OSForensics vs SUMURI PALADIN

OSForensics is digital investigation software for extracting and examining forensic data from computers. It searches and indexes files, looks inside documents and email archives, and attempts to recover deleted files. Hashing can verify evidence or compare it with known files, while extension checks can flag files whose extensions are incorrect. The software can surface recent activity such as opened documents, web history, connected USB devices, and network shares. Password tools target commonly used web browsers and can use rainbow tables to retrieve passwords from hashes. Investigators can group evidence into case files, cryptographically hash data, and export reports readable as HTML or PDF, with narratives and external reports. It can maintain a secure audit trail and create or restore disk images for analysis. OSForensics can also run from a portable USB drive. Listed evidence sources include Windows, Mac, Linux, Android, and iOS/macOS file systems, plus disk images, memory dumps, email, browser data, registry hives, SQLite, and ESE databases. Windows 7, 8, 10, and 11 are listed, as are several Windows Server versions. A free license and a 30-day trial are listed; subscription pricing is $95 per user per month.

SUMURI PALADIN is a donation-supported live Linux environment for forensic imaging, triage, and recovery. PALADIN 9 LTS uses Ubuntu 24.04 LTS and is modified to prevent changes to attached media and disable automatic mounting at boot. Its graphical Toolbox handles imaging, logical acquisitions, hashing, and device mounting, with read-only options and logging. Included software includes Autopsy, The Sleuth Kit, and other open-source forensic tools. Supported image formats include E01/Ex01, RAW (.dd), SMART, AFF, VHD, and VMDK. PALADIN LTS can mount and image through NFS or SMB networks and supports BitLocker-encrypted Windows partitions from Vista through Windows 10. It integrates Arsenal Image Mounter Remote Agent for advanced mounting and live or remote analysis. Persistent Mode preserves reports and configurations between prepared sessions, subject to extra free space. PALADIN runs as a Linux live environment on 64-bit and 32-bit PC hardware.