What's new in version 7.3 of Belkasoft Evidence Center

What's New in Version 7.3

Version 7.3 comes with major carving improvements, fully reworked Search Results window, and a pack of performance and usability improvements. SQLite Viewer now works quickly even with huge databases, supports various type conversions and deep unallocated space analysis. The product now supports Cellebrite’s Link Analysis integration and has hundreds of other enhancements.

Upgrading to version 7.3 is free of charge to all customers with non-expired Extended Software Maintenance and Support contracts. File System and RAM Process Explorer modules can be purchased separately.

Customers without the contract can purchase it from the Customer Portal. Affordable User Refresher Course is available for those who would like to catch up all recent improvements.

New features in v.7.3 of Belkasoft Evidence Center

File System

$FreeSpace: you can now carve only unused space in allocated, thus significantly decreasing carving time

Mobile devices

iOS (iPhone, iPad):
- New iOS applications supported: Kakao Talk, OneDrive, Standard Mail app, Meow Chat
- SMS can now be carved
Android:
- New Android applications supported: Badoo, OneDrive, Google Drive, Brosix
- Calls for Viber are now extracted

User interface

After selecting a data source you can then select what to analyze inside: logical drive, partitions, unallocated and/or freespace, what saves you a lot of time
User interface responsiveness is significantly improved
Per our customers' requests we returned list view for pictures, so that you now have both Gallery view and Details view
Case Explorer now conveniently shows partitions and volumes
Task Manager window shows statistics on how many tasks are visible and selected
Add datasource window now has "Add another datasource" button. While the possibility to add multiple datasources to a case was available before, some of our customers did not know about it. To make this possibility more explicit, the new button is introduced, helping to add multiple datasources at a time

Search

Search performance is massively improved
Size of search index greatly decreased
Search Results window is fully reworked:

Each search attempt results in a separate Search Results window, so that you can navigate between different search results
Search history is now saved
You can filter search results by multiple criteria
There is a possibility to select multiple predefined searches
When searching for multiple search terms, the product shows how many results found for each particular one
After re-opening a case you can run saved search again with just a single click
Sorting is supported in the Search Results window
Search inside Search Results is now available
In order to add results to a report, Search Results window offers convenient checkboxes

In general, Search became much more robust and convenient

SQLite

Even with v.7.2 we heard from our customers that "Belkasoft support for SQLite is the best worldwide", but v.7.3 raises the bar to a new level:

Performance massively improved
Huge databases are now opened in a blink of an eye
Database table structure is now shown
You can convert selected column values to multiple data types, such as various timestamps, integer and floating values, string types etc.
Selected column type is remembered and used in a report, which you can run directly from the SQLite Viewer

Reporting and exporting

Geolocation data can be exported to KML format
Evidence Reader license never expires
Cellebrite Link Analysis integration supported via Export to UFDR format (Instant Messengers only)

System files

More info extracted about plugged USB devices

Performance

Registry analysis performance is massively improved
Predefined searches performance is massively improved
Browser analysis performance is massively improved (especially for Chrome browser)
General performance improved: more effective usage of computer's cores

Instant Messengers

OneDrive support improved
Skype picture transfers is now supported, if sent picture is still available, it is added to "Pictures" node of the Case Explorer
Skype contact extraction is improved: contacts, stored in Skype database as a result of people search are not shown

Smaller improvements

Searching of "The Bat!" email profiles improved
PList validation improved
Deleting of cases and profiles is improved
Carving improved: sizes of carved JPG and PNG are now much smaller
Video keyframe extraction is now off by default. This is now an option, which you can switch on or off. You can extract keyframes for individual video or selected videos manually. Switching keyframe extraction off makes your initial analysis much faster
Mounting under Windows 8 became faster and better. If you experience issues with standard mounting, powered by third-party "imdisk" tool, you can switch it off in Options

Important! Cases stored with v.7.2 won't open by v.7.3. Please keep using v.7.2 or Evidence Reader to access older cases. We recommend installing v.7.3 to a separate folder in case you are going to work with legacy cases. Alternatively, you can re-analyze datasources used in older cases with the new version.

What's New in Version 7.3

New features in v.7.3 of Belkasoft Evidence Center

See also: