EnCase Forensic

OpenText™ EnCase™ Forensic is a court-proven solution for finding, decrypting, collecting and preserving forensic data from a wide variety of devices, securing forensic data for internal investigations and law enforcement



Reliable acquisition of evidence
With EnCase Forensic, examiners can be confident the integrity of the evidence will not be compromised. All evidence captured with EnCase Forensic is stored in the court-accepted EnCase evidence file formats.

Deep forensic analysis
EnCase Forensic has been used in thousands of court cases and is known for its ability to uncover evidence that may go unnoticed if analyzed with other solutions

Mobile collection for 27,000+ profiles
EnCase Forensic supports the latest smartphones and tablets, including more than 27,000 mobile device profiles, all while empowering the examiner to conduct logical and physical
acquisitions. From the new investigator to the seasoned examiner, each level of user can find the evidence they need with mobile acquisitions in EnCase Forensic.

Image analysis
Media Analyzer processes images into 12 categories using AI powered visual threat intelligence technology. Examiners can quickly filter by confidence level and identify previously unidentified contraband with near-zero false positives.

Broad OS/decryption support
Offering the broadest support of operating and file systems, artifacts and encryption types, EnCase Forensic enables the investigator to provide conclusive results with a detailed analysis of findings.

Connect to the cloud
With EnCase Forensic, examiners can leverage credentials to collect from data repositories in the cloud, such as Microsoft O365 and SharePoint. Data is stored in logical containers to preserve chain of custody at the point of acquisition.

Enhanced indexing engineEmpowers investigators to conduct investigations with powerful processing speeds, advanced index searching, comprehensive language support and optimized performance
Easy reportingProvides customizable templates to help examiners create compelling, easy to read, professional reports that can be shared for every case
ExtensibilityOffers extensibility through EnScripts, which are automated code commands that streamline and automate tasks and extend the capabilities of EnCase Forensic to help the examiners complete investigations more efficiently
Workflow automationDelivers automated investigation workflows so examiners can easily navigate through EnCase Forensic to enhance how
they uncover evidence
Updated encryption supportProvides encryption support for Microsoft® Windows® 10 Bitlocker XTS-AES, Dell® Data Protection 8.17 and Symantec PGP v10.3; investigators can acquire encrypted evidence without worry about data corruption, damage or unnecessary delays
Apple File System (APFS) supportSupports APFS, the file system used in helping investigators conduct targeted data collections from APFS and send the output as an EnCase logical evidence file
Volume shadow copy capabilitiesExamines Volume Shadow Snapshot (VSS) backups, also known as volume shadow copies, generated by Microsoft Windows, allowing investigators to recover deleted or modified files, as well as full volumes and learn what may have taken place on a system before the investigation
Apple T2 Security BypassAcquires machines equipped with Apple T2 Security chips without additional hardware, drive partitions, or hassle. And if the user is logged in, no credentials are required
Operating systemMicrosoft Windows 7 SP1 through Windows 10
Microsoft Windows Server through Version 2016
CPU4 core processor or better
Memory16 GB RAM or better
Storage200GB SSD, 1TB HDD

digital forensics


Additional information


Guidance Software





You've just added this product to the cart: