EnCase® Forensic

Product Overview

Having a reliable forensic solution is critical for digital investigators. This document is an overview of the latest version of EnCase Forensic 20.2 which includes the ability to collect from Macs equipped with Apple T2 security as well as to connect to the Cloud and use credentials to forensically collect data from cloud repositories such as Microsoft O365, SharePoint, OneDrive and Google Drive.

THE GOLD STANDARD IN DIGITAL INVESTIGATION

Our Heritage: Best in Class. Proven in Courts.
Guidance created the category for digital investigation software with EnCase Forensic in 1998. EnCase has maintained its reputation as the gold standard in criminal investigations and was named the Best Computer Forensic Solution for eight consecutive years by SC Magazine. No other solution offers the same level of functionality, flexibility, and has the track record of court-acceptance as EnCase Forensic. With EnCase offering mobile forensics, investigators have the flexibility and convenience they need to complete their investigations quickly and efficiently.

One Product. One Mission: Get You to Case Closed.
Unlike other forensic solutions that only provide surface level visibility, EnCase Forensic offers the flexibility for any investigator to:

• Acquire data from the widest variety of devices, including over 25 types of mobile devices such as smartphones, tablets, and GPS
• Complete a comprehensive, forensically sound investigation
• Produce extensive reports on findings while maintaining the evidence integrity

TRIAGE

In the Field and in the Lab

EnCase Forensic enables you to quickly search, identify, and prioritize potential evidence, in computers and mobile devices, to determine whether further investigation is warranted. This will result in a decreased backlog so that investigators can focus on getting to case closed.

COLLECT

Secure Your Evidence. Protect Your Case.

EnCase Forensic helps you acquire more evidence than any product on the market. You can collect from a wide variety of operating and file systems, including over 25 types of mobile devices with EnCase Forensic. Parse the most popular mobile apps across iOS, Android, and Blackberry devices so that no evidence is hidden. This is the flexibility needed to ensure you can complete your cases no matter where the potential evidence resides.

DECRYPT

Unlock Encrypted Evidence

EnCase Forensic is unmatched in its decryption capabilities, offering the broadest support of any forensic solution. Encryption support includes products such as Dell Data Protection, Symantec, McAfee, and many more. You can further expand the decryption power of EnCase Forensic with Tableau Password Recovery — a purpose-built, cost-effective hardware solution to identify and unlock password-protected files.

PROCESS

Automate the Routine, Focus on the Investigation

The EnCase Forensic evidence processor provides industry-leading processing capabilities that can automate the preparation of evidence, making it easier to complete the investigation. Powered by an indexing engine built for scale and performance, you can automate complex queries across your varied evidence sources in one step saving time and increasing your efficiency.

INVESTIGATE

Bring Your Expertise to the Forefront

The most important part of any investigation is your ability to analyze your evidence. EnCase Forensic is built with the investigator in mind, providing a wide range of capabilities that enables you to perform deep forensic analysis as well as fast triage analysis from the same solution. Built to help you do what you do best: find evidence and close cases.

REPORT

Tailor Your Reports for Your Audience

EnCase Forensic provides a flexible reporting framework that empowers you to tailor case reports to meet your specific needs. With comprehensive and triage reporting options built in, you can create reports for a wide range of audiences and easily share them across your organization.