EnCase Quietly Gathers PC Info

By Cameron Sturdevant  |  Posted 2002-12-23 Print this article Print

Guidance Software's EnCase 3.22 is a good program for investigators who need to go to court with evidence gathered from a PC.

Guidance Softwares EnCase 3.22 is a good program for investigators who need to go to court with evidence gathered from a PC. Regardless of password protection and even file deletion, EnCase can pick up data from a hard drive, storage device or Palm PDA.

The $2,495 product, which is available now, allowed me to copy a disk drive without disturbing the files while annotating the date and time of collection.

Although this is much more than most corporations IT departments need for routine investigations, financial institutions and other businesses with regulatory obligations should consider using the tool to document evidence of possible wrongdoing that involves a computer. This version is better able to understand hard disk sectors without relying on the PCs BIOS.

I can see many other uses for the product, including file recovery from PCs acquired from another company or from employees long since gone.

Using the network cable connection, it took only minutes to image and investigate a 9GB hard drive from a laptop I had in storage.

For more information, go to www.guidancesoftware.com.

Cameron Sturdevant Cameron Sturdevant is the executive editor of Enterprise Networking Planet. Prior to ENP, Cameron was technical analyst at PCWeek Labs, starting in 1997. Cameron finished up as the eWEEK Labs Technical Director in 2012. Before his extensive labs tenure Cameron paid his IT dues working in technical support and sales engineering at a software publishing firm . Cameron also spent two years with a database development firm, integrating applications with mainframe legacy programs. Cameron's areas of expertise include virtual and physical IT infrastructure, cloud computing, enterprise networking and mobility. In addition to reviews, Cameron has covered monolithic enterprise management systems throughout their lifecycles, providing the eWEEK reader with all-important history and context. Cameron takes special care in cultivating his IT manager contacts, to ensure that his analysis is grounded in real-world concern. Follow Cameron on Twitter at csturdevant, or reach him by email at cameron.sturdevant@quinstreet.com.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel