When officers, agents, and other field personnel found a computer on-scene, they had only two options: try to get a specialist to the scene, or more likely, the only option available would be to “bag and tag” the hardware; shipping it off to the lab. It might be days, weeks, even months before a trained forensic specialist had time to conduct an investigation. In the meantime, the detective had no choice but to wait. With EnCase Portable, field personnel now have a new weapon that can unlock the secrets stored on a computer immediately. With EnCase Portable, the wait is over.

EnCase Portable, is a solution, delivered on an USB device, which can enable teams in the field to see what is on the computer right now without having to call in specialist or seize the computer.

The solution is composed of two components, Triage and Collect.

Triage allows field personnel to quickly review information stored on a computer, in real time, without needing to be an expert in computer forensics. Working with the forensic specialists, field personnel can define and configure searches on the EnCase Portable device to search for:

Pictures Internet Browsing Activity Instant Message History Personally Identifiable Information

What’s Been Installed on a Computer What’s Been Uninstalled on a Computer Who Has Been Using the Computer And More…

Advanced users of Triage can also create new triage searches, in the field, in a matter of minutes.

With the Collect component of EnCase Portable, field personnel can also act as an extension of the forensic team, completing both broad and targeted, forensically sound collections in the field. Collect can be used to create full disk acquisitions of a computer's hard drive or perform a targeted collection based on the criteria required for the specific situation. In addition, users can collect an exact copy of a computer's memory, which can contain valuable information pertinent to an investigation.

Triage Instantly view images on the target machine Review documents in real-time Collect only relevant information quickly Customizable job creation Use keywords, metadata, hash values, and other criteria to perform targeted triage and collection Memory acquisition Full disk imaging Multiple configurations Easy Mode – Portable pre-configured by experts Advanced Mode – User able to create and edit configuration of Portable in the field, instantly Multiple triage and collection modes Live mode – collect memory from running computers Boot mode – collect from Mac and Linux computers Forensically sound Triage and Collect while preserving metadata, maintaining evidence integrity All data stored in EnCase evidence file format, most trusted format in the forensic community

View data stored on a computer in real time, giving valuable insight into the investigation Eliminate the need to wait for the forensic specialist before getting initial findings from a computer Enable non-experts to perform triage and collection in the field Seamlessly integrate collected data into EnCase® Forensic or EnCase® Enterprise for analysis Create a repeatable and defensible triage and collection process, extending the reach of your forensic team