GUIDANCE SOFTWARE

EnCase Portable

EnCase Portable

A Data Collection and Triage Solution that Anyone can Use

TM

GUIDANCE SOFTWARE

EnCase Portable

EnCase Portable
Who Can Use EnCase Portable
Police Officers Probation and Parole Officers Civilian Investigators Military Personnel Government Personnel IT Professionals Law firm Personnel Litigation Support Personnel Non-Technical Personnel
With the ever-growing demand to collect and triage data in the field, organizations limited resources can be stretched beyond limits. There is a clear need for a technology solution that increases productivity and effectiveness by enabling a wider range of personnel to collect and triage data in a forensically sound manner anywhere in the field. With EnCase Portable, any person with basic computer skills can search, collect, and review data from computers, allowing forensic experts and other specialists to focus time and attention on their areas of expertise.

Powerful Capabilities, Pocket-Sized Portability

EnCase Portable is a data collection and triage solution that leverages the powerful capabilities of EnCase, in a simple-to-use USB device. The solution searches a targeted computer and automatically collects data, including documents, Internet history and artifacts, images, other digital evidence, and even entire hard drives. During this search and collection, the user may review images, documents, Internet history and a variety of other data in real time on the target computer. The combination of these two critical abilitiescollection and triagein one easy-to-use solution enables unsurpassed efficiency and effectiveness. Unlike other solutions that reside on laptops, EnCase Portable is a pocket-sized USB device that saves time and money. Users can collect data in a forensically sound manner, in any location with ease. Virtually any user can be trained in minutes.

EnCase Portable now gives any lawyer, paralegal, and litigation support specialist the ability to easily collect and preserve ESI anywhere, anytime.

-John J. Rosenthal, Partner and Chairman, e-Discovery and electronic information practice group, Winston & Strawn LLP

The Power of Triage, the simplicity of a USB

Many times the collection of data is not the most time-consuming activity in the processing of cases. Rather, waiting for the initial review of the collected data by the experts can add days, weeks, even months to a case. Unfortunately, these delays can severely delay or damage the progress of a case, increasing costs incrementally. With the powerful Triage capability of EnCase Portable, users can identify critical information immediately, using the target computer as their review portal. With the unique features of EnCase Portable, anyone can review information without having to be an expert in forensic technology.
n

Law enforcement agencies: Non-technical field officers can now triage suspect computers to determine quickly whether further analysis is warranted. Corporations: Legal and IT teams that perform in-house electronic discovery search and collection can run the exact same search criteria for non-networked laptops and desktops that they use over the network. Electronic discovery service providers and law firms: These organizations can improve consistency and defensibility of collections by ensuring clients that the same search methodology and criteria is applied to all custodianseliminating the well-documented risks associated with the disparate search methods, motives, or thoroughness of certain custodians.

How Collection and Triage Works with EnCase Portable

With EnCase Portable, organizations of any size, in any industry, can increase their ability to capture data, utilizing virtually everyone in their organization in the data collection and triage process. With the non-experts in the field collecting data, specialists in forensic investigations, eDiscovery, and Cybersecurity investigations can remain focused on analysis and processing, closing cases, and securing networks.

With EnCase Portable

Define - specific keywords to find, review, and collect responsive files in a matter of minutes Search - for and immediately review information related to internal investigations Preview - images, emails, and internet history and artifacts immediately on the target computer Uncover - any signs of illegal content on a target computer and review findings instantly Collect - critical data, such as intelligence information, from a computer that can help identify persons of interest

1) Expert configures EnCase Portable to meet specific collection or triage request. 2) Non-Expert runs EnCase Portable to search, review and collect relevant data. 3) Collected data is sent back to Expert for further analysis/processing using EnCase.

1 3
0101010001011101010111101010101111101010110100110 1010101101010100011011110010101001 101010111110111101000101110111011110100010

2
EnCase Portable lets anyone with minimal technical knowledge collect electronic evidence, with a chain of custody, from computers in the field. This will free up time for computer forensic experts and allow them to focus their attention on analysis and reporting, rather than initial collection.

EnCase Expert

Non-Expert

- Collect Evidence With EnCase Portable, Product Review, Law Technology News
EnCase Portable enables a person familiar with EnCase to create search, collection, and triage jobs using keywords, file types, dates, etc, as their criteria. Once created, the jobs can be published to the EnCase Portable device and used by anyone to execute the job. This unsurpassed flexibility means that EnCase Portable can handle any situation that arises. The EnCase Portable user can then insert the device into a target computer, select the job and EnCase Portable will do the rest. With EnCase Potable you can perform a targeted or broad collection, even an entire hard drive with ease. During a triage job, the user may review images, documents, internet history and a variety of other data in real time on the target computer as the search is in progress.

