» PassMark OSForensics / OSFMount / ImageUSB

OSForensics - мощный пакет утилит для компьютерной экспертизы. Чаще всего программные продукты для проведения компьютерной экспертизы (Computer Forensics) используются правоохранительными органами, спецслужбами и сотрудниками госструктур для сбора улик и выявления признаков незаконной активности на отдельно взятом ПК. Кроме того, большинство подобных пакетов могут использоваться и для решения менее сложных, но достаточно важных задач, таких как поиск потерянных файлов, восстановление утраченных паролей, обнаружение вредоносных программ и др
Возможности программы:
• Поиск в несколько раз быстрее, чем стандартный поиск Windows.
• Индексирование, которое позволяет еще сильнее ускорить поиск.
• Поиск в почте, с поддержкой всех популярных mail-клиентов.
• Восстановление удаленных файлов.
• Просмотр недавно использованных документов.
• Просмотр активности использования компьютера.
• Сбор информации о системе, включая аппаратную и программную части.
• Просмотр и сохранение копии содержимого оперативной памяти.
• Извлечение сохраненных логинов и паролей из ваших браузеров.

---

OSFMount - небольшая бесплатная утилита, которая позволяет монтировать ранее сделанные образы дисков и представлять их в виде виртуальных приводов. Также следует отметить возможность создания RAM-дисков, которые находятся исключительно в оперативной памяти компьютера, что позволяет существенно повысить скорость работы с ними. При монтировании диска пользователь может самостоятельно задавать тип устройства (HDD, CD/DVD, флоппи-дисковод), устанавливать атрибут "только чтение", а также выбирать букву для обозначения диска. Поддерживаются форматы ISO, BIN, IMG, DD, 00n, NRG, SDI, AFF, AFM, AFD и VMDK.

---

ImageUSB - бесплатная портативная утилита, с помощью которой можно быстро создавать образ USB Flash Drive в формате BIN. Готовый образ содержимого флешки сохраняется на жестком диске, после чего его можно "развернуть" на новом USB-носителе. Имеется проверка правильности записанных данных. ImageUSB предоставляет возможность копировать любые USB Flash Drive, в том числе и загрузочные.

---

darko123
Здесь русскоязычный форум.
И сначала можно сюда Где спросить?

vty
Он, похоже, югослав, и русского не знает.

Руски не знам али га доста разумијем , јер су словенски језици, 10 година сам на овом форуму, не без разлога. Поздрав свим људима добре воље. Христос Воскресе.

OSFMount v1.5.1013
7-03-2013


Цитата:

Columns and main window are now resizable
Added "DEBUGMODE" command line parameter to OSFMount (GUI) for debug logging
Added "File system (detected)" column in the mounted drive list (for file systems unsupported by OS)
APM partition scheme is now supported, along with more robust partition detection

http://www.osforensics.com/downloads/osfmount.exe

http://www.osforensics.com/downloads/osfmount_x64.exe

osforensics 2.0.100016? Лажни?

OSForensics Professional 2.2 Build 1000 Final - 10th of September 2013
[more]•Added support for creating a self booting USB solution from the "Install to USB" section, this is a new tool called "WinPE builder" that can be launched after the "Install to USB" process.[/more]

OSFMount v1.5.1014
22-10-2013


Цитата:

Fixed issue with detecting partitions for ImageUSB images
Windows dynamic disks are now supported
Fixed issue with mounting via OSFMount command line with "-o rw" option
Fixed issue with mounting multiple partitions in an image file as writable due to file sharing permissions
Fixed issue with mounting multiple partitions in an image file from command line
Drive letters 'A' and 'B' can now be used
Propagated changes from Imdisk v1.7.5 including some key fixes:
Disks with "lost" drive letters can now be removed
Notifications hanging on drive creation and removal

http://www.osforensics.com/downloads/osfmount.exe

http://www.osforensics.com/downloads/osfmount_x64.exe

OSForensics 2.3 Beta Release
link

OSForensics 2.3.2 Beta Release
link

OSFMount v1.5.1015
07-02-2014


Цитата:

