（數字調查工具）PassMark OSForensics Professional 2.2 Build 1000 Final

OSForensics是一種新型數字調查工具，它可以讓你提取取證資料或從電腦中發現隱藏的訊息。
它具有了一些獨特的功能，更快發現關聯的資料，甚至，如高效能很深的檔案搜尋和索引，電子信件和電子信件歸檔搜尋和能力分析最近的系統及活性記憶體。
 OSForensics可以構建和讓您檢視事件的時間表，這顯示你的背景和活動時間。您甚至可以恢復已被刪除使用者的資料和檔案。它帶有一個內建的檔案瀏覽器，可以讓你檢查一個檔案的內容，屬性和元資料，以及電子信件的觀眾，這是最流行的信件用戶端格式相容。

檔案內搜尋
如果基本的檔案搜尋功能是不夠的， OSForensics也可以在硬碟上建立一個索引檔案。這使得快如閃電的搜尋檔案裡面包含的文字。本站技術背後Wrensoft的讚譽變焦搜尋引擎。

搜尋電子信件
能夠搜尋到檔案內的另外一個特點是能夠搜尋電子信件歸檔。索引過程中可以開啟和讀取最流行的電子信件檔案格式（ PST ）和識別個人訊息。
這容許一個快速系統上發現的任何電子信件的文字內容搜尋

恢復已刪除的檔案
已被刪除的檔案後，甚至一度從回收站中刪除，它往往仍然存在，直到另一個新的檔案取代它的位置在硬碟機。 OSForensics可以追查這個的ghost檔案資料，並試圖將它復原到硬碟機上的可用狀態。

揭開近期活動
找出哪些使用者。OSForensics可以發現最近在系統上執行的使用者操作，內含但不限於：
開啟的文件
網頁瀏覽歷史記錄
連線的USB裝置
連線的網路

收集系統訊息
尋找電腦裡面出了什麼。詳細訊息硬體系統上運行：
CPU的類型和數量
記憶體的數量和類型
安裝的硬碟機
連線的USB裝置
等等。

檢視活動記憶體
什麼是目前在系統主記憶體，也可以直接看。嘗試發現密碼和其他敏感訊息，否則將無法訪問。
從活動程式的清單中選取系統檢查。 OSF磁碟上的檔案，也可以拋售他們的記憶，以備後查。

OSForensics is a new digital investigation tool which lets you extract forensic data or uncover hidden information from computers. OSForensics has a number of unique features which make the discovery of relevant forensic data even faster, such as high-performance deep file searching and indexing, e-mail and e-mail archive searching and the ability to analyze recent system activity and active memory. OSForensics can build and let you view an events timeline which shows you the context and time of activities. You can even recover data and files that have been deleted by users. OSForensics comes with a built-in file viewer which lets you examine a file contents, properties and meta-data, as well as an e-mail viewer which is compatible with most popular mail client formats.

Search within Files
If the basic file search functionality is not enough, OSForensics can also create an index of the files on a hard disk. This allows for lightning fast searches for text contained inside the documents. Powered by the technology behind Wrensoft's acclaimed Zoom Search Engine.

Search for Emails
An additional feature of being able to search within files is the ability to search email archives. The indexing process can open and read most popular email file formats (including pst) and identify the individual messages.
This allows for a fast text content search of any emails found on a system

Recover Deleted Files
After a file has been deleted, even once removed from the recycling bin, it often still exists until another new file takes its place on the hard drive. OSForensics can track down this ghost file data and attempt to restore it back to useable state on the hard drive.

Uncover Recent Activity
Find out what users have been up to. OSForensics can uncover the user actions performed recently on the system, including but not limited to:
Opened Documents
Web Browsing History
Connected USB Devices
Connected Network Shares

Collect System Information
Find out what's inside the computer. Detailed information about the hardware a system is running on:
CPU type and number of CPUs
Amount and type of RAM
Installed Hard Drives
Connected USB devices
and much more.

View Active Memory
Look directly at what is currently in the systems main memory. Attempt to uncover passwords and other sensitive information that would otherwise be inaccessible.
Select from a list of active processes on the system to inspect. OSF can also dump their memory to a file on disk for later inspection.

Extract Logins and Passwords
Recover usernames and passwords from recently accessed websites in common web browsers, including Internet Explorer, Firefox, Chrome and Opera.