If you've ever worked in digital forensics or cybersecurity, you've probably heard of EnCase. For decades, EnCase has been synonymous with court-admissible digital forensic evidence, endpoint investigation, and forensic precision. It has earned a reputation as an industry standard, used by law enforcement, enterprises, and investigative firms around the world.

So, where did it go?

Short answer: It didn’t go anywhere. It evolved. The heart ofEnCase is still very much alive, just under new names. The trusted capabilities you relied on in EnCase now live on in OpenText’s next generation DFIR portfolio.

Why the name change?

Following a company-wide rebranding initiative across all our product portfolios, OpenText retired the EnCase brand name. While we put the EnCase name on the shelf, the technology lives on through a broader, integrated suite of digital forensics and incident response (DFIR) solutions.

We get it. The name EnCase still carries weight in the industry. That’s why it’s important to say it loud and clear:

• EnCase lives on in OpenText™ Endpoint Investigator for corporate-wide digital forensics, and in OpenText™ Forensic for forensic investigations in public safety and desktop environments.
• EnCase technology is the basis for many of the capabilities in the new OpenText™ Endpoint Forensics & Response, delivering full-scale enterprise digital forensics and incident response.

Not only has the name changed, but the series of products previously known as EnCase now delivers more power, scale, and automation than ever before.

What’s new (and better) since EnCase

OpenText Endpoint Investigator, and now the new OpenText Endpoint Forensic & Response, builds on EnCase’s trusted legacy while introducing advanced response capabilities. We built both on the same trusted forensic engine that made EnCase a staple in global investigations. However, they’ve grown significantly with steady innovation to meet the needs of today’s enterprise organizations while strengthening the forensic foundation on which forensic teams have come to rely. For example:

Enterprise-Scale Investigations - while EnCase supported powerful forensic analysis, today's enterprises need to operate at a massive scale. OpenText Endpoint Investigator supports forensic-grade data collection across more than one million endpoints,both on and off the network.

Remote and Real-Time Response - OpenText Endpoint Forensics & Response introduces live response capabilities, including the ability to isolate endpoints, kill malicious processes, remediate registry keys, and delete files, all without leaving the forensic interface.

Multi-User Collaboration - remember when EnCase was single-user? Those days are over. OpenText enterprise solutions now support multi-user, web-based interfaces, so teams can collaborate in real time on cases.

Mobile and Cloud Coverage - with support for over 36,000 mobile device profiles, plus forensic acquisition from platforms like Office 365, OpenText tools provide visibility far beyond the hard drive.

Automation - modern forensic workflows now include artifact-based triage, helping investigators automatically organize artifacts into easily identifiable categories and quickly extract relevant information. The platform enhancements also include support for a full suite of RESTful APIs, which automates the integration of EnCase-based products with other software platforms, helping SOC teams move faster with less effort.

EnCase by any other name: still winning cases

Digital Discovery, a forensic investigations firm, still uses EnCase as a foundation for its work. “OpenText EnCase has always been the gold standard,” said Steve Davis, Director of Business Development. “Absent that, I don’t think we could do our job in an effective and defensible manner.”

And one of the largest banks in the US turns to EnCase because “it is hands down the best digital forensics tool I’ve used. Its accuracy, depth of analysis, and dependable performance make it a solid 5-star platform.”

The name may have been retired, but it’s still the technology people consider a badge of forensic credibility.

• Legacy and industry recognition: EnCase remains one of the earliest and most widely referenced forensic tools in digital investigations, with a long history dating back to the late 1990s and continued mention in educational resources and forensic tool guides.
• Training and certification: While the EnCase name is no longer extensively used, the EnCase Certified Examiner (EnCE) certification is still widely recognized, as the skills, methodologies, and credibility associated with EnCE remain just as relevant in legal, regulatory, and operational contexts as always. Hiring managers and investigators still associate it with sound methodology, evidence handling, and defensibility. The EnCase certification validates that core competencies don’t go out of date, even as tools and attack techniques change. In regulated environments and legal proceedings, the EnCase certification carries weight as proof of formal forensic training, not just tool familiarity.

EnCase is evolving, not ending

EnCase hasn’t disappeared. It has evolved into OpenText Endpoint Investigator, a core component of the OpenText DFIR portfolio. This evolution demonstrates our commitment to staying ahead of modern threats, scaling for global enterprises, and preserving the integrity, defensibility, and investigative power that made EnCase an industry leader. The latest addition to our portfolio, OpenText Endpoint Forensic & Response, builds on EnCase’s trusted legacy while introducing advanced response capabilities relied upon by today’s most sophisticated DFIR teams.

Whether you're responding to a breach, conducting an insider investigation, or gathering data for a compliance audit, OpenText is ready to help you solve your most challenging digital forensics and incident response challenges. For more information, contact us at OpenText DFIR.

The post What happened to EnCase? appeared first on OpenText Blogs.