What's New in Version 7.3
Version 7.3 comes with major carving improvements, fully reworked Search
Results window, and a pack of performance and usability improvements. SQLite Viewer
now works quickly even with huge databases, supports various
type conversions and deep unallocated space analysis. The product now supports Cellebrite’s
Link Analysis integration and has hundreds of other enhancements.
Upgrading to version 7.3 is free of charge to all customers with non-expired
Extended Software Maintenance and Support contracts.
File System
and RAM Process Explorer modules can be purchased separately.
Customers without the contract can purchase it from the
Customer Portal. Affordable
User Refresher Course is available for those who would like to catch up all recent
improvements.
New features in v.7.3 of Belkasoft Evidence Center
File System
- $FreeSpace: you can now carve only unused space in allocated, thus
significantly decreasing carving time
Mobile devices
- iOS (iPhone, iPad):
- New iOS applications supported: Kakao Talk, OneDrive,
Standard Mail app, Meow Chat
- SMS can now be carved
- Android:
- New Android applications supported: Badoo, OneDrive,
Google Drive, Brosix
- Calls for Viber are now extracted
User interface
- After selecting a data source you can then select what to analyze
inside: logical drive, partitions, unallocated and/or freespace, what saves you a lot of time
- User interface responsiveness is significantly improved
- Per our customers' requests we returned list view for pictures, so
that you now have both Gallery view and Details view
- Case Explorer now conveniently shows partitions and volumes
- Task Manager window shows statistics on how many tasks are visible
and selected
- Add datasource window now has "Add another datasource" button. While
the possibility to add multiple datasources to a case was available before,
some of our customers did not know about it. To make this possibility
more explicit, the new button is introduced, helping to add multiple datasources
at a time
Search
- Search performance is massively improved
- Size of search index greatly decreased
- Search Results window is fully reworked:
- Each search attempt results in a separate Search Results window, so
that you can navigate between different search results
- Search history is now saved
- You can filter search results by multiple criteria
- There is a possibility to select multiple predefined searches
- When searching for multiple search terms, the product shows
how many results found for each particular one
- After re-opening a case you can run saved search again with
just a single click
- Sorting is supported in the Search Results window
- Search inside Search Results is now available
- In order to add results to a report, Search Results window offers
convenient checkboxes
- In general, Search became much more robust and convenient
SQLite
Even with v.7.2 we heard from our customers that "Belkasoft support for
SQLite is the best worldwide", but v.7.3 raises the bar to a new level:
- Performance massively improved
- Huge databases are now opened in a blink of an eye
- Database table structure is now shown
- You can convert selected column values to multiple data types, such as various
timestamps, integer and floating values, string types etc.
- Selected column type is remembered and used in a report, which you can
run directly from the SQLite Viewer
Reporting and exporting
- Geolocation data can be exported to KML format
- Evidence Reader license never expires
- Cellebrite Link Analysis integration supported via Export to UFDR
format (Instant Messengers only)
System files
- More info extracted about plugged USB devices
Performance
- Registry analysis performance is massively improved
- Predefined searches performance is massively improved
- Browser analysis performance is massively improved (especially for
Chrome browser)
- General performance improved: more effective usage of computer's
cores
Instant Messengers
- OneDrive support improved
- Skype picture transfers is now supported, if sent picture is still
available, it is added to "Pictures" node of the Case Explorer
- Skype contact extraction is improved: contacts, stored in Skype
database as a result of people search are not shown
Smaller improvements
- Searching of "The Bat!" email profiles improved
- PList validation improved
- Deleting of cases and profiles is improved
- Carving improved: sizes of carved JPG and PNG are now much smaller
- Video keyframe extraction is now off by default. This is now an
option, which you can switch on or off. You can extract keyframes for
individual video or selected videos manually. Switching keyframe extraction
off makes your initial analysis much faster
- Mounting under Windows 8 became faster and better. If you experience
issues with standard mounting, powered by third-party "imdisk" tool,
you can switch it off in Options
Important! Cases stored with v.7.2 won't open by v.7.3. Please
keep using v.7.2 or Evidence Reader to access older cases. We recommend
installing v.7.3 to a separate folder in case you are going to work with
legacy cases. Alternatively, you can re-analyze datasources used in older
cases with the new version.
See also:
Belkasoft Evidence Center 7.2
Belkasoft Evidence Center 7.1
Belkasoft Evidence Center 7.0
Belkasoft Evidence Center 6.3.1
Belkasoft Evidence Center 6.3
Belkasoft Evidence Center 6.2
Belkasoft Evidence Center 6.1
Belkasoft Evidence Center 6.0
Belkasoft Evidence Center 5.4
Belkasoft Evidence Center 5.3
Belkasoft Evidence Center 5.2
Belkasoft Evidence Center 5.1
Belkasoft Evidence Center 5.0
Belkasoft Evidence Center 4.2
Belkasoft Evidence Center 4.1
Belkasoft Evidence Center 4.0
Belkasoft Evidence Center 3.9
Belkasoft Evidence Center 3.8
Belkasoft Evidence Center 3.7
Belkasoft Evidence Center 3.6
Belkasoft Evidence Center 3.5
Belkasoft Evidence Center 3.0
Belkasoft Evidence Center 2.0