Inexpensive Encase

Why do you want to use EnCase?

I use Xways Forensic version now and the IRS/DOHJ use Encase and I's like to understand it capabilities in e-discovery. Plus it seems open jobs require experience with it.

It is a popular tool. They do not have a trial option and it runs via a USB dongle. v6 is the current version and if you look around this forum sometimes folks will sell a dongle.

If you go to You Tube there are several videos demonstrating use.

Also, if you do the online Guidance training courses they provide you with a time limited dongle of the full version. This allows you to train and work with the product at the same time.

If you purchase 'The Official EnCase Certified Examiner' by Steve Bunting, it comes with a demo version on CD that has pre-loaded files. The book will direct you to certain files to perform exercises. I have a copy of the book but never got past the first chapter roll .

I'm guessing from his previous post that he can't afford the training, as he stated that he couldn't afford the license. Training I seem to remember was 2k or 2500 but you can now get the passport for 5k. Add in the flights, or gas, hotel, food, etc. and you can easily get to 3000 per class and they have several classes.

While not required I don't know that I would want to take a tool and not have any training on it. I don't mean you have to take the Encase training as there are vendor neutral training sessions available. But it is always nicer to be able to state that you have had training on the equipment you use and not merely a book.

It is a popular tool. They do not have a trial option and it runs via a USB dongle. v6 is the current version and if you look around this forum sometimes folks will sell a dongle.

If you go to You Tube there are several videos demonstrating use.

Also, if you do the online Guidance training courses they provide you with a time limited dongle of the full version. This allows you to train and work with the product at the same time.

If you purchase 'The Official EnCase Certified Examiner' by Steve Bunting, it comes with a demo version on CD

You can get the demo from their website as well. It's rather buried though, and you can expect a great deal of sales emails and calls.

I can't find it right now, but if I do, I'll put a link to it here later.

Demo's a lot of the time don't help.

Even with the file limitations you can find yourself not being able to examine what you need to because of size or not being able to chop down a specific file set down to fit the limitations.

You also still run into things in a deposition or court on I learned off a demo (which isn't a crime) and if asked why saying it wasn't in the budget isn't a great response.

Plenty of people use open source tools and use them very well, Encase is always a nice thing to have in a toolbox. If a client says the other examiner ran this enscript and came up with PQRS… and the person hiring you wants you to duplicate that in front of him using that software then you can't, or if you can, not a good idea to do it using a demo.

I know that you should be able to duplicate that result using any tool, but the reality is that many times people are set in their ways and want something produced to them just like the other side is producing it.

Ran into a guy awhile back and he was saying there was another examiner there who was just starting out and couldn't afford FTK or Encase and was using X-ways, so he didn't know how to read the report wizard, RSR, or Init case, etc. from either software.

Guess I'm trying to say get the training, not just the software.

Thanks to all for your comments. They have been enlightening to say the least. It would seem that I need to save for training and the software - both of which will be hard to do. But alas, if that is the only way to truly learn the product so that I could legitimately answer questions about experience with the product. Then so be it. Not one for padding a resume.

Why do you want to use EnCase?

BTW, took a look at your website. Great job.