View source for EnCase

{{Short description|Software developed by Guidance Software}}
{{redirect|Encase|the coil|encased coil|the meaning of encase|wikt:encase}}
{{Infobox software
| name = EnCase
| logo = [[File:EnCase logo.jpg|200px|alt=EnCase Forensic Logo]]
| screenshot = [[File:Encase.png|200px|alt=Blank EnCase project file]]
| caption = Blank EnCase (V6.16.1) project file
| developer = [http://www.guidancesoftware.com Guidance Software], [http://www.opentext.com OpenTextk]
| released = 1998
| latest release version = 21.1 CE
| latest release date = {{Start date and age|2021|03|11}}<ref>{{cite web
|url          = https://blogs.opentext.com/announcing-opentext-security-protection-cloud-ce-21-1/
|title        = Announcing OpenText Security and Protection Cloud CE 21.1 - OpenText Blogs
|website      = blogs.opentext.com
|date         = 11 March 2021
|access-date  = 2021-04-04
|archive-date = 2021-03-11
|archive-url  = https://web.archive.org/web/20210311160058/https://blogs.opentext.com/announcing-opentext-security-protection-cloud-ce-21-1/
|url-status   = live
}}</ref>
| operating system = [[Microsoft Windows|Windows]]
| language = [[English language|English]]
| genre = [[Computer forensics]]
| website = {{URL|https://www.opentext.com/products/encase-forensic}}
}}
'''EnCase ''' is the shared technology within a suite of digital investigations products by [[Guidance Software]] (acquired by [[OpenText]] in 2017<ref>{{Cite web|date=2017-09-14|title=News and Press Releases (PR)|url=https://www.opentext.com/about/press-releases?id=58E6100FE1544BE18AB91512C1060E90|access-date=2021-10-31|website=OpenText|language=en|archive-date=2018-09-03|archive-url=https://web.archive.org/web/20180903013453/https://www.opentext.com/about/press-releases?id=58E6100FE1544BE18AB91512C1060E90|url-status=live}}</ref>). The software comes in several products designed for [[forensic]], [[cyber security]], [[security analytics]], and [[e-discovery]] use. EnCase is traditionally used in forensics to recover evidence from seized [[Hard disk drive|hard drives]]. It allows the investigator to conduct in-depth analysis of user files to collect evidence such as documents, pictures, internet history and [[Windows Registry]] information.
The company also offers EnCase training and certification.
Data recovered by EnCase has been used in various court systems, such as in the cases of the [[Dennis Rader#Arrest|BTK Killer]] and the [[murder of Danielle van Dam]].<ref name="UK Court Usage"/><ref>Dillon, Jeff, and Steve Perez. [http://legacy.utsandiego.com/news/metro/danielle/20020703-9999-noon.html "Prosecutor hammers away at computer forensic expert; Dad's patron describes Brenda's propositions,"] {{Webarchive|url=https://web.archive.org/web/20140714112541/http://legacy.utsandiego.com/news/metro/danielle/20020703-9999-noon.html |date=2014-07-14 }} San Diego Union-Tribune, July 3, 2002.</ref> Additional EnCase forensic work was documented in other cases such as the evidence provided for the [[Death of Caylee Anthony|Casey Anthony]], [[Unabomber]], and Mucko ([[Wakefield Massacre]]) cases.
== Company and Product Overview ==
Guidance Software, and the Encase forensic tool, was originally created by Shawn H. McCreight.<ref>{{Cite web |title=Pasadena-Based Guidance Software Founder Writes to Stockholders to Help Improve Company – Pasadena Now |url=https://www.pasadenanow.com/main/pasadena-based-guidance-software-founder-writes-to-stockholders-to-help-improve-company |access-date=2023-09-05 |website=www.pasadenanow.com |archive-date=2023-09-05 |archive-url=https://web.archive.org/web/20230905191709/https://www.pasadenanow.com/main/pasadena-based-guidance-software-founder-writes-to-stockholders-to-help-improve-company |url-status=live }}</ref>
In 2002 EnCase Enterprise was released allowing the first network enabled digital forensic tool to be used in forensic, investigative, and security matters.
In 2005 EnCase eDiscovery was released which further enabled the network abilities of EnCase to allow Identification, Collection, Preservation, and Analysis of ESI for Litigation and Investigative purposes.
In 2007 EnCase AIRS (Automated Incident Response Suite) was released (now discontinued and evolved to EnCase Endpoint Security) to automate the scanning, documenting, and remediation abilities of EnCase Enterprise. In 2007, EnCase Information Assurance, EnCase Data Audit and Policy Enforcement (both also effectively integrated into EnCase Endpoint Security) were also released.
In 2008 EnCase Cybersecurity was released which combined many of the tools and automation from previous security functions and streamlined the workflow of incident response.
In 2015 EnCase Endpoint Security was released which was the evolution of Endpoint Security into a more user-friendly web interface as well as further integration with many other security tools to further expedite and shorten the response time from an attack or event.
