Blank EnCase (V6.16.1) project file
|Stable release||7.08 / July 24, 2013|
EnCase is a suite of digital forensics products by Guidance Software. The software comes in several forms designed for forensic, cyber security and e-discovery use. The company also offers EnCase training and certification.
EnCase Product Line
EnCase technology is available within a number of products, currently including: EnCase Forensic, EnCase Cybersecurity, EnCase eDiscovery, and EnCase Portable. Guidance Software also runs training courses and certification, over 50,000 individuals have completed the training to date.
EnCase contains tools for several areas of the digital forensic process; acquisition, analysis and reporting. The software also includes a scripting facility called EnScript with various API's for interacting with evidence.
EnCase Evidence File Format
EnCase contains functionality to create forensic images of suspect media. Images are stored in proprietary EnCase Evidence File Format; the compressible file format is prefixed with case data information and consists of a bit-by-bit (i.e. exact) copy of the media inter-spaced with CRC hashes for every 64K of data. The file format also appends an MD5 hash of the entire drive as a footer.
As of EnCase V7, Mobile Phone Analysis is possible with the addition some add-ons available from Guidance Software.
In 2001, Jessica M. Bair, a former U.S. Army Criminal Investigation Command Special Agent and computer forensics examiner, created the EnCase Certified Examiner (EnCE) program with John Colbert, to certify professionals in the use of Guidance Software's EnCase computer forensics software. In 2006, Bair was the technical editor for the Sybex published Official EnCE Study Guide. The EnCase® Certified eDiscovery Practitioner (EnCEP®) program likewise enables e-discovery practitioners to demonstrate their skills, training, and experience in the proper handling of electronically stored information for legal purposes.
- "Teacher may not have seen images". Cambridge News. Retrieved 2009-01-11.
- Taub, Eric A. (2006-04-05). "Deleting may be easy, but your hard drive still tells all". New York Times. Retrieved 2009-01-11.
- Stevenson, C. "Rush to Judgement", CreateSpace, June 22, 2011, pages 628-636.
- Dillon, Jeff, and Steve Perez. "Prosecutor hammers away at computer forensic expert; Dad's patron describes Brenda's propositions," San Diego Union-Tribune, July 3, 2002.
- url=http://www.guidancesoftware.com/"| 11 October 2012
- url="http://itbriefing.net/modules.php?op=modload&name=News&file=article&sid=328379" | 11 October 2012
- Martin S. Olivier, Sujeet Shenoi, ed. (2006). Advances in digital forensics II. Springer. ISBN 0-387-36890-6. Retrieved 31 August 2010.
- GuidanceSoftware. "EnCase Forensic V7". GuidanceSoftware. Retrieved 13 April 2012.
- Steve, Bunting (2006). EnCase Computer Forensics: The Official EnCE: EnCase Certified Examiner Study Guide. Sybex. ISBN 0-7821-4435-7.
- url="http://www.guidancesoftware.com/computer-forensics-training-certifications.htm" | 11 October 2012
- Garber, Lee. "EnCase: A Case Study in Computer-Forensic Technology". IEEE Computer Society. Retrieved 10 November 2010.