File Viewer

OSForensics™ includes a built-in stream viewer for analyzing the contents of files, deleted files, memory sections and raw sectors. The viewer consists of several modes that aids specifically with forensic data analysis.

Image viewer

The image viewer attempts to view the data stream as an image. The following image formats are supported: BMP (Bitmap), JPG (JPEG), GIF, PNG, Exif and TIFF.

Video viewer

The video viewer plays video content and allows for quick inspection by displaying 9 still frames. The following image formats are supported: MPG, MPEG, MP4, AVI, MOV, M4V, MKV, OGV, WMV, RMV, RMVB, FLV, DIVX, and more.

Hex/String viewer

The hex/string viewer displays the data stream as raw bytes in hexadecimal. It can extract all ASCII/Unicode text strings contained in the stream (with user configurable string extraction settings specifying minimum and maximum string length, repeating character limit and more). You can also search within the Hex View and String List.

Text viewer

The text viewer displays the data stream as text. You can search within the text view. Note that any file format can be viewed as text, including binary files and image files. This can allow you to find hidden text within a binary file format. Of course, it is also used to view natural text file formats, such as .txt, readme files, and source code.

File information

Show the file attributes of the data stream: Location, Size, Size on disk, recognized file type, creation/modified/accessed dates, and any other file attributes (archive, compressed, read-only, system, hidden, symbolic link).

Meta data

Displays the meta data specific to the recognized file format. For image files, this would include Camera make, Model, etc. For documents, this would contain Author, Subject, etc.