FREE e-Newsletter
Important News - Hot Topics
Get them Now!

DrugTest 5000 - Draeger Safety Diagnostics Inc
In the past, roadside drug screening has been difficult because it involved the...

Exclusive Webinar!

Originally aired: June 17, 2014  ‚óŹ 2PM EST

View Webinar Archive Here

Integrated Law Enforcement Complements and Completes Law Enforcement Capabilities

Discover how the combination of intelligence analysis, lead generation, agency collaboration, and communications integration can help you uncover issues faster and take action sooner. Learn how innovative IBM law enforcement solutions can extend the capabilities within your organization to deal with new and emerging threats, improve officer safety, reduce criminal activity, and protect the public. 

Join IBM industry expert Stephen Dalzell and members from the MDPD, IT and homeland security departments of the Miami Dade police department to hear more!

Click here to view archive

 

Departments : Computers & Software

Guidance Software EnCase 4.19

The newest version of this computer forensics analysis tool seeks out hidden files with an easy-to-use interface.

August 01, 2004  |  by Bob Davis


Computer forensics is not a passing fad. It's a growing field that is becoming more important to successfully solving a wide range of criminal cases as crooks' tech savvy progresses. In fact, an FBI report from 2002 indicates that 50 percent of all investigations require a forensic examination of at least one computer to produce the necessary evidence. And the numbers aren't likely to decrease.

Since 1998 Pasadena, Calif.-based Guidance Software has been in the business of finding evidence where no man had gone before: the mass storage medium of computer systems. Whether you're searching hard, floppy, or even USB drives, Guidance's EnCase Forensic Edition investigative tools are designed to find and preserve what you're looking for: computer files that the perps didn't want you to see.

The company's newest version, EnCase 4.19, is Windows-based software that accelerates and streamlines the process of searching a computer drive. Its virtual file system allows investigators to share the information collected with non-EnCase users while a familiar graphical user interface (GUI) allows you to create a noninvasive investigation image of the storage media. With EnCase you can also easily organize case information and generate standard and custom investigative reports.

By using the company's FastBloc write-blocker utility tools a trained investigator may even drill down into the very sectors and cylinders of a hard drive without altering any of the "original" data or its attributes.

EnCase 4.19 also includes many enhanced or altogether new features.

One of these new features, the text "find" command, is built much like the find command found in many word processors. When users requested this feature, the company actually listened and incorporated it into the new version. Other enhancements include improvements to reporting modules, navigation techniques, and the overall speed in which an investigative audit is processed.

Increasing its flexibility, EnCase now accommodates additional platforms. Not only can you use it on Windows and Macintosh systems, but also with PalmOS, Unix, and Linux, among others.

Also, an increased number of file systems are now supported by EnCase, including all FAT systems, NTFS, CDFS, UDF, BSD, Mac OS X, and RAID drives on servers.

All this flexibility is essential when working cases involving more sophisticated computer setups. Some suspects use several different systems to make it more complicated to track their files. To further help in finding and collecting pertinent files, Guidance has added to EnCase enhanced support for Outlook's PST files, Base64 and UUE encoded attachments, file structures for .tar and .gz files, and support for PNG-formatted graphics.

One of the most important changes to EnCase is an enhancement in NTFS folder recovery tools, critical for recovering data when a drive has been formatted to conceal or destroy incriminating evidence. This is also useful when a master file table has been corrupted. With a simple right click on a computer drive icon you can uncover hidden files in what appears to be a formatted drive containing no data. EnCase's tools can recover files and place them into a virtual "lost files" folder while simultaneously recreating the directory structure to make clear what you have found.

Another new tool gives you the ability to search in both compressed folders and files. Combine this with the "search" and "text view" tools in the display's lower pane and EnCase automatically reveals the contents of a file for inspection. With added support from the Microsoft Encrypted File System you'll also have access to domain-authenticated accounts, as well as a Windows-protected storage area where you can recover user names and passwords.

While all of these improvements are useful, software cannot work on its own. It requires trained officers to conduct these searches. Fortunately, Guidance Software has made a major commitment to training law enforcement personnel how to use EnCase.

In fact, Guidance continues to develop EnCase tools with input from folks who have substantial law enforcement pedigrees and the desire to produce the best product available.

Nevertheless, with any technology that evolves as quickly as the computer industry, law enforcement agencies themselves must commit to ongoing education and training of their personnel. We may no longer assume that the training we received a few years ago will be all we'll ever need. We need to make an investment in keeping up with technology.

Bob Davis supervises the San Diego Police Department's computer lab. He has 26 years of experience on the force.

Tags: Software

Request more info about this product / service / company


Be the first to comment on this story





POLICE Magazine does not tolerate comments that include profanity, personal attacks or antisocial behavior (such as "spamming" or "trolling"). This and other inappropriate content or material will be removed. We reserve the right to block any user who violates this, including removing all content posted by that user.

Other Recent Stories

Cyber Terrorism: Preventing Online Assault
Hackers constantly target law enforcement. Whatever the intent, with our dependence on...
Posts for Public Consumption?
If you shot somebody tomorrow, how would the post you put online today read in the mind of...

Get Your FREE Trial Issue and Win a Gift! Subscribe Today!
Yes! Please rush me my FREE TRIAL ISSUE of POLICE magazine and FREE Officer Survival Guide with tips and tactics to help me safely get out of 10 different situations.

Just fill in the form to the right and click the button to receive your FREE Trial Issue.

If POLICE does not satisfy you, just write "cancel" on the invoice and send it back. You'll pay nothing, and the FREE issue is yours to keep. If you enjoy POLICE, pay only $25 for a full one-year subscription (12 issues in all). Enjoy a savings of nearly 60% off the cover price!

Offer valid in US only. Outside U.S., click here.
It's easy! Just fill in the form below and click the red button to receive your FREE Trial Issue.
First Name:
Last Name:
Rank:
Agency:
Address:
City:
State:
  
Zip Code:
 
Country:
We respect your privacy. Please let us know if the address provided is your home, as your RANK / AGENCY will not be included on the mailing label.
E-mail Address:

Police Magazine