I began my career in Computer Forensics when I was with the Air Force Office of Special Investigations (AFOSI) from 1987-2000. After 20+ years with the Air Force (14 with AFOSI) I retired and began my civilian career. I worked for Computer Science Corporation where I was assigned to the Drug Enforcement Administration (DEA) Computer Laboratory in Lorton, VA. During the 7 years I was there I was involved in various type cases ranging from simple Diversion of Pharmaceutical cases to very complex money laundering investigations involving “High” profile drug cartels. From there I moved over into more of Network Forensics with the Department of Energy (DOE) where I deployed Encase Enterprise/Cyber Security throughout the NNSA with DOE. That is why Guidance Software probably offered me my current position as Senior Consultant with Guidance Software in Dulles, VA.
The purpose of this blog is to provide some basic information on things I find of interest within the computer forensic community, and as a way to assist and help the new individuals just coming into the field. Even though I work for Guidance Software the information provided within this blog are my opinions and beliefs and in no way express the views of Guidance Software. If you follow anything that is provided here then you do so of your own free will and I will not be held responsible for anything that you might do based on information received from this blog.
Now that we have the legal jargon out of the way, I want to make sure everyone knows I am not a help desk person on everything Encase. If you have a problem that I can help you with that does not violate any maintenance agreements you have with Guidance Software then I will be happy to assist you.
I will always assist anyone with writing conditions, filters or Enscripts where applicable if I am able to. From my personal experience with Encase I have come up with different ways of doing things and will write about those in future posts. I do not think there is any tool that is the one and only tool. I believe Encase is one of many tools a forensic examiner has in his tool box and must use other tools to verify or retrieve the information needed to solve the case.
I hope you enjoy this blog and if you ever have questions or comments please let me know.