In 2016 EnCase Enterprise needed a face lift and the distributed agent (formerly referred to as servlet) was given more abilities with the redesign into EnCase Endpoint Investigator. Also in 2016 the release of EnCase Risk Manager for data risk assessment, audit, DLP-like services, and compliance.
In 2017 Guidance Software was acquired by OpenText, and the company name "Guidance Software" is no longer used.
==EnCase Product Line==
EnCase technology is available within a number of products, currently including: EnCase Forensic, EnCase Endpoint Investigator, EnCase eDiscovery (which includes EnCase Legal Hold), EnCase Endpoint Security and EnCase Portable.<ref>{{Cite web |title=Guidance Software |url=http://www.guidancesoftware.com/ |url-status=dead |archive-url=https://web.archive.org/web/19961226144504/http://www.guidancesoftware.com/ |archive-date=December 26, 1996 |access-date=October 11, 2012}}</ref> Guidance Software also runs training courses from Foundations in Computer Forensics, to several expert series courses to include an EnScripting course to automate various functions within EnCase. Further, certification is offered to train toward and prove knowledge within various fields to include EnCE (EnCase Certified Examiner), EnCEP (EnCase Certified eDiscovery Practitioner), CFSR (Certified Forensic Security Responder). The EnCase training team have trained over 100000 individuals to date.<ref>{{Cite web |title=Sprintzeal |url=https://www.sprintzeal.com/ |url-status=dead |archive-url=https://web.archive.org/web/20160704034829/https://www.sprintzeal.com/ |archive-date=July 4, 2016 |access-date=June 18, 2024}}</ref>
==Features==
EnCase contains tools for several areas of the [[digital forensic process]]; acquisition, analysis and reporting. The software also includes a scripting facility called EnScript with various [[Application programming interface|API's]] for interacting with evidence.
===Expert Witness File Format===
EnCase contains functionality to [[Digital forensic process#Acquisition|create forensic images]] of suspect media. Images are stored in proprietary ''Expert Witness File'' format; the compressible file format is prefixed with case data information and consists of a [[bit]]-by-bit (i.e. exact) copy of the media inter-spaced with CRC hashes for every 64 sectors of data (by default).<ref>{{Cite book |last=Bunting |first=Steve |title=EnCase computer forensics: the official EnCE: EnCase certified examiner; study guide |date=2012 |publisher=Wiley |isbn=978-1-118-05898-5 |edition=3rd |location=Indianapolis, Ind}}</ref> The file format also appends an [[MD5]] [[Hash function|hash]] of the entire drive as a footer.<ref name="advancesdf" /> The E01 file format was [[Reverse engineering|reversed engineered]] and specifications can be found [https://github.com/libyal/libewf/blob/main/documentation/Expert%20Witness%20Compression%20Format%20(EWF).asciidoc here].
===Mobile forensics===
As of EnCase V7, Mobile Phone Analysis is possible with the addition some add-ons available from Guidance Software.<ref>{{Cite web|last=GuidanceSoftware|title=EnCase Forensic V7|url=http://www.guidancesoftware.com/forensic.htm|work=GuidanceSoftware|access-date=13 April 2012|archive-date=12 February 2012|archive-url=https://web.archive.org/web/20120212035042/http://www.guidancesoftware.com/forensic.htm|url-status=dead}}</ref>
==References==
{{Reflist|40em|refs=
<ref name="advancesdf" >{{Cite book|title=Advances in digital forensics II|year=2006|publisher=Springer|isbn=0-387-36890-6|url=https://books.google.com/books?id=jr2PPjwXJQwC|editor=Martin S. Olivier, Sujeet Shenoi|access-date=31 August 2010}}</ref>
<ref name="UK Court Usage">{{Cite news
|url=https://www.nytimes.com/2006/04/05/technology/techspecial4/05forensic.html?_r=1&ref=techspecial4
|title=Deleting may be easy, but your hard drive still tells all
|work=[[The New York Times|New York Times]]
|access-date=2009-01-11
|first=Eric A.
|last=Taub
|date=2006-04-05
|archive-date=2024-06-19
|archive-url=https://web.archive.org/web/20240619044645/https://www.nytimes.com/2006/04/05/technology/techspecial4/deleting-may-be-easy-but-your-hard-drive-still.html
|url-status=live
}}</ref>}}
==Further reading==
* {{Cite web|last=Garber|first=Lee|title=EnCase: A Case Study in Computer-Forensic Technology|url=http://www.cosgrovecomputer.com/documents/computer_magazine_article.pdf|publisher=IEEE Computer Society|access-date=10 November 2010|archive-date=14 December 2010|archive-url=https://web.archive.org/web/20101214073705/http://www.cosgrovecomputer.com/documents/computer_magazine_article.pdf|url-status=dead}}
{{Digital forensics}}
[[Category:Law enforcement equipment]]
[[Category:Hard disk software]]
[[Category:Computer forensics]]
[[Category:Digital forensics software]]