Current Version
Update 31/Aug/2012: It's done, V1.2 is no longer in beta. You can get the final release from the download page.
Download Page
http://www.osforensics.com/download.html
What's New
The following is a summary of what has changed in V1.2 compared to V1.1.
Major changes
- Support for Apple Mac file systems. Including HFS+ as used in Mac, iPhone, iPod and iPad. So it is now possible to view & investigate files from a Mac or iPhone on your windows machine with OSForensics. Includes changes to,
- Indexer
- File viewer
- Raw disk viewer
- Device manager
- Support for Linux file systems. Including EXT2, EXT3, EXT4. Includes changes most modules in OSF.
- SQLite database viewer is now included in the OSF package. This is useful for looking into database files created by several applications on the iPhone and also by Firefox.
- Added support for APM partition scheme (Apple Partition Map)
- Updated RecentActivity Module to display Browser information for when querying Unbutu machines images.
- Added firefox form history retriveal to the recent activity
- Made CSV import into hash sets a significantly more robust and added better documentation.
- Changed regular expression searching in search index to use a slower algorithm, but it is more able to execute complex regexes.
- Deleted file search now supports hash set lookup and displays icons for status.
- Internal file viewer supports right-click functionality for deleted files (Open/Hash lookup/Add to case)
Minor changes
- Changed progress bar in Create Index to complete with 100% instead of 0%
- Fixed Registry Viewer to use custom file selection dialog. Making it easier to view registry files with directly accessing an image file.
- Help file updates
- Fixed vmdk crash bug
- Added a maximum limit for # of items in cache to prevent allocation of an abnormally large amount of RAM at startup by Thumbnail view.
- Fixed handle/memory leaks causing potential crash in Thumbnail view.
- Fixed crash when closing OSF when search is running in raw disk viewer
- Changed double click of thumbnail in Image tab of "Search Index" to open in internal viewer
- Extended vshadow executable timeout to 2 minutes for slow machines
- Fixed a crash when a case with no indexes was selected and the "Browse Index" tab was clicked on.
- Fixed a possible crash when using the scroll wheel in the recent activity window
- Added cookie name and content to CSV export of cookies
- Added cookie content to information displayed in the recent activiy window and included in the TXT and HTML exports
- Fixed bug opening fileset from hash lookup dialog after first sorting
- Can now sort by whether or not the file is in the hash set in deleted file search
- The 'Include Special Characters' checkbox in the hex viewer settings is now functional
- Changed 2GB max file size limit for indexing to 4GB
- Fixed possible crash when adding file to case in free version in deleted files module
- Fix possible crash problem when indexing PST files.
- Fixed icons in "File List" tab for OSF devices