Why is it useful?

Booting from a USB drive can be preferable to booting from the HDD in the machine as you can boot into a known clean environment avoiding the execution of malware and rootkits. It can also be useful if the operating system has become corrupted and will no longer boot, or if you need to image the hard drive of the machine without altering the data on the main drive.

Why can't I purchase a pre-built bootable flash drive directly from PassMark?

Passmark used to sell pre-built OSForensics Bootable USB Flash Drives as an OSF product, though this required the licensing of Microsoft Windows Pre-install Environment (WinPE) with every flash drive. In 2012, Microsoft removed the licensing for WinPE and as such we have been unable to continue to distribute the pre-built product. As such, we further developed OSForensics to include a WinPE builder – a simplified guide for setting up the Windows Pre-install environment.

How do I build the OSForensics Bootable Flash Drive?

We have developed a step by step guide to building your own OSF bootable flash drive. If you encounter any issues with this process, check out related forum posts on the issue or send us an email as we are more than happy to troubelshoot for you.

How long does it take to boot?

It typically takes 1-2 minutes to boot from the USB drive.

Does it contain the full functionality of OSForensics?

Yes, the bootable edition contains all of the features available to the Subscription & Perpetual editions of OSForensics, as seen on the Comparison chart

Do I need to boot from the USB drive to use OSForensics?

No, OSForensics can be run directly from the USB drive after plugging it in on a computer with a compatible version of Windows. The OSForensics installer is also available on the USB drive and can be run to install a local copy of OSForensics onto the system.

Updates

Updates for the OSForensics Bootable USB Flash Drive are available here. They are distrubted as a complete image file that is copied to the USB drive, instructions are included in the download.