Belkasoft Evidence Center X (Belkasoft X), is Belkasoft's new flagship product for digital forensics and incident investigations.

Version 1.9 features the following exciting improvements: two new Android acquisition methods, namely Android Screen Capture and Android Advanced ADB; support for encrypted ADB backups, more APK downgrade improvements as well as iOS agent-based acquisition fixes for iOS v.11.2.*, support for Belkasoft T images analysis, a number of new and updated artifacts for iOS, Android, macOS and Windows.

Upgrading from previous versions of Belkasoft X to version 1.9 is free to all customers with a non-expired Software Maintenance and Support (SMS) contract. Customers without a current contract can purchase it from the Customer Portal.

Customers with a valid Belkasoft Evidence Center (version 9.9 and below) SMS, can upgrade with discounts: please contact sales@belkasoft.com for your upgrade quote. Do not forget that BEC support expires Nov 1, 2021.

You can also purchase affordable training with optional certification. A new on-demand training course has recently been made available.

More on new features

Mobile acquisition

• New Android acquisition method: automated screen capture. With the help of this method, Belkasoft X has the ability to capture screenshots of various popular applications installed on a device. Currently there are three apps supported: Signal, Telegram and WhatsApp. You can take screenshots of chat threads and call lists. There is an option available to you for specifying how many pages to capture, useful for large chat or call histories
• New Android acquisition method: Android Advanced ADB backup. The new method is a combination of all available methods powered by ADB into a single task. It first starts with an agent-based acquisition, then runs an APK downgrade with full ADB backup creation and extraction of data from Shared Folder
• Support for encrypted Android ADB backups. Now you can create such backups, ingest them into a Belkasoft X case, and analyze
• More Android APK downgrade method improvements
  • Particularly, there are more options for you to recover apps in case of previously failed APK downgrade attempts
  • APK downgrade is now available for apps using Dual Messenger function on Samsung devices
• Support for automatic start of an ADB backup. Belkasoft X v.1.9 can automatically confirm start of such backup on a device. If the device is configured to allow only encrypted backups, Belkasoft X will automatically enter password '12345'
• iOS agent-based acquisition improved for iOS versions 11.2-11.2.6

Integration

• Belkasoft X can ingest and analyze images created by our new Belkasoft Triage (Belkasoft T) product

User interface

• You can now enter a decryption key for the ChatSecure application manually

New and updated artifacts

• Android
  • Brosix (updated)
  • Chaatz (updated)
  • ChatON (updated)
  • Gmail (updated)
  • LinkedIn (updated)
  • Pinterest (updated)
  • Slack (updated)
  • Skype (updated)
  • Telegram: now Belkasoft X can extract Telegram attachments from an image created with APK Downgrade method
  • Tox (updated)
  • WhatsApp
    • Now Belkasoft X can extract WhatsApp attachments from an image created with APK Downgrade method
    • Belkasoft X can automatically decrypt WhatsApp backups from an image created with APK Downgrade method
• iOS
  • Apple mail (updated)
  • Garmin app (new)
  • Gmail (updated)
  • GroupMe (updated)
  • LinkedIn (updated)
  • Notes (updated)
  • Vipole (updated)
• macOS
  • Messages (updated)
  • Fire (updated)
• Windows
  • Chrome
    • Browser history snapshots analysis added
    • Unallocated SQLite records extracted

Issues fixed

• Search inside HexViewer improved on huge volumes of data (e.g. entire data source)
• Fixed: File System tab cannot be reopened after it was closed
• Fixed: Creating a report does not start if run from the Structure tab
• Fixed: Not possible to enter a password for an encrypted Android ADB backup (Huawei phones)
• Fixed: Face grouping is not started for data sources which are folders or mobile images
• Dozens of other issues fixed