- Added VHD image file support. VHD is the Virtual Hard Disk file format for disk images, as used by Micrsoft's Virtual PC. This includes support for Dynamic-size (or sparse) hard disk images. Differential images are not supported. Support was added via libvhdi.
- Updated EWF library to libewf-20131230
- Confirmed Win8.1 support

http://www.osforensics.com/downloads/osfmount.exe

http://www.osforensics.com/downloads/osfmount_x64.exe

OSForensics 3.0.2 Beta
link

DEL.

v3.0.1001 - 19 of Aug 2014
[more=What's new]•Case Management
◦Images/drives without valid partition/file system info (ie. boot sector) can now be added to the case. This allows the drive to be viewable using the Raw Disk Viewer.
•File Indexing
◦Added support for indexing extracted binary text from "hiberfil.sys" and "pagefile.sys" (not limited by max file size limit)
◦Fixed stemming problems during indexing
◦Fixed bug with updating indexing status causing small indexing jobs to report no files being indexed
◦Fixed bugs with identifying misnamed ZIP files during indexing
◦Updated Engine/CGIs to V7 build 1008
◦Image search results that are nested in archives are now displayed in the 'Images' tab
◦Image search results that are nested in archives are now displayed with an 'archive' overlay on the top left corner of the icon
◦Fixed bugs with accented characters in search result URLs
◦Fixed bug with opening search results in the Internal Viewer
•Deleted Files Search
◦Fixed bug in file carving of .mov files (was including 4 additional bytes in the end, now removed)
◦Fixed file carving of .pdf files. Will now check buffer for four known combination for end markers. If not found, will default to look for %EOF.
◦Fixed scanning of deleted files on mounted drives without partition information
•Raw Disk Viewer
◦Fixed divide by error bug when performing a raw disk search on a disk with sector size = 0
◦Fixed partition info in the Decode window not being updated correctly when a new disk is loaded
•Web Browser
◦Module Will now load on first use instead of loading on startup. Starting Page is now set to about:blank (was set http://www.osforensics.com ). This minmises the impact on a live target system when running OSF from a USB drive.
•Internal Viewer
◦Fixed image stored in the alternate stream of a file not being displayed
•Misc
◦Fixed bug with FAT file system parsing caused by truncating errors when calculating cluster offset. This could prevent some FAT partitions from being mounted when the FAT partition's starting offset was a long way from the start of the disk.
◦Added debug statements to FAT file system parsing (when DEBUGMODE mode is enabled)
◦Added debug statements when there are NTFS file system parsing errors in applying fixup values to MFT and index records (when DEBUGMODE mode is enabled)
◦Updated WinPEBuilder.exe to include more debug messages.[/more]

PassMark OSForensics 3.3.1001 - 8th of February 2016

Цитата:

Deleted Files Search
File Carving, naming of recovered carved files has been changed to "Carved (type) file (Sector Location in HEX).extention" e.g. Carved 'jpg' file 0x00001F2B.jpg
File name search
Fixed a bug that was preventing sort by foreground/background colour working correctly on results when OSForensics was using direct access (eg direct access of an image file)
Hash Sets
Fixed a crash when first trying to open the hash sets tab
Misc
Some help file updates

PassMark OSForensics

Цитата:

V3.3.1002 - 23rd of March 2016
Deleted Files - FileCarving
Fixed Crash. TIF file format has internal pointers to location within the file, when these pointer contains a corrupted/invalid value, it would possibly cause OSForensics to crash.
Added slider to configuration to allow selection of start and end percent/location of drive to carve.
Fixed possible crash when searching for HFS+ deleted files.
File Indexer
New Zoom build, fixed issues with not starting indexing on HFS image with "Invalid folder" errors.
Misc
Fixed retrieving file attributes on non-ntfs file systems
Fixed possible crash when access HFS+ filesystem
Added detection of file system for MBR partitions due to possible differences in reported partition type and actual file system