Guidance Software

Guidance Software, Inc. was an American software company focused on digital forensics, cybersecurity investigations, endpoint analysis, incident response, and electronic discovery. Founded in 1997 by Shawn McCreight and headquartered in Pasadena, California, the company developed tools intended to help investigators acquire, preserve, search, analyze, and present information stored on computers, mobile or removable media, and other digital systems. Its best-known product was EnCase, a digital investigation platform used by law-enforcement agencies, government organizations, corporate security teams, legal professionals, and specialist forensic examiners. The company operated across several related markets. Its digital-forensics products supported the examination of hard drives, disks, files, deleted material, system artifacts, and metadata. Its endpoint-security and analytics capabilities were directed toward identifying suspicious activity and investigating compromised machines. Guidance Software also supplied tools and services for cybersecurity incident response and e-discovery, allowing organizations to investigate security events, internal misconduct, litigation-related data, and regulatory matters. In addition to software licenses, its business included professional services, training, maintenance, and certification programs for practitioners using the EnCase technology. Guidance Software served a broad institutional customer base. Its customers and users included law-enforcement and government agencies, as well as organizations in financial services, insurance, technology, defense contracting, telecommunications, pharmaceuticals, healthcare, manufacturing, and retail. The company maintained an international presence through offices and operations in locations including Brazil, Chicago, Houston, New York, San Francisco, Singapore, the United Kingdom, and Washington, D.C., while serving customers across Europe, the Middle East, Africa, and the Asia-Pacific region. Wikipedia described the company as having approximately 371 employees before its acquisition. EnCase became particularly visible through its reported use in high-profile criminal investigations and trials. It was cited in the examination of digital evidence in the David Westerfield, Scott Peterson, Dennis Rader, and Casey Anthony cases. French authorities also reportedly used the software while investigating digital evidence associated with Richard Colvin Reid. These references helped associate the Guidance Software brand with courtroom-grade digital evidence handling, although the company’s commercial business extended well beyond criminal investigations. Guidance Software expanded its portfolio through acquisitions. In May 2010 it completed the acquisition of Tableau, LLC, a company associated with forensic hardware and acquisition tools. In February 2012 it acquired CaseCentral, strengthening its position in hosted or managed e-discovery and related legal-data workflows. These transactions complemented the company’s core forensic platform and broadened its presence in enterprise investigations. On September 14, 2017, OpenText acquired Guidance Software. Following the transaction, Guidance Software ceased operating as an independent public company and its technologies and offerings were incorporated into OpenText’s broader information-management and security portfolio. The Guidance Software corporate identity is therefore primarily historical, while EnCase and related capabilities became associated with OpenText after the acquisition.

Guidance Software emerged in 1997 as a specialist American technology company dedicated to the growing field of digital forensics. Its central proposition was that electronic evidence required purpose-built methods for acquisition, preservation, examination, and presentation. As personal computers, enterprise networks, removable media, and digital communications became increasingly important to criminal investigations, litigation, and corporate security, the company developed software intended to make those investigations repeatable and defensible. The company’s principal platform was EnCase. The software became associated with forensic examination of computer storage and digital artifacts, including deleted or hidden material, file-system information, system metadata, and user activity. Its customer base extended from police and government agencies to corporations facing security incidents, internal investigations, regulatory inquiries, and litigation discovery. Guidance Software organized its commercial activity around digital forensics, endpoint security analytics, cybersecurity incident response, and e-discovery. It also generated revenue through professional services, training, maintenance, and specialist certification programs, including the EnCase Certified Examiner and EnCase Certified eDiscovery Practitioner designations. Guidance Software’s public profile was strengthened by references to EnCase in several prominent investigations and trials. In 2002, the software was reportedly used in the David Westerfield case and by French police investigating digital evidence connected with Richard Colvin Reid. In 2004, forensic examination using EnCase was cited in the Scott Peterson trial. In 2005, investigators used metadata recovered from a floppy disk sent by Dennis Rader, the BTK killer, to connect the document to him; reporting associated this examination with EnCase. The product was also cited in the Casey Anthony investigation in 2011. These cases illustrated the role of digital evidence in modern investigations and reinforced the company’s reputation among forensic practitioners. The company expanded beyond its original software base through acquisitions. In May 2010 it acquired Tableau, LLC, broadening its forensic acquisition and examination capabilities. In February 2012 it acquired CaseCentral, adding or strengthening e-discovery capabilities for enterprise and legal workflows. Guidance Software also participated in incident-response work surrounding major security events. In 2011, Sony identified Guidance Software among the organizations assisting with the response to breaches affecting Sony Online Entertainment. Reporting that same year linked EnCase to the analysis of digital devices recovered from Osama bin Laden’s compound, though that account was based on an inferred tool selection rather than a direct public confirmation. Before its acquisition, Guidance Software maintained offices in the United States, Brazil, Singapore, and the United Kingdom and served customers across Europe, the Middle East, Africa, and the Asia-Pacific region. Wikipedia described the company as employing approximately 371 people. Its market identity was that of a focused digital-investigation specialist rather than a broad consumer-security brand. On September 14, 2017, OpenText acquired Guidance Software. The acquisition ended the company’s independent corporate existence and transferred its products, expertise, and customer relationships into OpenText. Guidance Software is consequently best understood as a historical cybersecurity and digital-forensics brand, with EnCase representing its principal legacy offering.

1. 2017OpenText acquisition

   OpenText acquired Guidance Software on September 14, 2017.

   Source
2. 2012CaseCentral acquisition completed

   Guidance Software acquired CaseCentral, expanding its e-discovery capabilities.

   Source
3. 2011EnCase associated with major incident and investigation work

   Guidance Software was named among organizations assisting Sony’s breach response, while EnCase was also cited in reporting about analysis of material recovered from Osama bin Laden’s compound and in the Casey Anthony investigation.

