What's new in version 3 of Belkasoft Evidence Center
On this page you can view
a presentation with all v.3.0 highlights. Below the presentation you will find a
full text.
New major features
- MacOS support added. The product can now mount HFS and
HFS+ file systems. You can mount both physical drives and drive images like
Encase, SMART and DD. Then you can
extract existing or
carve deleted
Instant Messenger histories. Currently the following MacOS
messengers supported:
- Adium
- AIM
- Brosix
- Fire
- iChat
- ICQ
- InstantBird
- Mail.Ru Agent
- Mercury
- Nimbuzz
- Trillian
- Yahoo! Messenger
- Picture and video support added. You can search and add
existing pictures and videos to a case, explore their properties such as EXIF
properties and do various analysis and operations:
-
Detect porn
-
Detect faces
-
Detect texts
-
See images with GPS coordinates on Google Maps, Google Earth or generate
kml-files for them
-
Key frames extraction for a video
- Powerful filtering facilities added. You can filter pictures
by hordes of various criteria. Both predefined filters available and possibility
to
create your own customized filters.
- Carving options expanded. Now you can not only carve a whole
drive or image, as in previous versions, but also select to carve unallocated
or allocated only.
- Hibernation and pagefile analysis supported. In the new
version you can
analyze both these extremely important files, which may contain remnants
of Live RAM memory stored when a computer was switched off.
Smaller enhancements
- Thunderbird supported. This popular email client stores
its history in not the most pleasant format for investigation. Now you can easily
extract all emails from Thunderbird mailbox into Belkasoft tool.
- A lot of new messengers added:
- Paltalk (LiveRAM)
- Gajim
- emClient
- Nimbuzz
- Qutim
- Gadu-Gadu (old and new versions)
- More than 10 Mac messengers (see above)
- Facebook support improved. Remnants in Internet Explorer
cache can be located and analyzed. The product extracts contacts and chat messages
for such profiles. For Live RAM the product now support both chats and group
chats (previous version did not support group chats)
- Better Gmail support. The product now extracts not only
mails from Live RAM but also unsent draft messages.
- Better Skype group chats extraction.
- Better ICQ 6 and 7 file transfer extraction. Previously
not all available file names were shown, this is fixed now.
- Possibility to tweak the way report looks like. Using
report template designer you can, for example, replace Belkasoft logo with
yours and change color and font design.
- Big The Bat! mailbox analysis. There is no more 1Gb restriction
for analyzed The Bat! mailboxes. You now can analyze The Bat! mailbox of any
size, while previous version of the tool was failing on bigger ones.
- More features included into base configuration. Extraction
of
browser passwords andcache
vizualization, which used to be additional paid features, now included into
the base version.
- Sample files are included to the installation package.
Now you do not have to download separate samples, samples of all types are included:
chats, browsers, emails, pictures, video and network traffic.
- Enhanced installation process. There are 4 predefined packages
which you can download upfront if your target
machine does not have Internet: for English or German Windows, 32 or 64
bit. Other Windows languages are also supported with a little help from a user.
- More clear price structure. All
additional features now
cost the same
price. Easy!
- More convenient registration process:
- No more entering licenses and mistakes in this
- All feature and license information is in a single file features.xml,
which is sent to a customer right after purchase. You just put it in the
product folder and product registers automatically
- As previously, no Internet required for registration
Enjoy using the product!
See also:
Belkasoft Evidence Center 2.0
