OSForensics vs Tsurugi Linux

OSForensics is digital investigation software for extracting and examining forensic data from computers. It searches and indexes files, looks inside documents and email archives, and attempts to recover deleted files. Hashing can verify evidence or compare it with known files, while extension checks can flag files whose extensions are incorrect. The software can surface recent activity such as opened documents, web history, connected USB devices, and network shares. Password tools target commonly used web browsers and can use rainbow tables to retrieve passwords from hashes. Investigators can group evidence into case files, cryptographically hash data, and export reports readable as HTML or PDF, with narratives and external reports. It can maintain a secure audit trail and create or restore disk images for analysis. OSForensics can also run from a portable USB drive. Listed evidence sources include Windows, Mac, Linux, Android, and iOS/macOS file systems, plus disk images, memory dumps, email, browser data, registry hives, SQLite, and ESE databases. Windows 7, 8, 10, and 11 are listed, as are several Windows Server versions. A free license and a 30-day trial are listed; subscription pricing is $95 per user per month.

Tsurugi Linux is a free Linux distribution for digital forensics, incident response, malware analysis, and OSINT. Its 64-bit [LAB] edition is based on Ubuntu 24.04.3 LTS with a custom kernel based on version 6.19.10, including kernel-level device write blocking. It also provides a Computer Vision analysis section and an OSINT profile switcher. The system can run live, although the project’s primary aim is an installed forensics lab. Tsurugi Acquire is a separate lightweight 32-bit live edition for booting a computer and acquiring mass-storage devices. The related Bento toolkit contains over 300 applications for live forensics and incident response on Windows, Linux, and macOS. The project recommends checking image hashes and verifying signatures with its PGP public key. [LAB] updates come from official Ubuntu repositories, but the FAQ warns that dist-upgrade can break the operating system. Tsurugi Linux [LAB] and Tsurugi Acquire are free under the GNU General Public License and supplied without warranty; some included tools are not open source. Evidence work can cover disks, volatile memory, mobile devices, file systems, OS artifacts, and cloud sources.