Extend the power of EnCase® with EnCase apps and tap into the expertise of our community of expert EnScript® developers. EnCase apps save you time and money in your investigations and will help you make your case—faster!

EnCase Integrated Threat Toolkit (EITT)

EnCase Integrated Threat Toolkit (EITT) is a GUI interface and aggregate for a number of
EnCase® Enterprise functions and open source tools (OST) designed to assist in
DFIR investigations.

App of the Month

Mac OS X Time Machine Parser

Time Machine is a function of Mac OS X that makes incremental backups of a Mac OS X system volume to a HFS+ volume on a removable disk or a HFS+ volume contained in a disk-image file on a device such as Time Capsule. Time Machine uses HFS+ hard-linked files and folders so as to only backup those files and folders that have changed since the last backup.

C-TAK (Cyber-Threat
Analytics Knowledgebase) Trial
Version (v2.0)

C-TAK provides examiners with accurate identification of cyber threats that may directly impact investigations.

Partner of the Month

DS_Store Parser

Parse Apple .DS_Store files and find such information as the original path of items in the Mac OS X Trash folder.

VSS Examiner

Quickly and easily identify and preserve data of interest in Microsoft Windows volume shadow copies.

Copy Web Browser Files

A script to search for and copy/export web browser history and cache files to a folder for analysis using 3rd party tools.

Entry Bookmarker

This script will bookmark in groups all blue checked entries by evidence file, year, month, day, weekday, and session.

Low Hanging Fruit

Export unique hashes for all entries that are unknown to NIST.

Messenger Protocol Fragments

Search for MSN and MSN Live Messenger protocol fragments. In many cases, this app can retrieve important protocol data even when chat logging is disabled.

Windows Executable Packer Detection

Analyze Windows executables and detect modification by a packer or cryptor.

Call Sales

Need help immediately?
Call us at (844) 576-9354, or submit this form: