EnCase® Portable

EnCase Portable is a powerful solution, that allows forensic professionals and non-experts alike to quickly and easily triage and collect vital data in a forensically sound and court-proven manner. You’ll close cases faster and reduce your case backlog by focusing on analyzing potential evidence, not searching through data.

Save Time and Money with EnCase Portable

  • Scan for evidence without having to call in specialists or seize computers
  • Remotely perform forensically sound collection of data from any computer with a USB port at any organizational or search location
  • Immediately access critical information
  • Reduce backlog by allowing non-experts to perform forensically sound triage and collection
  • Pre-screened evidence reduces data, allowing forensic experts to work more efficiently
  • Create pre-configured data-collection jobs for non-experts, then return to experts for analysis


Equip forensic experts and non-experts alike with EnCase Portable and they’ll be able to quickly review information stored on a computer in the field, in real time, without altering or damaging the information in any way.

Even non-expert team members can plug in the EnCase Portable device and:

  • Execute pre-configured triage searches
  • Browse pictures
  • View internet history
  • See who has been using a computer

Expert team members can also run new triage searches in the field.


When you need to perform forensically sound collection from a device or devices at a remote location, there’s no longer any need to put a specialist on a plane. With EnCase® Portable, you can empower any trusted staffer to become an extension of a computer forensics, incident response, or e-discovery team.

Use the collection capabilities of EnCase Portable to:

  • Create an exact copy of a computer’s entire hard drive
  • Perform a targeted search based on criteria required for a specific situation
  • Collect an exact copy of a computer’s memory

Ease of use
Pre-configure collection jobs and send devices to remote employees.

Plug in and run job
EP identifies and collects all data relevant to the search, preserving even metadata relevant to the files. Once completed, the employee can send data back to your team.

Configure job based on:

  • File type
  • Hash value
  • Size
  • Date(s)
  • More

With ability to target specific files, your team can avoid overcollecting data if complete exact copy of hard drive needed, pros can configure the job to create:

  • A full physical copy of a hard drive
  • Logical image
  • Remote employee's choice

Manage all Portable devices from one, easy interface. You can:

  • Create new jobs
  • Edit existing jobs
  • Import collected evidence
  • Analyze evidence
  • Refresh EnCase Portable devices

Core Capabilities

  • Instantly view images on the target machine
  • Review documents in real-time
  • Collect only relevant information quickly

Customizable Job Creation
  • Use keywords, metadata, hash values, and other criteria to perform targeted triage and collection
  • Memory acquisition
  • Full disk imaging

Multiple Configurations
  • Easy Mode: Pre-configured by experts
  • Advanced Mode: Instantly create and edit configurations of EnCase Portable in the Field


Increase Your Reach
Extend the reach of your investigation, e-discovery, incident response, or IT teams without sending experts into the field. Based on the situation, EnCase Portable can be used in Easy Mode for non-experts, or Advanced Mode to create and edit configurations in the field.

Triage and Collect with Forensically Sound Results
Triage and collect while preserving metadata and maintaining evidence integrity. Collected data is preserved in the court-accepted EnCase® evidence file format; the most trusted format in the forensics community.

Perform Fast, Powerful Triage
Instantly and easily view images, documents, and other digital evidence found on a target computer.

Customize Collection Configuration
Use keywords, metadata, hash values, and other criteria to perform targeted collection, as well as full-disk imaging and memory acquisition.

Trust Your Results
The powerful and effective features of EnCase® Portable--combined with the processing, analytic, and reporting capabilities of EnCase® Forensic, EnCase® eDiscovery, and EnCase® Enterprise—have made EnCase® solutions the trusted standard in corporate, legal, and criminal investigation. No other technology offers the same degree of functionality, acceptance, and performance.

Digital Investigations Overview

Download Now

More Efficient Investigations with EnCase Forensic 8

Watch Webinar

What's New in EnCase Forensic 8

Download Now

Tinley Park Police Solve the "Craigslist Killer" Case Using EnCase Forensics

Download Case Study

Request Quote