EnCase is the shared technology within a suite of digital investigations products by Guidance Software (acquired by OpenText in 2017[2]).

It allows the investigator to conduct in-depth analysis of user files to collect evidence such as documents, pictures, internet history and Windows Registry information.

Data recovered by EnCase has been used in various court systems, such as in the cases of the BTK Killer and the murder of Danielle van Dam.

In 2008 EnCase Cybersecurity was released which combined many of the tools and automation from previous security functions and streamlined the workflow of incident response.

[7] EnCase contains tools for several areas of the digital forensic process; acquisition, analysis and reporting.

Images are stored in proprietary Expert Witness File format; the compressible file format is prefixed with case data information and consists of a bit-by-bit (i.e. exact) copy of the media inter-spaced with CRC hashes for every 64 sectors of data (by default).