OpenText EnCase Endpoint Investigator

OpenText EnCase Endpoint Investigator


Conduct internal investigations to discover behaviors that put corporate assets at risk


OpenText™ EnCase™ Endpoint Investigator helps businesses find the evidence they need to protect their organization from current and potential illicit activities. EnCase Endpoint Investigator allows digital forensic investigators to discreetly collect and analyze evidence from computers, the cloud and mobile devices.


Why choose OpenText EnCase Endpoint Investigator?


  • Court-accepted evidence format

    Rely on more than 20 years of global acceptance as a secure, court-proven standard for handling, storing, protecting and reporting digital forensic evidence.

  • Popular EnScripts

    Extend the power of EnCase with EnScripts by providing an API that allows investigators to automate common investigative tasks and improve overall efficiency.

How EnCase Endpoint Investigator can benefit business


Discover the advantages of using EnCase Endpoint Investigator.


  • Protect corporate assets

    Leverage powerful analytic capabilities to discover risks to corporate assets and reduce corporate losses.

  • Draw quick, accurate conclusions

    Acquire clear and actionable evidence, both on and off the network, for any type of investigation, from HR and regulatory issues to compliance violations and IP theft.

  • Maximize valuable corporate resources

    Adopt a dynamic, flexible and scalable investigation process to eliminate costs associated with external investigators and business operation disruptions.

  • Simplify comprehensive reports

    Capture and share relevant data in well-structured reports with a powerful and flexible reporting tool.

  • Improve productivity

    Remotely access devices and gain visibility into endpoints to enable discreet investigations and ensure employee productivity.

  • Consolidate global enterprise needs

    Scale investigations and digital evidence collections across thousands of global employees and corporate digital devices.



  • Off-network collection

    Collects data off-network and stores it locally until the device reconnects to the network.

  • Extensive device support

    Gathers evidence from Windows, Mac and Linux endpoints, as well as mobile and other IoT-associated devices to enable comprehensive evidence evaluations.

  • AI and ML support

    Automatically identifies images and videos containing visual threats using artificial intelligence and machine learning capabilities.

  • AFF4 evidence file support

    Utilizes an open standard evidence file format to ingest other evidence file formats and allow for a comprehensive conclusion.

  • Cloud support

    Audits logs and unobtrusively examines employee accounts to acquire and analyze data from corporate cloud resources such as Azure, Teams, O365 or Box.

  • Optical character recognition

    Extracts text evidence buried in PDFs, images, scanned documents and more with OCR technology to include all information as critical evidence in cases.