Boot a Forensics Image on a Virtual Machine with OSForensics

OSForensics lets you extract forensic evidence from computers quickly with high performance file searches and indexing. Identify suspicious files and activity with hash matching, drive signature comparisons, e-mails, memory and binary data. Manage your digital investigation and create reports from collected forensic data. Booting a disk image containing a functional operating system in a virtual environment provides the forensics investigator with a visual context of the system of interest, uncovering additional opportunities for evidence collection and analysis. In additional to being able to view the desktop environment of the system, files and executables that were inaccessible from static analysis can now be opened within the virtual environment.