What's new in version 5.3 of Belkasoft Evidence Center

The new release constitutes a major update to our flagship forensic tool. Version 5.3 adds Evidence Reader, an all-new portable tool allowing Belkasoft users to save, view and pass digital evidence to their colleagues and coworkers. Evidence Reader allows accessing evidence collected with Belkasoft Evidence Center from any computer free of charge, even if Belkasoft Evidence Center is not installed on that PC.

Version 5.3 also adds the ability to carve many additional file formats:

Microsoft Word 97-2003
Excel 97-2003
PowerPoint 97-2003
bmp
gif
jpg
png
wmf
Thumbs.db
SQLite databases
MIME-encoded emails.

Many other features, enhancements and improvements are detailed in the list below. Particularly, the multi-threaded core engine now works faster and much more stable than in version 5.2.

We strive to provide the highest quality experience using our products. For this reason, we are offering a free upgrade to version 5.3 to all users of version 5.2 with a valid, non-expired license.

Evidence Reader: a free way to pass along collected evidence

Evidence Reader is the most important addition to the product for a long time. Evidence Reader offers Belkasoft customers an all new way to deal with evidence collected during the session. The Reader allows using any computer, with or without Evidence Center installed, to access and analyze evidence collected with Belkasoft Evidence Center. Evidence Reader is perfect when you need to pass digital evidence along to a colleague or coworker, or need to present raw data in a court.

Evidence Reader greatly enhances the value of the product, particularly for those customers opting for a bare basic license without the Case Management module. The Export for Evidence Reader feature allows saving collected evidence for later analysis even if you don't have the Case Management add-on. Evidence Reader provides read-only access to collected data.

Enhanced file carving

Another major change in the version 5.3 is the ability of Belkasoft Evidence Center Pro, Ultimate and Enterprise to recover deleted data ("carve") in many additional formats including Microsoft Word 97-2003, Excel 97-2003, PowerPoint 97-2003, jpg, bmp, gif, wmf, Thumbs.db, SQLite databases, and MIME-encoded emails. While previously the product was able to work with existing files in these formats only, now it is able to find even deleted or even partially corrupted data.

Faster completion with half-way exporting

Investigators may now complete their work faster by interrupting the scanning process mid-way and exporting incomplete search results. The ability to save half-way results is new to Belkasoft Evidence Center 5.3.

Other Improvements

User-selectable path to store cases. If your system drive is not big, while your case is, you now can assign another folder on another drive to store case data.
The number of discovered artifacts is now displayed in the Case Explorer, e.g. (235), including data in subfolders. This number has changed its meaning for emails: now it represents the number of emails in the selected folder along with all its subfolders.
Reporting by the column allows generating reports with data aligned by the column (in addition to raw lists).
Existing Thumbs.db files discovery and analysis. These files contain small versions of all images in a folder and may contain important evidence. All existing versions of thumbnail files are supported, including the new Windows 8 format.
All video profiles are merged into a single profile, making Case Explorer less cluttered. Before this release, every video file was a single profile in the Case Explorer, which led to hundreds of video profiles. In current release, there is just a single profile, and all the videos are shown in the right-hand list. Keyframes are shown under a special Keyframes subnode of the Video profile node.
Contact selection for Instant Messenger reports. You can now export selected contacts only for IM histories.
For consistency reasons, "images" (meaning "digital pictures") are now referred as "pictures" throughout the user interface.
Improved Facebook analysis: added discovery of json and other fields.
Turkish "İ" problem is solved in reports. Our Turkish customers reported that the product may give incorrect results for items containing the Turkish İ symbol. This is now corrected.
Added Ukrainian language localization.
Solved issues with Chrome extraction.
Supports latest Skype builds.
Skype chat headers now extracted. Though chat headers are not a chat log, we encountered a few cases when they are the only thing not erased from the Skype database. Information from chat headers may give a clue of what was happening with deleted chats.
More info extracted for jumplists.
Multiple improvements to the multi-threaded engine make it work faster and more stable compared to v. 5.2.

With the new developments, the product supports more than 400 artifact types, which is more than any competing product.

The upgrade to version 5.3 is free to all licensed customers using Belkasoft Evidence Center 5.2. Of course, all customers having a valid Extended Support and Maintenance plan are also eligible for this upgrade. In order to download the update, customers will need to login to the Customer Portal.

What's new in version 5.3 of Belkasoft Evidence Center

See also: