Belkasoft Evidence Center 2020 Version 9.9
Product Code: AP-BELK-EVCENTER – Electronic Version (No Dongle. Bound to single computer)
Product Code: AP-BELK-EVCENTER – DONGLE – Dongle Version
All-in-one forensic solution for locating, extracting, and analyzing digital evidence stored inside computers and mobile devices, RAM and cloud.
Trusted by the police around the Globe
Used by thousands forensic experts and police departments from more than 70 countries worldwide
Belkasoft Evidence Center is designed with forensic experts and investigators in mind: it automatically performs multiple tasks without requiring your presence, allowing you to speed up the investigation; at the same time, the product has a convenient interface, making it a powerful, yet easy-to-use tool for data extraction, search, and analysis.
- Fully automated extraction and analysis of 1000+ types of evidence.
- Destroyed and hidden evidence recovery via data carving.
- Live RAM analysis
- Advanced low-level expertise
- Concise and adjustable reports, accepted by courts
- Case Management and a possibility to create a portable case to share with a colleague at no cost
- Remote acquisition of computers, mobiles and RAM
- Incident investigation
- Cross-case search
- TWRP dump mounting and analysis
- Full logical backup of jailbroken iOS devices
- ANN detection for arrow and cross signs on images
- Telegram X decryption
- Decryption of Bitlocker and McAfee Endpoint Security encrypted images
- Multi-partition APFS support
- Massive update of multi-user Team Edition module
- Numerous updates to artifact extraction
Types of evidence supported by Evidence Center
- Office documents
- System files, including Windows 10
- Email clients
- Pictures and videos timeline and TOAST, macOS plists, smartphone Wi-Fi and Bluetooth configurations etc. Mobile application data
- Cryptocurrencies Web browser histories, cookies, cache, passwords, etc.
- Registry files
- Chats and instant messenger histories
- SQLite databases
- Social networks and cloud services
- Peer-to-peer software
- Encrypted files and volumes
- Plist files
Types of analysis performed by Evidence Center
- Existing files search and analysis. Low-level investigation using Hex Viewer.
- Timeline analysis – ability to display and filter all user activities and system events in a single aggregated view.
- Full-text search through all types of collected evidence. Automatic indexing of various important text templates such as emails, phone numbers, MAC and IP addresses etc.
- Data carving and destroyed evidence recovery. Custom carving, including support for Scalpel and FTK sets.
- Live RAM analysis including process extraction and data visualization. Malware detection.
- Hibernation file (hiberfil.sys) and page file (pagefile.sys) analysis.
- Native SQLite analysis with freelist and WAL support.
- Discovers deleted SQLite records, e.g. Skype conversations or WhatsApp messages.
- Picture analysis including EXIF and GPS analysis, face/test/skin tone/forgery detection, pornography detection using neural networks.
- Video key frame extraction.
- Analysis of links between persons using Connection Graph features such as communication visualization and communities detection.
- Encryption detection and decryption of found encrypted files.
- Special files and folders analysis (e.g. Volume Shadow Copy, $OrphanFiles, $MFT etc.)
- Hashset analysis.
- Flexible analysis with BelkaScript, scripting module.
- De-duplication by using PhotoDNA hashing as well as not carving existing files.
Evidence Center works with the following data sources and file systems
- Storage devices – Hard drives and removable media.
- Disk images – EnCase (including Ex01), L01/Lx01, FTK, DD, Smart, X-Ways, Atola, DMG, tar and zip files.
- Mobile devices – Mobile backups, UFED and OFB dumps, chip-off and JTAG dumps.
- Virtual machines – VMWare, Virtual PC, VirtualBox, XenServer.
- Volatile memory – Life RAM dumps; fragmented memory set analysis with BelkaCarvingTM.
- Memory files – Hibernation and page files.
- Unallocated space – Data carving discovers destroyed evidence.
- File systems – APFS, FAT, exFAT, NTFS, HFS, HFS+, ext2, ext3, ext4, YAFFS, YAFFS2.
Evidence Center supports the following acquisition types
- Mobile devices: iTunes backup (iOS), ADB backup or agent-based backup (Android), physical backup or EDL (rooted Android)
- Hard drives: logical and physical drives, available to DD or E01 images with optional hash calculation and verification.
- Clouds: Google Clouds (Google Drive, Google Plus, Google Keep, GMail, Google Timeline), iCloud, EMail (Yahoo, Hotmail, Opera, Yandex, Mac.com and 25 more webmail clouds), Instagram, WhatsApp.
Evidence Center helps investigate the following systems
- Windows (all versions, including
- iOS: iPhone, iPad Windows 10)
- Android macOS
- Windows Phone 8/8.1 Unix-based systems (Linux, FreeBSD, etc.)
- Fully automated extraction and analysis of 1000+ types of evidence
- Destroyed and hidden evidence recovery via data carving
- Live RAM analysis