This blog post is a review of the EnCase portable device. I have had the chance to use the EnCase portable device for several months now, starting with the initial version that was released, but I finally got a chance to sit down and write a review. The current EnCase Portable version that is publicly available is v1.2.1, which was released November 2009.
The EnCase Portable kit consists of a small carrying kit, a HASP security key, the EnCase portable USB device (black) and a 16gb flash device that is used for the collected data (blue) and a IOGear USB hub:
The EnCase Portable device was released about a year ago and is designed to be deployed on a subject's computer to collect a predetermined set or types of files. The device works in one of two ways:
2. The second method is to insert the USB device on the target computer and choose the pre-determined job at the time of triage.
Method one would be for giving the device to someone who does not know much about EnCase or does not need to interact with the collection process whatsoever. Method two would be for someone with average knowledge of EnCase and could decide what types of files need to be collected at the time of collection in the field.
In addition to the two collection methods described above, the USB device can be used in one of three ways to perform the collection:
1. For computers that support booting from a USB device, you can insert the black USB EnCase portable device and boot directly to an operating system installed on the USB (BartPE-ish).
2. For computers that don't support booting to USB devices (older computers or BIOS is locked down), then you can boot from an included CD-ROM that contains a stand alone operating system and the necessary EnCase program.
3. You can insert the USB on a running device and execute the EnCase portable process directly from the USB while the computer is running.
The EnCase security key must also be connected to the target machine during the time of the collection. There are also three choices for storing the collected data:
1. You can store the collected data on the actual EnCase portable device itself. It is a 4GB flash device, so space is somewhat limited if your collection may contain a large number of files or large amounts of data.
3. You can use your own external USB device such as an external USB hard drive.
When you run the portable EnScript (EnPack), the following menu is displayed: