An international standard supporting automated combination, validation, and analysis of cyber-investigation information


Learn about CASE's parent organization.

Jump Right In

Get into the 1's and 0's right now.

Get In Touch

Interested in contributing or adopting?

Stay Informed

Join the CDO Mailing List for major announcements.

Express & Exchange

Cyber-investigation Analysis Standard Expression (CASE) is a community-developed evolving standard that provides a structured (ontology-based) specification for representing information commonly analyzed and exchanged by people and systems during investigations involving digital evidence. The power of CASE is that it provides a common language to support automated normalization, combination and validation of varied information sources to facilitate analysis and exploration of investigative questions (who, when, how long, where). In addition to representing tool results, CASE ensures that analysis results can be traced back to their source(s), keeping track of when, where and who used which tools to perform investigative actions on data sources.

The purpose of these online resources is to provide a foundation for broader community involvement in defining what to represent and how.

Subscribe to Community Emails