Identify Relevant Items

To help solidify and validate your findings for faster case closure, EnCase Enterprise makes it easy to tag files and bookmark items for easy retrieval at any time and include them in various reports. During this phase of the investigation process, EnCase Enterprise reports offer high-level conclusions and automate the manual steps of correlating multiple artifacts to determine what happened on a system.

For example, the Files Seen on USB Device report joins together files linked to the USB history and mapped drives in the Windows registry. Each report provides enough information for you to find the original evidence and investigate further.

View Multiple Records Simultaneously

Just select the records you want to expand and view as a group, then click Open.

Identify Relevant Items 01 

The selected items will display in the Records tab.

Identify Relevant Items 02 

The Records tab shows you all mounted volumes and results from the Evidence Processor or other activities, including three types of items:

  • Entries (mounted archives)
  • Records (module results)
  • Email (mounted email archives)

EnCase Startup Training
Learn More »

Related Materials

"EnCase Enterprise saved us more than $1 million in the first six months of its use. It also allowed us to complete a critical M&A discovery issue that would have been impossible with any other software or services options in the market today."

Ted Barlow
CSO & VP of Risk Management
McAfee, Inc.

Call Sales

Need help immediately?
Call us at (844) 576-9354, or submit this form: