What's new in version 7.2 of Belkasoft Evidence Center

What's New in Version 7.2

In version 7.2 of Belkasoft Evidence Center 2015 we added a lot of new mobile applications for modern smartphones such as iPhone and Android. JTAG analysis for Windows Phone 8.1 is now available, in addition to previously available analysis of mobile device backups, UFED physical and logical images and binary chip-off dumps.

Besides, Evidence Center v.7.2 comes with a pack of reporting, performance and usability improvements.

Finally, Scripting module is now FREE!

Upgrading to version 7.2 is free of charge to all customers with non-expired Extended Software Maintenance and Support contracts. File System and RAM Process Explorer modules can be purchased separately.

Customers without the contract can purchase it from the Customer Portal. Affordable User Refresher Course is available for those who would like to catch up all recent improvements.

New features in v.7.2 of Belkasoft Evidence Center

Mobile devices

Android:
- New Android applications supported: FireChat, Tango, MeetMe, Im+, Whisper, QIWI wallet, Voxer, Google+, Touch, textPlus, MeowChat, Grindr, ooVoo, Hangouts, CommFort, Tinder, SinaWeibo, Vipole, AIM, Evernote, Growlr, BBM, FireChat, Tango, Foursquare.
- Google Maps analysis for Android improved.
- Telegram analyzer analysis improved.
iOS (iPhone, iPad):
- New iOS applications supported: FireChat , Tango, MeetMe, Im+, ChatOn, ooVoo, Kakao Talk, Viber, Line, PalTalk, Touch, Voicemail, Grindr, Brosix.
Windows Phone 8/81:

JTAG analysis supported.
Particularly, pagefile is automatically analyzed. (Belkasoft became first to support proper Windows Phone pagefile forensic analysis)

With the latest additions, a number of supported mobile artifacts exceeds 100!

SQLite

Analyzing SQLite unallocated space from index pages supported.

File System

Data source (logical disk, hiberfil, pagefile etc) is now shown in HexViewer when selected in the File System window. This particularly allows you to run custom carving right inside Hex Viewer for the whole dump or image!

Reporting

XLSX report redesigned and simplified.
A possibility to create a report from SQLite Viewer was added.
Search Results report improved.
You can now create a report from built-in Google Maps window. Apart from coordinates, altitude and direction, current map view is included to a report as a picture.

User interface

License screen now allows to browse for a license. You do not have to unpack the license to Program Files anymore.
Case root folder added to the "New case" dialog. You can now specify one base folder to store all cases. Case name is added to the root folder path to store particular case.
User interface performance improved for navigation inside Case Explorer when analysis is in progress.
"Add another data source" button to Add Data Source screen. Now you can add all devices and images to investigate at once.

Other

Predefined searches performance improved.
Field name display is improved in Search Results.
Pressing Ctrl-B now adds selected items to a last created (or new) bookmark.
Direction for QIP carved data is now determined.

Issues fixed in v.7.2 of Belkasoft Evidence Center

Mobile devices

Better search for WhatsApp encryption key implemented.
Mail.RU extraction improved.
Date extraction for Android Tinder app fixed.

File System

Single file in File list problem with missing icon and not showing in Hex Viewer fixed.
Fixed "Recursive copy of files and folders" from File System window.

Browsers

Extraction of cookies and cache is fixed for Opera 6.
Update of Firefox cache2 analysis.

Instant Messengers

Artifacts are not extracted for ICQ and Facebook profiles in Pidgin messenger fixed.

Reporting

Failure to create a report for a huge SQLite database fixed.
Failure to create XSLX report for Timeline fixed.

System files

Windows event log analysis improved.

Search

Problem of registry files search fixed.

User interface

Mess between different multiple file profiles (carved and files based) eliminated.
Scrolling in built-in PDF preview fixed.
Duplication of Case Explorer window nodes for $MFT and $LogFile fixed.
Problem with cleared data inside a product window when it was docked to another place fixed.

Image mounting

Some logical UFED images were not working correctly: fixed.
Problems with invalid path symbols during processing of Mac OS X disk images fixed.
Not-terminated filenames in FAT file system fixed.

Other

Performance problems during viewing of yEnc data fixed.
Passware decryption integration fixed.

Hundreds of smaller improvements and bugfixes made.