   Source
4. 2010Tableau acquisition completed

   Guidance Software completed its acquisition of Tableau, LLC.

   Source
5. 2005Metadata evidence linked to the BTK killer

   Investigators recovered document metadata from a floppy disk sent by Dennis Rader, with the examination reported in connection with EnCase.

   Source
6. 2004EnCase cited in the Scott Peterson trial

   Computer forensic examination using EnCase was reported as part of the digital-evidence work in the Scott Peterson case.

   Source
7. 2002EnCase appears in high-profile investigations

   EnCase was reported in connection with the David Westerfield investigation and a French investigation involving Richard Colvin Reid.

   Source
8. 1997Guidance Software founded

   Shawn McCreight founded Guidance Software in the United States as a digital-forensics software company.

   Source

A specialist provider of enterprise and law-enforcement digital investigation technology, positioned around defensible evidence collection, forensic analysis, incident response, and e-discovery.

• EnCaseDigital forensics and investigations

  EnCase was Guidance Software’s flagship digital-investigation platform. It was designed for the forensic acquisition and examination of digital evidence, including computer storage, removable media, files, deleted material, system artifacts, and metadata. The platform was used by law-enforcement and government investigators as well as corporate security, legal, and incident-response teams. Its reported use in criminal investigations and trials helped establish the product as one of the company’s most recognizable offerings.

• Tableau forensic productsForensic acquisition hardware and software

  Guidance Software obtained Tableau, LLC in 2010. The acquisition broadened the company’s digital-forensics portfolio with technology associated with the acquisition and examination of digital storage evidence. The Tableau business complemented EnCase by addressing the evidence-collection stage of forensic workflows.

• CaseCentralElectronic discovery

  CaseCentral became part of Guidance Software through the company’s February 2012 acquisition. It strengthened the company’s presence in e-discovery and enterprise legal-data workflows, extending its scope beyond traditional computer-forensics investigations.

• EnCase Certified ExaminerProfessional certification

  The EnCase Certified Examiner, or EnCE, was one of Guidance Software’s professional certification programs. It supported training and credentialing for practitioners working with EnCase-based digital-forensics investigations.

• EnCase Certified eDiscovery PractitionerProfessional certification

  The EnCase Certified eDiscovery Practitioner, or EnCEP, was a certification program associated with Guidance Software’s e-discovery offerings. It was intended for practitioners involved in electronic-discovery processes using the company’s technology.

• 2017Accept OpenText acquisitionM&A

  Guidance Software was a specialist digital-forensics and cybersecurity company operating in markets complementary to OpenText’s information-management portfolio.

  What changed. OpenText acquired Guidance Software on September 14, 2017.

  Aftermath. Guidance Software ceased operating as an independent company, and its technology was incorporated into OpenText.

  Source
• 2012Acquire CaseCentralM&A

  Guidance Software was expanding from traditional digital forensics into enterprise e-discovery.

  What changed. The company acquired CaseCentral in February 2012.

  Aftermath. The acquisition strengthened Guidance Software’s e-discovery and legal-data capabilities.

  Source
• 2010Acquire Tableau, LLCM&A

  Guidance Software sought to broaden its digital-forensics portfolio beyond its core investigation platform.

  What changed. The company completed the acquisition of Tableau, LLC in May 2010.

  Aftermath. The transaction expanded the company’s forensic acquisition and evidence-handling capabilities.

  Source

• 2017OpenText acquires Guidance Software

  OpenText acquired Guidance Software on September 14, ending Guidance Software’s existence as an independent company and bringing its digital-investigation technology into the OpenText portfolio.

  M&A
  Source
• 2012Guidance Software acquires CaseCentral

  Guidance Software acquired CaseCentral, broadening its capabilities in electronic discovery and related enterprise investigations.

  M&A
  Source
• 2011Guidance Software supports response to Sony Online Entertainment breaches

  Sony said it would work with Data Forté, Guidance Software, and Protiviti in addressing the forensic and security implications of breaches affecting Sony Online Entertainment.

  Other
  Source
• 2011EnCase reportedly selected for analysis of material recovered from Osama bin Laden’s compound

  Following the raid on Osama bin Laden’s compound, reporting linked EnCase to the forensic analysis of computers, storage devices, and optical media recovered by the assault team, although the selection was inferred from a supporting job description.

  Other
  Source
• 2011EnCase cited in the Casey Anthony investigation

  EnCase was reportedly used to examine computers and digital cameras during the Casey Anthony investigation, including searches for references to chloroform.

  Other
  Source
• 2010Guidance Software completes acquisition of Tableau, LLC

  The company completed its acquisition of Tableau, LLC, expanding its digital-forensics product portfolio.

  M&A
  Source
• 2005Metadata analysis helps identify the BTK killer

  Investigators reportedly used EnCase to recover metadata from a deleted document on a floppy disk sent by Dennis Rader, helping connect the material to him.

  Other
  Source
• 2004EnCase evidence cited in the Scott Peterson trial

  Digital forensic experts reportedly used EnCase to examine five hard drives in the Scott Peterson case, identifying online searches, purchases, and other computer activity presented as investigative evidence.

  Other
  Source
• 2002EnCase cited in the David Westerfield investigation

  EnCase was reported as having been used to examine computers and disks in the David Westerfield murder trial, including evidence associated with child pornography.

  Other
  Source
• 2002EnCase used in investigation involving Richard Colvin Reid

  French police reportedly used EnCase to uncover email evidence in the investigation of Richard Colvin Reid, later convicted in connection with a shoe-bombing attempt.

  Other
  Source

1. Guidance Software
2. Guidance Software official website