With EnCase Bit9 Analyzer, users of EnCase software can quickly search through their entire enterprise at a forensic level and compare all volatile data such as active processes, drivers and DLLs, as well as static data, against a database of known applications. Analysts can quickly identify all known malware, trusted binaries, unknown processes and user-created data. Known malware, system binaries and user applications can quickly be eliminated, while unknown processes and user-created data can be investigated, categorized and tagged for future use with EnCase software. With EnCase Bit9 Analyzer, examiners can also quickly eliminate known and trusted files to focus on unknown and user-created data, dramatically increasing the efficiency of any investigation, audit, or eDiscovery collection.