Guidance Softwares EnCase 3.22 is a good program for investigators who need to go to court with evidence gathered from a PC. Regardless of password protection and even file deletion, EnCase can pick up data from a hard drive, storage device or Palm PDA.
The $2,495 product, which is available now, allowed me to copy a disk drive without disturbing the files while annotating the date and time of collection.
Although this is much more than most corporations IT departments need for routine investigations, financial institutions and other businesses with regulatory obligations should consider using the tool to document evidence of possible wrongdoing that involves a computer. This version is better able to understand hard disk sectors without relying on the PCs BIOS.
I can see many other uses for the product, including file recovery from PCs acquired from another company or from employees long since gone.
Using the network cable connection, it took only minutes to image and investigate a 9GB hard drive from a laptop I had in storage.
For more information, go to www.guidancesoftware.com.