There was absolutely no slight intended. If you took it that way, I apologize. I don't intend to discredit anyone, and don't get me wrong..Encase is a good tool.

I really question the accuracy of any investigation that occurs over a network. Talk about avenues of data corruption...injected packets in to a forensic investigation..whoa baby..hold on to your hats with that, although I guess it doesn't matter for internal audits.

Do you have to understand the science to be good at anything? With point and click utilities you don't have to be..you can always subpoena an encase programmer to come and explain anything you need.

I do question it becoming overly corporate friendly. While more companies are creating incident response and investigative teams..a lot are just handing it to their admins and saying "here, you are our investigator now". Only the big companies can afford to have specific investigators. I do agree with a need for these teams and people but it's a double edged sword. Technology has a way of degrading as it progresses. It all began with the military, then the corporations get a hold of it, then the home owner gets a hold of it, and by that time...yes any idiot can use it. It's a natural progression(or is that regression ).

I understand forensics as it is, and as it is becoming. The 2 sides of the coin..incident response and "real forensics". Right now, Incident response seems to be driving the field, because first responders need to be able to process machines in a way that protects the evidence in case something serious(crimes) has occured. I certainly hope what the field is quickly becoming does not take away from the "real forensics", because that is the really interesting piece of the industry.