EnCase

From Wikipedia, the free encyclopedia

"Encase" redirects here. For the coil, see encased coil. For the meaning of encase, see wikt:encase.

EnCase

Blank EnCase (V6.16.1) project file
Developer(s)	Guidance Software
Stable release	7.09.02 / February 4, 2014 (2014-02-04)
Development status	Active
Operating system	Windows
Available in	English
Type	Computer forensics
Website	www.guidancesoftware.com

EnCase is a suite of digital forensics products by Guidance Software. The software comes in several forms designed for forensic, cyber security and e-discovery use. The company also offers EnCase training and certification.

Data recovered by EnCase has been used successfully in various court systems around the world, such as in the cases of the BTK Killer and David Westerfield.^[1]^[2]^[3]

EnCase Product Line

EnCase technology is available within a number of products, currently including: EnCase Forensic, EnCase Cybersecurity, EnCase eDiscovery, and EnCase Portable.^[4] Guidance Software also runs training courses and certification, over 50,000 individuals have completed the training to date.^[5]

Features

EnCase contains tools for several areas of the digital forensic process; acquisition, analysis and reporting. The software also includes a scripting facility called EnScript with various API's for interacting with evidence.

EnCase Evidence File Format

EnCase contains functionality to create forensic images of suspect media. Images are stored in proprietary EnCase Evidence File Format; the compressible file format is prefixed with case data information and consists of a bit-by-bit (i.e. exact) copy of the media inter-spaced with CRC hashes for every 64K of data. The file format also appends an MD5 hash of the entire drive as a footer.^[6]

Mobile forensics

As of EnCase V7, Mobile Phone Analysis is possible with the addition some add-ons available from Guidance Software.^[7]

References

↑ Taub, Eric A. (2006-04-05). "Deleting may be easy, but your hard drive still tells all". New York Times. Retrieved 2009-01-11.
↑ Stevenson, C. "Rush to Judgement", CreateSpace, June 22, 2011, pages 628-636.
↑ Dillon, Jeff, and Steve Perez. "Prosecutor hammers away at computer forensic expert; Dad's patron describes Brenda's propositions," San Diego Union-Tribune, July 3, 2002.
↑ url=http://www.guidancesoftware.com/"| 11 October 2012
↑ url="http://itbriefing.net/modules.php?op=modload&name=News&file=article&sid=328379" | 11 October 2012
↑ Martin S. Olivier, Sujeet Shenoi, ed. (2006). Advances in digital forensics II. Springer. ISBN 0-387-36890-6. Retrieved 31 August 2010.
↑ GuidanceSoftware. "EnCase Forensic V7". GuidanceSoftware. Retrieved 13 April 2012.

External links

Guidance Software web site

v t e Digital forensics

Branches	Computer forensics Mobile device forensics Network forensics Database forensics

Hardware	Forensic disk controller

Software	EnCase Foremost FTK Registry Recon PTK Forensics The Sleuth Kit The Coroner's Toolkit COFEE Selective file dumper HashKeeper Xplico

Certification	Certified Hacking Forensic Investigator (CHFI) Global Information Assurance Certification

Processes	Digital forensic process Data acquisition Digital evidence eDiscovery Anti-computer forensics

Organisations	National Software Reference Library American Society of Digital Forensics & eDiscovery Department of Defense Cyber Crime Center National Hi-Tech Crime Unit (NHTCU) Australian High Tech Crime Centre (AHTCC)

People	Eoghan Casey Clifford Stoll Erik Laykin

Glossary of digital forensics terms

This article is issued from Wikipedia. The text is available under the Creative Commons Attribution/Share Alike; additional terms may apply for the media files.