Keyboard cops

I'm a sucker for true-crime shows. Maybe it comes from being a former police reporter, but believe me, Court TV would love to clone me to boost its ratings.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

So I was very interested to speak with Guidance Software about the latest version of its EnCase software, which has been used for years by law enforcement and legal eagles doing computer investigations.

Guidance is interesting not just for what it does -- making computer forensics software -- but also for its customers, who tend to be law enforcement officials, the Secret Service, the FBI, and the like. I'm sure Chloe on 24 uses it religiously.

The new version of EnCase, though, is designed not just for Officer Friendly and other assorted shamuses and gumshoes but for IT managers as well. EnCase Enterprise Version 5 brings together computer forensics, incident response, and electronic discovery techniques in one package.

There's a good reason for that. According to John Colbert, president and CEO of Guidance Software, the new version is aimed at enterprise security professionals because they often need the same tools Johnny Law and James Bond have used for years.

"We find a lot of companies have created separate groups that are in charge of preventing intrusions, dealing with patch updates, and investigations. That often leads to companies being slow to react to security problems. With this product, we're trying to bridge that gap," Colbert said.

For instance, EnCase Version 5 can be integrated with existing security infrastructures to provide some real-time automated incident response. Alerts generated by monitoring technologies such as IDSes and SIMs (security information managers) will trigger automated responses by EnCase that "increases the speed with which security professionals can react to problems. And they need that speed," Colbert added.

At the recent Techno Security/CEIC 2005 conference, Colbert made a speech about that very subject: the increasing convergence in IT security between computer forensics, incident response, and electronic discovery.

Plenty of other parties agree on its importance, too. A recent report from the Secret Service and the CERT Coordination Center of Carnegie Mellon University recommended that corporations retain the services of consumer forensics specialists to maintain the integrity of electronic evidence that might be used in litigation. (Litigation is so much less interesting than criminal investigation. But that's the real world.)

As a side note, at the conference Guidance awarded the first annual Timothy Fidel Memorial Award in honor of the late Timothy Fidel, a special agent at the Secret Service who was best known for his efforts to modernize computer forensic standards.

The Timothy Fidel Memorial Award will be awarded annually to recognize excellence in the field of computer forensics. The inaugural award went to Modesto and Sacramento Valley High Tech Crimes Task Force law enforcement officials involved in the Laci Peterson investigation and to the Missouri State Highway Patrol law enforcement teams involved in the Bobbie Jo Stinnett investigation.