Difference between revisions of "EnCase"

From ForensicsWiki
Jump to: navigation, search
m (External Links: Pointed dead link to archive.org mirror.)
(One intermediate revision by one other user not shown)
Line 25: Line 25:
* [[LinEn]]
* [[LinEn]]
* WinEn
* WinEn
=== Tools ===
* [[E01 Viewer]]
== External Links ==
== External Links ==
* [http://www.guidancesoftware.com Guidance Software]
* [http://www.guidancesoftware.com Guidance Software]
* [http://www.safehack.com/Textware/forensic/Anti_Forensic_Break_Encase.pdf Breaking Encase with FILE0 and Winhex]
* [https://web.archive.org/web/20070310192503/http://www.safehack.com/Textware/forensic/Anti_Forensic_Break_Encase.pdf Breaking Encase with FILE0 and Winhex]

Latest revision as of 16:08, 22 June 2016

Maintainer: Guidance Software
OS: Windows
Genre: Analysis
License: Commercial
Website: www.guidancesoftware.com

EnCase is a family of all-in-one computer forensics suites sold by Guidance Software. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called EnScripts, to automate tasks.


Expert Witness (for Windows) was the original name for EnCase (dating back to 1998). More info about this can be found on the Internet Archive [1] including a demo of the original software [2].

File Format

See Encase image file format

Hash Databases

EnCase uses MD5 hashes and stores them in its proprietary Encase hash file format; either individually or in a "hash map". EnCase supports importing hashes from the NSRL, Hashkeeper, and plain MD5 files.

See Also

External Links