The company's newest version, EnCase 4.19, is Windows-based software that accelerates and streamlines the process of searching a computer drive. Its virtual file system allows investigators to share the information collected with non-EnCase users while a familiar graphical user interface (GUI) allows you to create a noninvasive investigation image of the storage media. With EnCase you can also easily organize case information and generate standard and custom investigative reports.
By using the company's FastBloc write-blocker utility tools a trained investigator may even drill down into the very sectors and cylinders of a hard drive without altering any of the "original" data or its attributes.
EnCase 4.19 also includes many enhanced or altogether new features.
One of these new features, the text "find" command, is built much like the find command found in many word processors. When users requested this feature, the company actually listened and incorporated it into the new version. Other enhancements include improvements to reporting modules, navigation techniques, and the overall speed in which an investigative audit is processed.
Increasing its flexibility, EnCase now accommodates additional platforms. Not only can you use it on Windows and Macintosh systems, but also with PalmOS, Unix, and Linux, among others.
Also, an increased number of file systems are now supported by EnCase, including all FAT systems, NTFS, CDFS, UDF, BSD, Mac OS X, and RAID drives on servers.
All this flexibility is essential when working cases involving more sophisticated computer setups. Some suspects use several different systems to make it more complicated to track their files. To further help in finding and collecting pertinent files, Guidance has added to EnCase enhanced support for Outlook's PST files, Base64 and UUE encoded attachments, file structures for .tar and .gz files, and support for PNG-formatted graphics.
One of the most important changes to EnCase is an enhancement in NTFS folder recovery tools, critical for recovering data when a drive has been formatted to conceal or destroy incriminating evidence. This is also useful when a master file table has been corrupted. With a simple right click on a computer drive icon you can uncover hidden files in what appears to be a formatted drive containing no data. EnCase's tools can recover files and place them into a virtual "lost files" folder while simultaneously recreating the directory structure to make clear what you have found.
Another new tool gives you the ability to search in both compressed folders and files. Combine this with the "search" and "text view" tools in the display's lower pane and EnCase automatically reveals the contents of a file for inspection. With added support from the Microsoft Encrypted File System you'll also have access to domain-authenticated accounts, as well as a Windows-protected storage area where you can recover user names and passwords.
While all of these improvements are useful, software cannot work on its own. It requires trained officers to conduct these searches. Fortunately, Guidance Software has made a major commitment to training law enforcement personnel how to use EnCase.
In fact, Guidance continues to develop EnCase tools with input from folks who have substantial law enforcement pedigrees and the desire to produce the best product available.
Nevertheless, with any technology that evolves as quickly as the computer industry, law enforcement agencies themselves must commit to ongoing education and training of their personnel. We may no longer assume that the training we received a few years ago will be all we'll ever need. We need to make an investment in keeping up with technology.
Bob Davis supervises the San Diego Police Department's computer lab. He has 26 years of experience on the force.
