.

Networked Drives