Product Overview

Having a reliable mobile forensic solution is critical for digital investigators. This document is an overview of EnCase Mobile Investigator, which includes support for over 26,000 mobile device profiles and provides investigators with an intuitive review of evidence from mobile devices. This document also describes features that have been implemented into the product to make your job as an investigator easier.

THE MOST COMPLETE MOBILE FORENSICS SOLUTION

The most comprehensive mobile forensics solution on the market has arrived from the leader in digital forensics. EnCase Mobile Investigator augments the mobile acquisition capabilities of EnCase Forensic with the ability to intuitively view, analyze, and report on critical mobile evidence that is relevant to their case. With mobile-first workflows, in-depth evidence analysis, and flexible report generation, investigators can feel confident in their results.

According to PEW Research, 92% of people in the United States own a cell phone and 68% own a smartphone. A mobile device can be the most accurate witness in almost every case. EnCase Mobile Investigator by Guidance Software addresses common challenges related to mobile forensics ensuring access to the critical data you need to close the case.

The Broadest Support of Mobile Devices & Operating Systems

Investigators can now rely on the gold standard in digital forensics to collecting and analyze evidence from the widest variety of mobile devices. With continuous updates to mobile operating systems, the most popular apps, and the broadest mobile device support, augmented by powerful investigation features, EnCase Mobile Investigator stands out from the pack — empowering examiners to find, analyze, and report on the evidence they need to close their case.

Uncover All Evidence

When a mobile acquisition is completed with EnCase Forensic, use EnCase Mobile Investigator to:

Easily view acquired mobile evidence in detail
Add evidence to new or existing case
Investigate SQLite Database Data and PLists
Perform in-depth content analysis and find regular expression data
Find, extract, and analyze data within graphic files with OCR
Quickly generate customized reports

Unrivaled Access

Many devices that investigators faced with are either locked or contain a password. EnCase Mobile Investigator empowers the investigator by offering several built-in bypass functions for select phones so that no evidence within a device can be hidden and unable to access.

Intuitive Evidence Review

With EnCase Mobile Investigator, examiners can easily review parsed mobile device evidence from the widest variety of mobile devices including text messages, e-mails, call records, cloud repositories associated with mobile device, internet history, photos, application data, and deleted data

Unmatched Support

Investigators need a reliable forensic solution that they can use when it comes to any investigation involving a mobile device. With frequent operating system and application updates in EnCase Mobile Investigator, examiners can keep up with the constant evolution of mobile devices and mobile applications that they come across

Unrivaled Access

Many devices that investigators are faced with are either locked or contain a password. EnCase Mobile Investigator empowers the investigator by offering several built-in bypass functions for select phones so that no evidence within a device can be hidden and unable to access.

Comprehensive Data Support

With EnCase Mobile Investigator, comprehensive set of data sources including SQLite, Plists, archives, PDF, HTML and more can be investigated using the file viewer feature. This allows investigators to gather the widest variety of evidence needed for their case, including all data associated with a wide variety of apps.

Powerful OCR

EnCase Mobile Investigator empowers instigators to find, extract, and analyze data within graphic files using Optical Character Recognition. Evidence from graphic files such as PDFs, photos, and other file types will be found when running keyword searches, ensuring you can uncover critical evidence no matter how it is stored

Powerful Cloud Application Visibility

Gathering data from social networking applications and cloud data sources tied to mobile device may be critical for an investigation to prove a suspect’s guilt or innocence. With the appropriate permissions, investigators can use EnCase Mobile Investigator to gather and review evidence from a suspects cloud-based account such as Google Drive, Twitter, Facebook, and others. This powerful feature enhances and extends the capabilities and reach that investigators possess

Robust Search

As investigators find evidence, there is a continuing trail for them to search for more. With the Regular Expression Review feature included with EnCase Mobile Investigator, investigators can locate credit cards, e-mail addresses, and phone numbers to find that extra piece of evidence to help finalize their collection

Simplified Report Generation

Once all relevant evidence is accounted for, investigators can create an intuitive report. There are several customizable reporting options offered with EnCase Mobile Investigator including HTML, Timeline, PDF, and many other report variations. These reports are created to be shared in a compelling and easy to read way for every case