EnCase Forensic

EnCase Forensic v7.10: The Fastest, Most Comprehensive Forensic Solution Available

EnCase® Forensic is the global standard in digital investigation technology for forensic practitioners who need to conduct efficient, forensically-sound data collection and investigations using a repeatable and defensible process.

EnCase Forensic Process 

Our #1 objective: Empower examiners with the highest efficiency, power, and results. First to market and still best in class, the proven, powerful, and court-accepted EnCase® Forensic solution lets you:

  • Rapidly acquire data from the widest variety of devices
  • Unearth potential evidence with disk-level forensic analysis
  • Produce comprehensive reports on your findings
  • Maintain the integrity of your evidence in a format the courts have come to trust

Find, Analyze, and Report on More Potential Evidence than With Any Other Solution
Speed and power are just two of the benefits you reap when you choose the global standard, EnCase® Forensic. You will also:

  • Acquire and examine data swiftly from the widest array of computers, smartphones, and tablets of any digital forensics software solution
  • Increase confidence in your findings by using the proven, court-referenced digital forensics standard
  • Uncover more potential evidence faster using advanced search capabilities
  • Boost productivity by previewing results as data is being acquired. Once image files are created, you can search and analyze multiple drives or media simultaneously
  • Improve efficiency by automating common investigative tasks with EnScript®, the scripting solution build into EnCase Forensic
  • Preserve evidence integrity with court-accepted EnCase® evidence file formats (L01, Lx01, E01, and Ex01)
  • Join more than 60,000 digital investigations professionals who have been trained by the real-world law-enforcement, legal, and digital investigations experts at Guidance Software Training centers.

Most Powerful Feature Set on the Market

New with Version 7: EnCase Review Package, Faster Processor and More
The powerful and efficient features of EnCase Forensic have made it the trusted standard in corporate and criminal investigations, as well as in courts around the world. No other product offers the same degree of functionality, court acceptance, and performance.
Intuitive User Interface
A redesign of the user experience has resulted in an easy-to-use tabbed interface that may remind you of your favorite web browser.
Share Your Findings with Ease
The EnCase Forensic Review Package lets you share findings with other people involved with your case, including detectives, district attorneys, field agents, and fellow investigators.
Tablet and Smartphone Acquisition
Acquire data from most popular smartphones and tablets and easily integrate the results into cases.
Simple E-Mail Review
Understand the context of email-based potential evidence with threading and related conversations for context.
Powerful Automation
Now you can use custom EnScripts to automate common processes, which can greatly increase your efficiency. Template-driven processing results are consistent, providing easy-to-find, easy-to-use output.
New Evidence Processor
The new indexing engine gives our re-engineered evidence processor more powerful queries and faster processing, plus the ability to automate tasks, create templates based on case profiles, and readily integrate EnCase Forensic results.
Broadest File-Type and OS Support Anywhere
No other product delivers the broad file-type and operating-system (OS) support of EnCase Forensic. With Version 7, you also get EnCase® Decryption Suite, EnCase® Physical Disk Emulator, EnCase® Virtual File System, and EnCase® FastBloc SE.
Acquisition from Almost Anywhere
Acquire data from disk or RAM, documents, images, email, webmail, Internet artifacts, web history and cache, HTML page reconstruction, chat sessions, compressed files, backup files, encrypted files, RAID workstations, servers, and--with Version 7--smartphones and tablets.
Robust Search
Uncover critical evidence using advanced search capabilities to identiy data that would be irretrievable with other computer forensic applications.
Preview Results
Begin reviewing results while data is being acquired. Once image files are created, search and analyze multiple drives or media simultaneously.
Automated De-NISTing Capabilities
The National Software Reference Library (NSRL) is provided in the EnCase hash library format, letting you easily de-NIST your potential evidence, eliminating thousands of known files from your evidence set.

EnCase Forensic preserves data in an evidence file format (LEF or E01) with an unsurpassed record of court acceptance.

