Every day, forensic examiners are presented with vast amounts of data to investigate. A terabyte or more of data for a single case is the new norm. Coupled with the demands for forensic experts to complete work in the field, it is hard to imagine how a forensic department will ever catch up with its backlog - until now. With EnCase Portable, forensic teams have a new weapon in their battle against the ever-growing backlog.

With EnCase Portable, organizations can increase the number of personnel in the field who can complete computer forensic related tasks, while reducing the amount of evidence brought into their labs for investigation. With EnCase Portable, organizations can save time, decrease costs, and increase efficiencies of their computer forensic teams.

With Triage, forensic teams can be extended to include people who are not forensic experts. The experts can create specific jobs that allow non-experts in the field to perform quick triage, helping them identify and eliminate computers that are not relevant to a case. With Triage, the experts remain in complete control of how non-experts search computers in the field.

With Collect, anyone can become an extension of a computer forensic team. With Collect, the experts can configure collection jobs for EnCase Portable. Collect can be used to create a bit-by-bit copy of a computer's hard drive, collect files based on time, type, location, or virtually any criteria that is required for the specific investigation. In addition, users can collect a computer's memory (RAM), which can contain valuable information pertinent to an investigation. Once configured, anyone can perform the collection, allowing the experts to stay in the lab, focused on their analysis, while others act as their proxy in the field, collecting the data.

Triage Instantly view images on the target machine Review documents in real-time Collect only relevant information quickly Customizable job creation Use keywords, metadata, hash values, and other criteria to perform targeted triage and collection Memory acquisition Full disk imaging Multiple configurations Easy Mode – Portable pre-configured by experts Advanced Mode – User able to create and edit configuration of Portable in the field, instantly Multiple triage and collection modes Live mode – collect memory from running computers Boot mode – collect from Mac and Linux computers Forensically sound Triage and Collect while preserving metadata, maintaining evidence integrity All data stored in EnCase evidence file format, most trusted format in the forensic community

Reduce volume of data seized by eliminating irrelevant computers on-site Enable non-experts to perform triage and collection in the field Maintain control over how computers are searched and data is collected Reduce backlog by decreasing volume of data associated with cases Seamlessly integrate collected data into EnCase® Forensic or EnCase® Enterprise for analysis Create a repeatable and defensible triage and collection process, extending the reach of your forensic team