An international standard supporting automated combination, validation, and analysis of cyber-investigation information

Getting Started

New to CASE or ontologies? Start here.

Jump Right In

Get into the 1's and 0's right now.

Get In Touch

We are always looking for more contributors and adopters.

Express & Exchange

Cyber-investigation Analysis Standard Expression (CASE) is a community-developed evolving standard that provides a structured (ontology-based) specification for representing information commonly analyzed and exchanged by people and systems during investigations involving digital evidence. The power of CASE is that it provides a common language to support automated normalization, combination and validation of varied information sources to facilitate analysis and exploration of investigative questions (who, when, how long, where). In addition to representing tool results, CASE ensures that analysis results can be traced back to their source(s), keeping track of when, where and who used which tools to perform investigative actions on data sources.

The purpose of these online resources is to provide a foundation for broader community involvement in defining what to represent and how.

Subscribe to Community Emails