What's new in BEC v.8.0

What's New in Version 8.0

Version 8.0 of the world's leading digital forensic tool Belkasoft Evidence Center offers new acquisition capabilities, social communication graph analysis, in-depth Volume Shadow Copy support and a pack of new apps and formats.

Sign up for a webinar on BEC 2017!

Upgrading to version 8.0 is free of charge to all customers with non-expired Extended Software Maintenance and Support contracts. File System module can be purchased separately.

Customers without the contract can purchase it from the Customer Portal. Affordable User Refresher Course is available for those who would like to catch up all recent improvements. Sign up for a free webinar to learn more on BEC 2017.

Below you can find major changes in the new version.

Major new functions of the product

New acquisition module. In v.8.0 of BEC the product allows you to acquire a hard or removable drive, make a logical image of Android or Apple device (including iOS 10), download iCloud and Google cloud and add all these types of acquired images to the BEC case for further analysis
New free acquisition tool – Belkasoft Acquisition Tool (or BelkaImager)
Analysis of social communications with Social Graph Builder module. New Connection Graph window visualizes entities and contacts, finds communities, shows communications for a selected link and so on
In-depth Volume Shadow Copy support. The new version of BEC can analyze even volumes with a massive amount of snapshots. You can select one or multiple snapshots to analyze. File System Explorer allows to browse snapshots' directory structure and review files belonging to a selected snapshot, in Hex Viewer window
Alpha version of x64 build of BEC (Available for EAP users only)
As usual, each new BEC version comes with hundreds of new or updated artifact formats. See below for more detailed information.

Mobile App Support

Android Facebook extraction improved
ooVoo, Tinder iOS analysis updated
New apps: Uber for iOS, Pokemon Go iOS, Pokemon Go for Android
BEC can now analyze encrypted iTunes backup without a password and get installed applications

User Interface

Property page for iOS and Android backups shows more information on devices
Item lists improved: Any metadata property can be shown as a column in Picture List, Document List and other lists
All thumbnails are now shown in a single profile (previous version shown every thumbnail file as a separate profile)
Better visualization of geolocation data on Google Maps using clustering
"Reset to default view" menu added which returns BEC windows back to default
When you click inside Case Explorer, File System Explorer or Connection Graph, corresponding item list is shown at the right
A number of tested passwords is now shown in the ongoing decryption task status
Filters updated, new convenient filters added

SQLite Analysis

SQLite journal analysis improved, what made analysis of all SQLite-based artifacts quicker and more robust

Chat Support

Jabber support updated
Extraction of Skype message attachments made much quicker

System File Support

Windows 10 jumplists analysis updated
Network connection extraction supported for iOS and Android
Visualization of values in Registry Viewer fixed
Added support of last plug/unplug date for USB devices

Browser Support

Top Sites extraction supported
Web sessions extraction supported
Google Analytics extraction supported
Browser's Tab extraction supported

Email Support

OLE attachments supported for Outlook
Analysis of Gmail Offline updated

Issues Fixed

Proper visualization of negative values in SQLite Viewer
Incorrect selection inside found item fixed
Export of Skype chatsync to XML and text fixed
Face detection fixed
Missed carved URLs in Overview fixed
Missed Cache tab in Item Properties fixed for browser links having cached data
Origin property added for some artifacts where was missing in previous version
$FreeSpace carving fixed
A number of hashset analysis issues fixed
About 300 other issues fixed