By browsing this site, you are agreeing to our cookie policy. More Information

EnCase Forensic® Startup Training

Getting Started Couldn't Be Easier
EnCase® Start Up on-demand product training to let you jump-in and quickly get started with your new software. EnCase® Start Up is available for select Guidance Software products at no cost. You can refer to it whenever you need it; brush-up on features and functionality, or bring a new team member up-to-speed.

On-Demand: The Way You Want It
The on-demand online training format means your training session is there when you need it. You choose the when you want it, and you set the pace.

EnCase Forensic Startup Introduction
The EnCase® StartUp course provides an introduction to EnCase® Forensic v7, the next advancement in computer forensics technology, workflow, and best practices.
Watch it now

Getting Started with EnCase - Installation
This lesson provides step-by-step instructions to install the most up-to-date version of EnCase Forensic v7.
Watch it now »

EnCase Concepts
EnCase Forensic v7 provides investigators with a single tool for conducting large-scale and complex investigations from beginning to end. This lesson details the structure and unique terminology, forming the foundation for sound examinations.
Watch it now »

Creating a Case
One of the most powerful features of EnCase Forensic v7 is its ability to organize different types of media together, so that they can be indexed and searched as a unit rather than individually. The best practices for starting a case are imparted during this portion of the course.
Part 1: Watch it now »
Part 2: Watch it now »

Adding Evidence to a Case
Adding evidence to a case with EnCase Forensic v7 differs from how it was done in previous versions. This lesson highlights the differences and describes best practices for storing the evidence.
Part 1: Watch it now »
Part 2: Watch it now »
Part 3: Watch it now »
Part 4: Watch it now »

Processing Evidence
This lesson provides an introduction to the use of the EnCase® Evidence Processor. The Evidence Processor a collection of powerful analytic tools. The Evidence Processor can be run unattended, allowing investigators to work on other aspects of the case while this tool is processing data.
Part 1: Watch it now »
Part 2: Watch it now »

Viewing Index and Search Results
This lesson provides introductions to EnCase Forensic v7 core viewing enhancements, such as the ability to search across multiple types of data and view the results on a single screen, the powerful index search capability, and searching data based on user-customized tags.
Part 1: Watch it now »
Part 2: Watch it now »

Processed Evidence Results
This lesson walks through the many methods for processing evidence, including understanding, adding, and editing file types, file signatures and signature analysis, compound or compressed archive files, analyzing Internet artifacts, viewing thumbnails, and creating and adding values to a hash set.
Part 1: Watch it now »
Part 2: Watch it now »
Part 3: Watch it now »

E-Mail
E-mail is a key area for all forensic investigation. This lesson explains the enhancements in EnCase Forensic v7 for viewing and analyzing e-mail artifacts.
Watch it now »

Bookmarking and Tagging
While working on a case in EnCase Forensic v7, files, portions of files, and other objects that are of interest as potential evidence are discovered. These items can be marked and saved for inclusion in the examination report. These marked sections are referred to as “bookmarks,” and this lesson provides an introduction to the using this powerful process.
Part 1: Watch it now »
Part 2: Watch it now »

Reporting
The final phase of a forensic examination is reporting the findings, which must be well-organized and presented in a format that the target audience will understand. EnCase Forensic v7 has added several enhancements to its reporting capabilities that strengthen this phase of the process and this lesson introduces these new functions.
Part 1: Watch it now »
Part 2: Watch it now »