Guidance Software EnCase Forensic v7.05.02
Strengths: A solid computer/media/mobile device forensic tool with a history of experience.
Weaknesses: Can be dicey to set up in a network environment with multiple other products’ CodeMeter dongles running on a networked license server.
Verdict: The usual reliable, solid offering we expect from this vendor.
Encase Forensic v7.05.02 is a tool for computer investigation that both searches a computer system for information, as well as aids in the process of developing this information into a complete report. This software can decrypt high-level forms of encryption, create an image of the physical drive, and then generate reports on the evidence.
After some initial challenges - the package we received did not include all necessary information - we were able to contact the company and receive the files necessary to install the software. The company's customer service was helpful in getting us through the install process after we encountered problems getting the software fully functional. We must say it took a lot of time to finally get all the necessary information for the installation process.
We determined that the software had trouble running on a network of computers using multiple CodeMeter dongles. The EnCase software would run and diplay an error message claiming it did not have all proper license certificates. Forensic v7.05.02 uses a secure key from the CodeMeter dongle so when operating on a network with multiple dongles, it had trouble identifying which secure keys related to the product. To get it to run on our network, we had to disable all our other tools that used a similar secure key. Otherwise, it would try to identify these keys as its own and fail to run. This means that while the software ran very well once it had its license identifiead, it might prove to be a nuisance on systems with many tools running that use CodeMeter dongles. Disabling the other secure keys would be both time-consuming and prevent one from using multiple tools in tandem. Therefore, our installation was time-consuming and we had to jump through hoops to get the software to operate on our network, though it did eventually work - and work very well, indeed.
EnCase Forensic v7.05.02 claims to be a comprehensive, industry-standard computer investigation solution - and it does not disappoint. The user interface (UI) is a clean, simple and comfortable platform from which to work. The flexibility and versatility of the interface is one of the product's greatest strengths, as it creates a more valuable experience for the user. The tool's features also help to make it an attractive option. It provides the capability to analyze Linux, Unix and Mac systems, as well as major phone and tablet operating systems, such as Android and Apple iOS and more. The evidence processor is customizable and efficient.
The interface of the program is easy to use and user friendly. The software is well organized. The search results becoming available as they load is also a useful feature, as is the ability to create a report of the evidence and findings. While the software encountered minor difficulties when beginning the installation process, the support staff was so helpful and was able to help us develop a workaround for our particular network. EnCase is, arguably, the grandparent of computer forensic tools and this legacy of experience shows in each new release. This one is no exception. Version 7 has a good combination of ease of use for the novice and comprehensive capability for the power user.