1. Encase Screenshots

2. Acquire

3. When you acquire evidence, you can choose from among the local devices

4. You enter details about the case (if you don’t have a case open already).

5. And you set some options about how you want to acquire the evidence in question.

6. Disk View

7. You can view a map of the sectors on the disk, showing status of each (allocated, bad, part of the FAT, etc.) and the contents of the selected block in hex and ascii.

8. File Signatures

9. The file signature feature uses heuristics to assign a type to a file using the file extension and the contents of the file.

10. General File View

13. Gallery View

14. This is an awesome feature – finds images by signature or extension and displays a catalogue of them all.

15. You can also zero-in on a single picture in the file view.

16. String, Hash Searches

17. You can search for regular expression matches

19. You can add hash sets to encase, and import sets from HashKeeper
You can add hash sets to encase, and import sets from HashKeeper. Once imported, you can choose which sets to employ in your searches.

20. This shows the results of matching files against hash sets
This shows the results of matching files against hash sets. The “Hash Set” column shows what “package” the file belongs to. The comments in the signature column tell you about interesting bits – for instance, logo.sys is a bitmap even though its extension is .sys.

21. Reconstruction

23. Registry Review

25. Reports