OpenText™ Forensic (Encase)

OpenText™ Forensic (EnCase) is a court-proven solution renowned for its deep dive evidence acquisition capabilities, powerful processing, and integrated investigative workflows. OpenText Forensic empowers investigators to complete any investigation, mobile or otherwise, on any device with full evidential integrity.

KEY FEATURES

• Comprehensive artifact support: Collects both local device and cloud-based activity from Facebook, Twitter, Instagram, Google, iCloud, WhatsApp and LinkedIn, as well as internet browser history, videos, documents and location data to ensure all relevant evidence is highlighted.
• Extensive device support: Provides comprehensive investigative capabilities for Mac devices, including APFS, HFS+ and FileVault 2 decryption support, as well as Windows and Linux-based devices.
• AI and ML support: Automatically identifies images of particular interest, including nudity, drugs, weapons and explicit sexual content using artificial intelligence and machine learning.
• Optical character recognition: Extracts text evidence buried in PDFs, images and scanned documents to include as critical evidence.
• AFF4 evidence support: Leverages an open standard evidence file format to ingest other evidence file formats to enable a more comprehensive conclusion.

ENHANCED INDEXING ENGINE

Empowers investigators to conduct investigations with powerful processing speeds, advanced index searching, comprehensive language support, and optimized performance.

EASY REPORTING

Provides customizable templates to help examiners create compelling, easy to read, professional reports that can be shared for every case.

EXTENSIBILITY 

Offers extensibility through EnScripts, which are automated code commands that streamline and automate tasks and extend the capabilities of OpenText Forensic for greater efficiency.

WORKFLOW AUTOMATION 

Automated workflows allow examiners to activate/follow pre-determined processes in order to easily navigate evidence. They able to more quickly uncover which evidence is vital to their investigation.

UPDATED ENCRYPTION SUPPORT

Through encryption support for Microsoft® Windows® 10 Microsoft® Bitlocker® XTS-AES, Dell™ Data Protection 8.17, and Symantec™ PGP® v10.3 investigators can acquire encrypted evidence without worrying about data corruption or unnecessary delays.

APPLE FILE SYSTEM (APFS) SUPPORT

Supports APFS, the file system used in helping investigators conduct targeted data collections from APFS and sends the output as an OpenText Forensic logical evidence file.

VOLUME SHADOW COPY CAPABILITIES 

Examines Volume Shadow Snapshot (VSS) backups, also known as volume shadow copies, generated by Microsoft Windows, allowing investigators to recover deleted or modified files, as well as full volumes and learn what may have taken place on a system before the investigation.

APPLE T2 SECURITY BYPASS

Acquires data from machines equipped with Apple T2 Security chips without additional hardware, drive partitions, or hassle. If the user is logged in, no credentials are required.