EnCase

From ForensicsWiki
Revision as of 03:12, 15 July 2012 by Joachim Metz (Talk | contribs)

Jump to: navigation, search
Encase
Developer: Guidance Software
OS: Windows
Status: Active
Version: 6.18
Genre: Forensic Investigation
Langauge: English

EnCase is a family of all-in-one computer forensics suites sold by Guidance Software. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called EnScripts, to automate tasks.

File Format

See Encase image file format

Hash Databases

Main article Encase hash files

Encase uses MD5 hashes and uses a proprietary file format to store them, either singly or in a "hash map". It can also import hashes from the NSRL, Hashkeeper, and plain MD5 files.

See Also

External Links

Retrieved from "http://forensicswiki.org/index.php?title=EnCase&oldid=1149"