Encase Data Forensic Tools, Essay Example

Designed by Guidance Software, EnCase is a commonly used forensic product that aids investigators to analyse digital media for criminal and civil cases. The software has also been useful in legal proceedings for criminal forensic evidence collection.

Primarily, a special training is a prerequisite to operate the software and the certain minimum hardware requirements are required, including Windows 2000, XP or 2003 server; recommended, 3GHz AMD or Intel processor; 1GB of RAM; and 1 USB Port, and ample hard drive for storage and file acquisition (Martin, 2006).

According to Bunting (2006), court sessions around the world have successfully adopted and used EnCase. Effective use of the software has been due to its fully-featured commercial package that has enabled investigators to examine data by imaging from hard disks, removable media such as floopy disks and even palm PDAs (Personal Digital Assistants). Internationally, EnCase has been used by law enforcement groups as well as forensic investigators especially for investigations involving the police or courts. An EnCase investigation commences with creation of medium-like hard disk, floppy disk, or PDA. The Evidence file can be analysed using the analysis EnCase program, through examining deleted files, viewing pictorial files, and searching the data for keywords.

Although the software is a relatively expensive commercial tool, the informant community benefit from a discounted package. However, the prices will vary depending on the multiple functionality available from the package, an example of which includes the scripting language package. Forensic examiners prefer the scripting language as it allows for writing of small programs and scripts, which can perform highly customized searching and filtering of data which has been imaged (Patzakis, 2003).

Acquisition – contains functionality to create forensic images of suspect media. These images are stored in a proprietary Encase evidence file format which presented with is presented with case data information that represent the exact copies of the original.

Analysis – images stored in files can be examined using a viewer or an editor called hex.

Reporting – A report can be produced of bookmarked evidence, though an EnCase certified examiner requirements and process involves the following steps:

Step 1 – the minimal requirements and training experience necessitates one ought to dedicate have 64 hours of forensic training which is either 12 months forensic computer training or online classroom.

Step 2 and 3 – one is advised to fill in the study guide once an application is approved by the certification coordinator.

Two months is the least time to wait for failures and one will be required to be in touch with the coordinator based on the eligibility date. Failure of which will force the participant to commence from the initial Phase of the testing process.

In case the certification expires, one will be expected to register afresh for the EnCase process Phase I.

However, in spite of the wide use and success of the software especially with law enforcement and other authorities, anti-computer forensics have encroached and produced anti-forensics software. Such tools prevent EnCase from operating and accessing data. This move has consequently been met with improved versions of the software to counter the “hackng” skills of the anti-computer forensics.

Conclusion

Encase enterprise is ideally suited and authenticated data over a local or wide network. In many cases the use of encase enterprise is more than merely acceptable, but in fact constitutes best practices. Encase enterprise looks after the file integrity and cannot write to the target drive. Its greatest security infrastructure protects against unauthorized access and security logs. Instead, with the help of a secure server, it identifies the activities of all users throughout the examinations session. Encase is used in the process of maintaining and documenting data acquired in remote and live network environment.

References

Bunting, S. (2006). EnCase Computer Forensics: The official EnCase – EcCanse ertified Examiner Study Guide. Wiley Publishing: New York.

Garfinkel, S. (2006). “Forensic Feature Extraction and Cross-Drive Analysis,” Digital Investigation. Vol 3(1). Pp. 71-81.

Martin S. O. (2006). Advances in Digital Forensics II for Forensic Science. Florida, USA.

Patzakis, J et al. (2003). Evidential authentication within the EnCase. Retrieved May 22, 2011, from http://www.computertutorials.org/ebooks/computerforensics.pdf.