Corporations of every size are faced with a common dilemma. With remote offices and employees constantly on the move, how is IT supposed to manage the collection of data when necessary? In most cases, EnCase® Enterprise is the most efficient, cost effective means to collect from remote locations over the network. However, in some cases those remote computers can be difficult to reach over a network connection due to poor bandwidth or some other issue. In those cases a common practice is to have employee ship their computer back to headquarters. This practice poses a major inconvenience for both the employee and the IT department. With EnCase® Portable corporations can streamline this process, reducing downtime and increasing the productivity of their IT and remote employees alike.

EnCase Portable is a solution, delivered on an USB device, designed to help corporations manage the cumbersome process of collecting data from remote offices and employees. With EnCase® Portable, corporations can eliminate the need for employees to send their computers to headquarters to complete collection of data. By creating pre-configured collection jobs for an EnCase® Portable device, employees and staff at remote offices can complete the data collection task themselves, sending back the collected data for analysis. EnCase® Portable can drive down costs and the time between collection request and collection completion.

The solution is composed of two components, Triage and Collect.

With Triage, investigation and Incident Response teams can search for and review information related to an investigation or incident in real time, without having to be a computer forensics specialist. With this flexibility, team members can create new triage jobs when they identify a relevant piece of information.

With Collect, anyone can become an extension of a corporation IT, investigation, eDiscovery, or Incident Response team. With Collect, experts can configure any variety of collection jobs for EnCase Portable. Collect can be used to create bit-by-bit copy of a computer's hard drive, collect files based on time, type, location, or virtually any criteria required for the specific situation. In addition, users can collect a computer's memory (RAM), which can contain valuable information pertinent to an investigation. Once configured, anyone can perform the collection, allowing the experts can stay in the lab, focused on their analysis, while others act as their proxy, collecting the required data. With Collect, the IT, investigation, eDiscovery, or Incident Response team can control how the collection is performed.

Triage Instantly view images on the target machine Review documents in real-time Collect only relevant information quickly Customizable job creation Use keywords, metadata, hash values, and other criteria to perform targeted triage and collection Memory acquisition Full disk imaging Multiple configurations Easy Mode – Portable pre-configured by experts Advanced Mode – User able to create and edit configuration of Portable in the field, instantly Multiple triage and collection modes Live mode – collect memory from running computers Boot mode – collect from Mac and Linux computers Forensically sound Triage and Collect while preserving metadata, maintaining evidence integrity All data stored in EnCase evidence file format, most trusted format in the forensic community

Eliminate downtime of remote employees during data collection of hard-to-reach computers Reduce costs associated with current remote collection practices Enable non-experts to perform forensically sound data collection in the field Maintain control over how computers are searched and data is collected Seamlessly integrate collected data into EnCase® Forensic or EnCase® Enterprise for analysis Create a repeatable and defensible collection process