So many artifacts, so little time… Summer edition

Ken Mizota

EnCase is an extensible digital investigation platform. Simply put, extensibility reduces time and effort for the investigator. One way to validate this claim for yourself is to take a look at the depth and breadth of the ways EnCase can work with existing tools in your kit. For example: Do you already own Magnet Forensic's IEF? IEF and EnCase work together to reduce work for investigators. Have you considered how to integrate threat intelligence into your DFIR regimen? EnCase and Cisco Security (formerly ThreatGRID) collaborate to reduce IR time and effort. Let’s walk through a few ways extensibility works in your favor.

Image Analyzer – A Case Simulation in EnCase Forensic

Robert Bond

A new release of Image Analyzer is now available on App Central that now supports the scanning of images for pornographic content in both entries and records. This means investigators can analyze images in the records tab that have been extracted from email archives and compounded files.

Let’s take a look at how an investigator might use Image Analyzer as part of an investigation involving email misuse in a large corporate environment.

Image Analyzer – Categorizer App for Pictures

Robert Bond

The task of correctly identifying pornographic images in either criminal or civil investigations can be very time consuming and is often like looking for a ‘needle in a haystack’. A single case can contain thousands or even millions of images, most of which are not relevant to the investigation. Even when reviewing images in a convenient thumbnail gallery, a human can only moderate about 5000 images per hour when fatigue is taken into consideration. Therefore cases requiring image review are typically labour intensive and are often postponed; creating a backlog of cases which further compounds the issue.