Digital Investigations and Forensics

OpenText EnCase Endpoint Investigator

Conduct internal investigations to discover behaviors that put corporate assets at risk


Discreetly conduct a full investigation without impacting employee productivity

OpenText™ EnCase™ Endpoint Investigator helps businesses find the evidence they need to protect their organization from current and potential illicit activities. EnCase Endpoint Investigator allows digital forensic investigators to discreetly collect and analyze evidence from computers, the cloud and mobile devices.

Why choose OpenText EnCase Endpoint Investigator?

  • Court-accepted evidence format

    Rely on more than 20 years of global acceptance as a secure, court-proven standard for handling, storing, protecting and reporting digital forensic evidence.

  • Popular EnScripts

    Extend the power of EnCase with EnScripts by providing an API that allows investigators to automate common investigative tasks and improve overall efficiency.

How EnCase Endpoint Investigator can benefit business

Discover the advantages of using EnCase Endpoint Investigator.

  • Protect corporate assets

    Leverage powerful analytic capabilities to discover risks to corporate assets and reduce corporate losses.

  • Draw quick, accurate conclusions

    Acquire clear and actionable evidence, both on and off the network, for any type of investigation, from HR and regulatory issues to compliance violations and IP theft.

  • Maximize valuable corporate resources

    Adopt a dynamic, flexible and scalable investigation process to eliminate costs associated with external investigators and business operation disruptions.

  • Simplify comprehensive reports

    Capture and share relevant data in well-structured reports with a powerful and flexible reporting tool.

  • Improve productivity

    Remotely access devices and gain visibility into endpoints to enable discreet investigations and ensure employee productivity.

  • Consolidate global enterprise needs

    Scale investigations and digital evidence collections across thousands of global employees and corporate digital devices.


  • Off-network collection

    Collects data off-network and stores it locally until the device reconnects to the network.

  • Extensive device support

    Gathers evidence from Windows, Mac and Linux endpoints, as well as mobile and other IoT-associated devices to enable comprehensive evidence evaluations.

  • AI and ML support

    Automatically identifies images and videos containing visual threats using artificial intelligence and machine learning capabilities.

  • AFF4 evidence file support

    Utilizes an open standard evidence file format to ingest other evidence file formats and allow for a comprehensive conclusion.

  • Cloud support

    Audits logs and unobtrusively examines employee accounts to acquire and analyze data from corporate cloud resources such as Azure, Teams, O365 or Box.

  • Optical character recognition

    Extracts text evidence buried in PDFs, images, scanned documents and more with OCR technology to include all information as critical evidence in cases.

Read the TAG Cyber position paper

Take advantage of OpenText and partner services


OpenText offers deployment flexibility for Encase Endpoint Investigator.

  • Extend your team
    Off Cloud, on-premises software, managed by your organization or OpenText

Professional Services

OpenText combines end-to-end solution implementation with comprehensive technology services to help improve systems.


OpenText helps customers find the right solution, the right support and the right outcome.


OpenText Learning Services offers comprehensive enablement and learning programs to accelerate knowledge and skills.


Explore our OpenText communities. Connect with individuals and companies to get insight and support. Get involved in the discussion.

Leaders trust OpenText

See how customers are succeeding with EnCase Endpoint Investigator.

See more success stories

Digital Discovery finds the facts hidden in data with forensic investigation technology

Learn more

Banner Health transforms information discovery and security with OpenText EnCase solutions

Learn more

Texas city government accelerates information discovery with OpenText security solution

Learn more

EnCase Endpoint Investigator resources

Collecting evidence from social media accounts

Watch the video

Collecting evidence from Microsoft Teams

Watch the video

Off VPN Remote Collections

Watch the video

What’s new in OpenText EnCase Endpoint Investigator

Read the blog

Enhanced threat detection, investigation & response capabilities

Read the blog

What’s new in OpenText EnCase Endpoint Investigator CE 21.3

Read the blog