Digital Discovery
When collecting data for investigations, litigation, audits, or other requests, the forensics team is faced with the challenge of discovering data in many different formats and locations, often buried in mobile technology or cloud-based systems and rarely obvious at the surface level. Steve Davis, Director of Business Development for Digital Discovery, explained, “Where data lives is transient, it’s movable, and it’s also redundant. It’s in multiple places. It used to be a lot easier to cast the net around data. Now, it’s not so easy, and it takes a little sleuthing to figure out all the places where data may be. People are finding new ways to steal, exfiltrate, and migrate data.” He added, “We’re the white hat guys. We’re data scientists trying to get the truth uncovered, and likewise there are people that are trying to obliterate it or muddy the water by doing just the opposite.”
When Digital Discovery needed technology to support its forensic data collection efforts, the company chose OpenText EnCase—a solution that provides 360-degree visibility and access across endpoints including workstations, mobile phones, and servers. “OpenText EnCase brings both breadth and depth in terms of what it does. It deals with all data types, so it also doesn’t have a lot of limitations in terms of sizing and the things you can open,” noted Davis. Known for its speed, flexibility, and functionality, EnCase is the industry gold standard for forensic-grade collection and investigation. Davis explained the company’s decision to use OpenText EnCase: “We did our shopping like anyone else would on what the best product is, what fits, and what does the most things. OpenText EnCase stood out in terms of its abilities. It is probably the most powerful and most widely used product out there.”
Using OpenText EnCase as its primary forensic tool, the investigators at Digital Discovery can quickly capture, decrypt, and explore evidence down to the bit level from the widest variety of operating and file systems. The solution enables both rapid triage and deep forensic analysis. “We’re using OpenText EnCase to do triaging of data, to review data, to pull out artifacts in order to analyze behaviors associated with ShellBags [Windows Registry tracking], user artifacts, and a lot of the things that are pretty standard in the forensic community,” said Davis. Keeping up with the speed of innovation is critical for the Digital Discovery team as their investigations frequently revolve around hidden data. EnCase is continually developed to support the latest devices, operating and file systems, artifacts, and encryption types, allowing investigators to collect the evidence they need, efficiently and comprehensively. Davis explained, “OpenText EnCase has done a great job of keeping up with all the necessary revisions, improvements, patches, versions that allow us to do our job. Absent that, I don’t think we could do our job in an effective and defensible manner. That’s the beauty of OpenText EnCase—we’ve always found it to be the gold standard.”
