- Instantly view images on the target machine
- Review documents in real-time
- Collect only relevant information quickly
- Use keywords, metadata, hash values, and other criteria to perform targeted triage and collection
- Memory acquisition
- Full disk imaging
- Easy Mode: Pre-configured by experts
- Advanced Mode: Instantly create and edit configurations of EnCase Portable in the Field
Extend the reach of your investigation, e-discovery, incident response, or IT teams without sending experts into the field. Based on the situation, EnCase Portable can be used in Easy Mode for non-experts, or Advanced Mode to create and edit configurations in the field.
Triage and collect while preserving metadata and maintaining evidence integrity. Collected data is preserved in the court-accepted EnCase® evidence file format; the most trusted format in the forensics community.
Instantly and easily view images, documents, and other digital evidence found on a target computer.
Use keywords, metadata, hash values, and other criteria to perform targeted collection, as well as full-disk imaging and memory acquisition.
The powerful and effective features of EnCase® Portable--combined with the processing, analytic, and reporting capabilities of EnCase® Forensic, EnCase® eDiscovery, and EnCase Enterprise—have made EnCase® solutions the trusted standard in corporate, legal, and criminal investigation. No other technology offers the same degree of functionality, acceptance, and performance.
Save Time and Money with EnCase Portable
- Scan for evidence without having to call in specialists or seize computers
- Remotely perform forensically sound collection of data from any computer with a USB port at any organizational or search location
- Immediately access critical information
- Reduce backlog by allowing non-experts to perform forensically sound triage and collection
- Pre-screened evidence reduces data, allowing forensic experts to work more efficiently
- Create pre-configured data-collection jobs for non-experts, then return to experts for analysis
Equip forensic experts and non-experts alike with EnCase Portable and they'll be able to quickly review information stored on a computer in the field, in real time, without altering or damaging the information in any way.
Even non-expert team members can plug in the EnCase Portable device and:
- Execute pre-configured triage searches
- Browse pictures
- View internet history
- See who has been using a computer
Expert team members can also run new triage searches in the field.
When you need to perform forensically sound collection from a device or devices at a remote location, there’s no longer any need to put a specialist on a plane. With EnCase® Portable, you can empower any trusted staffer to become an extension of a computer forensics, incident response, or e-discovery team.
Use the collection capabilities of EnCase Portable to:
- Create an exact copy of a computer’s entire hard drive
- Perform a targeted search based on criteria required for a specific situation
- Collect an exact copy of a computer’s memory
Ease of use
Pre-configure collection jobs and send devices to remote employees.
Plug in and run job
EP identifies and collects all data relevant to the search, preserving even metadata relevant to the files. Once completed, the employee can send data back to your team.
Configure job based on:
- File type
- Hash value
With ability to target specific files, your team can avoid overcollecting data if complete exact copy of hard drive needed, pros can configure the job to create:
- A full physical copy of a hard drive
- Logical image
- Remote employee's choice
Manage all Portable devices from one, easy interface. You can:
- Create new jobs
- Edit existing jobs
- Import collected evidence
- Analyze evidence
- Refresh EnCase Portable devices