GUIDANCE SOFTWARE

EnCase Portable

Key Features
Plug in and collect data immediately Customizable search, triage, and collection jobs Live and turned off computer operating modes Integrated with proven EnCase software

EnCase Portable enables everyone to perform data triage and collection and allows your forensic, Cybersecurity, and eDiscovery specialists to remain focused on completing casework and analysis. EnCase Portable changes the face of data collection by helping all members of your organization be valuable components in the completion of digital investigations.

Image Gallery View

View every image stored on a target computer as they are discovered, allowing for immediate identification of relevant images.

Track Progress of jobs immediately

Key Benefits
Easy to Use - Non-technical personnel can collect and review data Real-Time Review - Triage relevant information on a target computer instantly Forensically Sound - Collected data stored in EnCase courtvetted formats Fully Integrated with EnCase - Allows seamless integration of data into EnCase Forensic or EnCase Enterprise for detailed analysis Ultra-Portable - Pocket-sized kit can be transported to any location with ease Stealth - Search and collect without leaving a trace on the target computer

As computers are searched, the user of EnCase Portable can, in real time, see how much relevant data exists and begin to determine appropriate next steps.

Targeted Keyword Searching

Create custom keyword searches with EnCase Portable and see which files are relevant in a matter of minutes. This allows for uniformity in search and consistency in results for those who use EnCase Enterprise, EnCase Cybersecurity, or EnCase eDiscovery.

View Search Results in Real Time

With a few simple clicks, the user can view a detailed list of responsive files to gain critical information about the case, the computer users, and/or the significance of the data.

GUIDANCE SOFTWARE

EnCase Portable

With EnCase Portable...

you can automatically search, review and collect an array of data, such as:
Image & Multimedia files Web History Microsoft Office Files OpenOffice Files Lotus WordPro Files Archive Files Personally Identifiable Information

Customizable Search and Collection Jobs

Encryption Support
EnCase Portable can search and collect data from computers encrypted with the following solutions: Microsoft BitLocker GuardianEdge Encryption Plus GuardianEdge Encryption Anywhere GuardianEdge Hard Disk Utimaco SafeGuard Easy McAfee SafeBoot Offline WinMagic SecureDoc PGP Whole Disk Encryption For more information about encryption support contact guidance software sales sales@guidancesoftware.com

Forensic experts can create and configure complex search criteria, using proven EnCase functionality, to pinpoint the exact data needed for a given situation.

Capture Data from Running or Powered-Off Systems

n

Live Mode: With a computer already running, the user can collect valuable in-memory information Turned-off computer Mode: When a computer is powered off, the user inserts EnCase Portable into the USB port and turns the computer on. The product boots and launches automatically. Drives are write-protected by EnCase Fastbloc SE to ensure no data is changed on the target computer

A Single USB Device for Ease of Use

The EnCase Portable USB device does not require the user to install any special device drivers on the target computer, making EnCase Portable very simple to use. The data collected with EnCase Portable can be stored on a USB device or external hard drive.

For More Information

For more information, please contact Guidance Software at 1-626-229-9191 or visit us on the web at www.guidancesoftware.com

EnCase Portable Kit includes:

One 4GB USB drive with EnCase Portable installed One 16GB USB drive for additional storage One four-port USB hub Quick reference user guide EnCase Portable installation DVD EnCase Portable Boot CD Rugged carrying case

TM

www.guidancesoftware.com
Our Customers
Guidance Softwares customers are corporations and government agencies in a wide variety of industries, such as financial and insurance services, technology, defense contracting, pharmaceutical, manufacturing and retail. Our EnCase customer base includes more than 100 of the Fortune 500 and over half of the 50, including: Allstate, Chevron, Ford, General Electric, Honeywell, Mattel, Northrop Grumman, Pfizer, UnitedHealth Group and Viacom.

About Guidance Software (GUID)

Guidance Software is recognized worldwide as the industry leader in digital investigative solutions. Its EnCase platform provides the foundation for government, corporate and law enforcement organizations to conduct thorough, network-enabled, and court-validated computer investigations of any kind, such as responding to eDiscovery requests, conducting internal investigations, responding to regulatory inquiries or performing data and compliance auditing - all while maintaining the integrity of the data. There are more than 30,000 licensed users of the EnCase technology worldwide, and thousands attend Guidance Softwares renowned training programs annually. Validated by numerous courts, corporate legal departments, government agencies and law enforcement organizations worldwide, EnCase has been honored with industry awards and recognition from eWEEK, SC Magazine, Network Computing, and the Socha-Gelbmann survey. For more information about Guidance Software, visit www.guidancesoftware.com.
2010 Guidance Software, Inc. All Rights Reserved. EnCase and Guidance Software are registered trademarks or trademarks owned by Guidance Software in the United States and other jurisdictions and may not be used without prior written permission. All other marks and brands may be claimed as the property of their respective owners. EP BR 0110-12002