Version 7 Tech Tip: Spotting Full Disk Encryption

Graham Jenkins, Guidance Software, Technical Services Engineer

With data breaches and data security pushed into the news on seemingly daily basis, we expect today’s digital investigators to be faced with encryption technology more frequently. For those with something to hide, the use of strong encryption has been widely promoted. For those with data they would like to protect, the use of strong encryption is becoming more commonplace by the day. Most enterprises know full disk and file-level encryption is a necessity if you have something worth protecting. Underlining the trend, Windows 8.1 has designs in place to enable BitLocker encryption by default when appropriate hardware is present. One of the strengths of EnCase over the years have been the ability to identify encryption and decrypt evidence in place, exposing data for investigation, without altering its contents.

SysTools Outlook Exporter for EnCase – No Outlook Installation Required

Debasish Pramanik, SysTools Software Private Limited

SysTools Outlook Exporter is a plug-in that lets you export mail records found in EnCase Forensic into a Microsoft Outlook PST format file, with no need to install Microsoft Outlook on the machine.

The plug-in package includes SysTools Outlook Viewer, which lets you view the exported PSTs in an Outlook-friendly manner, again without the requirement of having Outlook installed on your local machine. It supports Microsoft Outlook versions 2013, 2010, 2007, 2003 and 2000. With this plug-in, digital forensic investigation teams can enhance the power of EnCase in making their investigations faster.

Digital Forensic Investigators’ Skills are Critical as Investigations Grow More Complex

Robert Bond

Digital forensic evidence is playing a larger role in determining the guilt or innocence of defendants in both civil and criminal matters. As technology captures movement, messages, photos, and the vast majority of what is done on laptops, smartphones, and tablets, it’s increasingly difficult for criminals to cover their digital tracks.

Part 2 - So much evidence, so many artifacts, so little time…

Ken Mizota

In my last post, I summarized a handful of apps that are useful to search and explore your case, and apps that help with malware investigations. For latest updates on apps go to EnCase App central directly, or follow us on twitter @EnCase.

Without further ado, here are some more apps that we hope can help you make your case:

Part 1 - So much evidence, so many artifacts, so little time…

Ken Mizota

I’ve recently taken to tweeting about some of the latest additions to EnCase App Central and it’s been a reminder of the impressive ingenuity and dedication within the digital investigations community. Our humble app store has grown to house over 100 solutions, extending and increasing the efficiency and efficacy of digital investigations. At Guidance Software, we take pride in shipping software that helps investigators find more evidence, faster and we see EnCase App Central as a key component of EnCase.