What's new in version 6.0 of Belkasoft Evidence Center

What's New in Version 6.0

Version 6.0 of Belkasoft Evidence Center 2014 is a major update adding a number of powerful features over the previous version. To name a few, Evidence Center 6.0 analyzes Android backups and UFED dumps, introduces a graphical timeline, offers Registry carving and viewing, implements a set of new reporting formats, and investigates the content of many popular virtual machines. In addition, Evidence Center 6.0 gets more affordable by introducing two new editions priced from $199.

Free upgrade to version 6.0 is available to all users having a non-expired Extended Software Maintenance and Support contract. If you don't have such a contract yet, you can purchase it from the Customer Portal.

Belkasoft Evidence Center 6.0

Android backup support. In addition to iPhone, iPad and Blackberry backups, the product now supports the analysis of Android backup files, extracting dozens of artifacts such as calls, messages, contacts and histories of various applications (e.g. Facebook, ICQ and so on).
Android dump support. Evidence Center v.6 is now capable to carve Android dumps made with UFED.
Graphical timeline. The new version displays an aggregated view of all events in a handy graphical chart. You can locate events and zoom to a period of interest, and all selected events will be automatically synchronized with the text-based timeline, allowing you to narrow your search. The synchronization between text-based and graphical timeline is two-way, which, in particular, enables you to filter data in the text-based timeline and view only events of the requested type in the graphical timeline.
BelkaCarving™ extenstion. This unique analysis feature that no competitor has at this moment allows Evidence Center to defragment information contained in Live RAM dumps. With version 6.0, we extended BelkasCarving support to Linux 32, 64 bit and PAE RAM dumps, Android and Windows 7 PAE.
AFF image mounting. The popular Advanced Forensic Format is now supported by Evidence Center and can be mounted.
Virtual machine support. Evidence Center can mount and analyze evidence in popular virtual machines such as VMWare (dynamic, static and multi-part static drives) and Virtual PC (VDI format).
Reporting. We have completely redesigned this part of the product. This made Evidence Center much more robust on large histories (getting rid of Out of memory issues). We also added a number of new target formats such as DOCX, XLSX and RTF, improved reporting layout and many more.
Registry analysis and carving enhancements; built-in Registry viewer. The registry analysis is now implemented in low-level, which helps avoid "insufficient access rights" errors. Registry carving is now supported. Built-in Registry Viewer now supports viewing badly damaged and corrupted registry files, which gives you a benefit over using conventional regedit tool.

Other Improvements

The issue with dd images starting with *.000 is fixed
New report options: orientation (portrain, landscape), date and time formats for different cultures and countries
A number of issues with EML export are fixed
A number of issues with export to Evidence Reader are fixed
QQ 2013 extraction is supported
Skype chatsync carver implemented. Skype chatsync analysis improved
Facebook timeline carving is renewed to the modern Facebook layout
Freelist analysis is improved

New Editions: Lower Prices!

Belkasoft added two new editions to Evidence Center 2014 lineup. The two editions are Chat Analyzer and Chat & Social Analyzer. The first one inherits its feature set from the discontinued Forensic IM Analyzer, and supports Instant Messenger artifact analysis. Compared to the now discontinued edition, Chat Analyzer is made significantly more affordable with the price tag of $199.95 instead of $499.95.

Chat & Social Analyzer adds carving and Live RAM Analysis for Instant Messenger and Social Network artifacts, and costs $499.95. This edition is priced on the same level as Forensic IM Analyzer, yet offers significantly more features compared to the now discontinued edition. Two other editions got shorter names: Evidence Center Pro is now called "Professional" and Forensic Studio Ultimate is now just "Ultimate". Despite huge extension of the functionality, both major editions of the product kept the same price, which has not changed during the last 2 years.