FAQs and Tutorials

How much does OSForensics cost?

What is the difference between an OSForensics Perpetual License and Subscription License?

How many OSForensics Licenses will I need?

How do I change the number of seats in my OSForensics subscription?

How do I check for OSForensics updates and my support status?

How do I cancel my OSForensics subscription?

How do I retrieve my OSForensics invoices?

How to install OSForensics on a USB drive?

How to boot into OSForensics with WinPE?

What are the recommended system requirements for running OSForensics?

How do I use the Auto Triage feature?

Why can't I see networked drives in OSForensics?

How to examine Mac and Linux hard drives with OSForensics?

How to acquire an image of a Chromebook hard disk?

How to Create an image of a network location?

How to determine if my disk is MBR or GPT?

Why can't I access mounted drives in Windows?

How to determine if there are hidden partitions on a drive?

How to determine if there are unallocated sectors on a drive?

How to determine if there are extended partitions on a drive?

Booting a forensics image on a Virtual Machine?

Why do I get the error, Error loading OSFMount Driver?

How to Obtain Data from Android Device?

How can I recover an unallocated sector?

How to view files with NTFS streams

How to copy a locked file in Windows?

How to view the size of a directory?

How to view files fragmentation?

How do I view hidden NTFS files?

How to scan NTFS $I30 (directory) entries for evidence of deleted files?

How to view the contents of ISO files?

Using OSForensics with RegRipper?

Using OSForensics with Volatility?

Using OSForensics with PassMark Volatility Workbench?

Using OSForensics with PhotoDNA?

If I index a hard disk does it include the deleted files?

How to list all files and emails on a disk?

Which e-mail formats are compatible with OSForensics?

How to search and sort images by color?

How to Create Custom Search Presets in the File Name Search Module?

How to perform File Decryption & Password Recovery?

How Recover Windows Login Passwords?

How to decrypt a BitLocker Drive?

Scanning Standalone Registry Files for User Activity?

How to Identify Uninstalled Software?

How to run in Debug Mode?

Generating the OSForensics Case Report

How to check an MD5 hash checksum of a file (or SHA1)

How to create a hashset in OSForensics?

How to Import NSRL hash sets from NIST?

What is Project VIC and does OSForensics support Project VIC Hashes?

How to install and effectively utilize the Project Vic hashset to locate Child Abuse Material (CAM)

How to check the MD5 (or SHA1) hash checksum of an entire volume, disk or image?

Remote Acquisition Troubleshooting