Customizable and Extensible with EnScript®
EnScript, an object-oriented programming language similar to Java or C++, lets you create custom programs to automate time-consuming investigative tasks, such as searching and analyzing specific document types or other labor-intensive processes.

Automatic, Customizable Reports
Easily create custom report templates that produce consistent, professional reports for every type of case, then export with lists of all files and folders along with a detailed list of URLs and dates and times of visits to each. EnCase Forensic Reports provide hard-drive information and details related to the acquisition, drive geometry, folder structure, and more.

Forensically Sound
EnCase Forensic produces an exact binary duplicate of the original drive or media, then verifies it by generating MD5 hash values for related image files and assigning CRC values to the data. These checks and balances reveal when evidence has been tampered with or altered, helping to keep all digital evidence forensically sound for use in court proceedings or internal investigations.

Integration to Passware Kit Forensic
Use the Evidence Processor to automate the detection of encrypted files. Once the files are decrypted by Passware Kit Forensic, they can be easily integrated back into EnCase Forensic for further analysis. (Passware Kit Forensic license sold separately.)

Tableau Forensic Products and Integrated Modules

Expand the Reach of Your Investigation with Tableau Forensic Products and Integrated Modules

Guidance Software offers a broad range of forensic solutions for the investigation, collection, and archiving of data, fully integrated to extend the functionality and reach of EnCase Forensic v7.

EnCase® Smartphone Examiner
Designed for law enforcement, security analysts, and e-discovery specialists who need to review and collect data in a forensically sound manner from smartphones and tablet devices. Works seamlessly with all EnCase® products.

EnCase® Virtual File System (VFS) Module
Easily mount and review evidence as read-only from outside the EnCase Forensic environment.

EnCase® Physical Disk Emulator (PDE) Module
Mount an image of a replicated hard drive or CD in read-only mode, allowing the use of third-party tools for additional analysis.

EnCase® Decryption Suite
Decrypt disks, volumes, files, and folders, including Microsoft BitLocker, Credant Mobile Guardian, Microsoft Outlook PST files, and many more.

FastBloc® Software Edition (SE)
Safely acquire every sector of a target hard drive--even those normally outside the operating system--and wipe or restore drives, as well.


Guidance Software Training

Guidance Software Training courses and programs help organizations maximize their use of EnCase Forensic software. We offer world-class training in enterprise investigations, e-discovery, computer security incident response, and digital forensics, and have trained over 50,000 digital investigators worldwide.

Some of our most popular courses include:
EnCase ® v7 Transition
Designed for EnCase Forensic users who are upgrading from a previous version to Version 7, the EnCase v7 Transition course details the new features of Version 7, highlighting specifically the areas of the product that differ significantly from previous versions. To register for this course, a user must have completed Computer Forensics II or hold an EnCE ®certification.

EnCase Computer Forensics I
Practical exercises and real-life simulations provide participants with an understanding of proper handling of digital eveidence from seizure to acquisition, to the analysis and archiving of the data.

EnCase Computer Forensics II
Designed for investigators with strong computer skills, prior forensic training, and experience using EnCase Forensic.

Supported Languages

The EnCase Forensic and EnCase Enterprise Version 7 user interface is available in the following 14 translations in order to enable investigators to be efficient regardless of their native tongue:

  • English
  • Arabic
  • German
  • Spanish
  • French
  • Italian
  • Japanese
  • Korean
  • Dutch
  • Polish
  • Portuguese (Brazil)
  • Russian
  • Chinese Traditional
  • Chinese Simplified

30-Minute Free Consultation

Due to our numerous partnerships, we can provide unbiased opinions on the best solution for your environment.

Unbeatable Prices

Our partnership levels give us the highest product discounts which we pass on as savings to our customers.

Professional Services

Finish your IT projects on-time and under budget with our nation-wide team of senior level engineers.

24x7 Tech Support

Rest assured knowing that our U.S. based IT support team is here for you on nights, weekends and when you need us most.