EnCase

EnCase
EnCase Forensic Logo
Blank EnCase project file
Blank EnCase (V6.16.1) project file
Developer(s) Guidance Software
Stable release
8.06.1 / March 26, 2018 (2018-03-26)
Operating system Windows
Available in English
Type Computer forensics
Website www.guidancesoftware.com

EnCase is the shared technology within a suite of digital investigations products by Guidance Software. The software comes in several products designed for forensic, cyber security, security analytics, and e-discovery use. Encase is traditionally used in forensics to recover evidence from seized hard drives. Encase allows the investigator to conduct in depth analysis of user files to collect evidence such as documents, pictures, internet history and Windows Registry information.

The company also offers EnCase training and certification.

Data recovered by EnCase has been used in various court systems, such as in the cases of the BTK Killer and the murder of Danielle van Dam.[1][2]

EnCase Product Line

EnCase technology is available within a number of products, currently including: EnCase Forensic, EnCase Cybersecurity, EnCase eDiscovery, EnCase Endpoint Investigator and EnCase Portable.[3] Guidance Software also runs training courses and certification, over 100000 individuals have completed the training to date.[4]

Features

EnCase contains tools for several areas of the digital forensic process; acquisition, analysis and reporting. The software also includes a scripting facility called EnScript with various API's for interacting with evidence.

Expert Witness File Format

EnCase contains functionality to create forensic images of suspect media. Images are stored in proprietary Expert Witness File format; the compressible file format is prefixed with case data information and consists of a bit-by-bit (i.e. exact) copy of the media inter-spaced with CRC hashes for every 64K of data. The file format also appends an MD5 hash of the entire drive as a footer.[5]

Mobile forensics

As of EnCase V7, Mobile Phone Analysis is possible with the addition some add-ons available from Guidance Software.[6]

References

  1. ↑ Taub, Eric A. (2006-04-05). "Deleting may be easy, but your hard drive still tells all". New York Times. Retrieved 2009-01-11.
  2. ↑ Dillon, Jeff, and Steve Perez. "Prosecutor hammers away at computer forensic expert; Dad's patron describes Brenda's propositions," San Diego Union-Tribune, July 3, 2002.
  3. ↑ url=http://www.guidancesoftware.com/"| 11 October 2012
  4. ↑ url="http://itbriefing.net/modules.php?op=modload&name=News&file=article&sid=328379" | 11 October 2012
  5. ↑ Martin S. Olivier, Sujeet Shenoi, ed. (2006). Advances in digital forensics II. Springer. ISBN 0-387-36890-6. Retrieved 31 August 2010.
  6. ↑ GuidanceSoftware. "EnCase Forensic V7". GuidanceSoftware. Retrieved 13 April 2012.

Further reading

  • Garber, Lee. "EnCase: A Case Study in Computer-Forensic Technology" (PDF). IEEE Computer Society. Retrieved 10 November 2010.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.