Encase Process (From Handbook of Computer Crime Investigation: Forensic Tools and Technology, P 53-71, 2002, Eoghan Casey, ed, -- See NCJ-195111)

• NCJ Number: 195113
• Author(s): John Patzakis
• Date Published: 2002
• Length: 19 pages
• Sale Source: Academic Press, Inc
• Publication Format: Book (Softbound)
• Publication Type: Report (Technical)
• Language: English
• Country: United States of America

Annotation

This chapter discusses the use of EnCase software by Guidance Software as a tool for gathering electronic forensic evidence.

Abstract

This chapter provides an overview of the entire EnCase process and examines its role in the field of forensic evidence collection and in the courtroom. The author of this chapter notes that EnCase by Guidance Software has become the leading forensic tool used by investigators of computer crimes. EnCase operates in a Windows environment and the author points out that the early pioneers of computer forensics operated in a DOS setting, believing that computer examinations should never take place in a Windows environment for fear that data would be routinely altered and written to the hard drive. However, these issues do not plague EnCase because this system directly mounts the bit-stream forensic images as read-only virtual drives. As such, EnCase has become a valuable tool in the collection of forensic evidence. This chapter discusses EnCase’s Evidence File, as well as its capabilities for analysis, restoring drives, and archiving drives. Figures, references