Guidance Software (Now OpenText) has recently released EnCase® Forensic and EnCase Endpoint Investigator 8.05 supporting mobile device acquisitions in addition to the all-new EnCase Mobile Investigator, which offers powerful mobile data review and reporting capabilities for acquired mobile data.
Working with the forensic community, we developed EnCase Mobile Investigator with the needs of examiners in mind. Our new mobile forensics solution delivers the same level of visibility to mobile devices as delivered to traditional endpoints through EnCase Forensic. With continuous updates to mobile operating systems and popular apps, the broadest mobile device support available, and powerful investigation features, EnCase Mobile Investigator stands out from the pack — empowering examiners to find, analyze, and report on the evidence they need to close cases.In this post, I want to share the three most important things you need to know about EnCase Mobile Investigator and give you a peek into what we have planned for the future.
EnCase Mobile Investigator is designed with ease of use in mind: With intuitive evidence review, examiners can easily create a case and review parsed mobile device evidence, such as mobile app data, text messages, call records, internet history, e-mails, and cloud repositories associated with the widest variety of mobile devices. Once an acquisition is complete with EnCase Forensic or Endpoint Investigator, you can load that EnCase Mobile Acquisition (.ema) file into EnCase Mobile Investigator. When parsing is complete, you can begin analysis from categorized files and start putting pieces of the puzzle together. As you can see below, once you click on the thumbnail button, all graphic files will appear and you can easily bookmark any relevant evidence for your case. With EnCase Mobile Investigator, finding and gathering the evidence you need from a smartphone, smartwatch, tablet, or even drone, has never been easier.
Expanded Cloud Application Visibility: As mobile apps commonly store some data in the cloud, investigators are faced with challenges accessing crucial and relevant evidence. Those challenges include existing tools that do not support connected cloud accounts, and challenges related to the retrieval of court-ordered warrants. EnCase Mobile Investigator tackles the first challenge providing an examiner access and visibility into a cloud applications associated with the mobile device (Google Drive, Gmail, Facebook, etc.) With an authentication key, (and the appropriate permissions), examiners can access a cloud account to retrieve critical evidence, such as e-mails or messages, that can be instrumental to a case closing. Over time, the use of digital evidence from the cloud in criminal and civil matters will continue to expand, and using EnCase Mobile Investigator can empower you to accessing the evidence you need when obtaining the permissions you seek.
Powerful OCR: Investigators need all of the evidence they can find to report to their key stakeholders, and ultimately, close a case. With EnCase Mobile Investigator, examiners can now find, extract, and analyze data within graphic files using Optical Character Recognition. Evidence from graphic files such as PDFs, photos, and other file types will be found when running keyword searches, ensuring you can uncover critical evidence no matter how it is stored. This is a critical feature designed to ensure your ability to exact relevant evidence no matter how it is stored.
These are just three examples of how we are committed to making EnCase Mobile Investigator work the way you want it to work. With each release you will see more and more mobile applications, device types, and operating systems supported, so that you can conduct your investigations seamlessly.
We are committed to working with you, the forensic community, to understand how we can continue to make the EnCase better. If you have any comments, suggestions please let us know.
Raj Udeshi is a Product Management Specialist at Guidance Software (Now OpenText)
