BelkaScript: How to Get Most out of Digital Forensic Software

Yuri Gubanov, Danil Nikolaev © Belkasoft Research

Digital investigator nowadays has access to a wide array of solid forensic tools. Some of them offer mobile forensics only, some help with computer or laptop analysis, some – like Belkasoft Evidence Center – support all types of devices, but the task flow and product logic is more or less fixed in every product. If an investigator faces an unusual task, it is hard to solve it within the workflow offered by a product. And unusual tasks are not that rare – we hear about them very often, just take a glance at various forensic forums.

In this article, we will discuss some real life stories that involved cases hard to solve with the standard workflow in Belkasoft Evidence Center:

  • Good Employee, Bad Employee
  • Bar Fight
  • Digging Deep Inside Photos

However, it became possible with BelkaScript, a free built-in scripting module that allows users to write custom scripts to extend Evidence Center capabilities. Scripts can be used to automate some of the routine (for example, reporting or bonding together two operations) or to extend product’s functionality for a specific situation. But it most certainly does not end there as we will now show on real-life examples.

Good Employee, Bad Employee

In the case of Good Employee, Bad Employee our customer used Belkasoft Evidence Center 7.2 to analyze a criminal case. There was a computer used by two workers of a company. However, both of them were using the same Windows account, which made it hard to distinguish whose actions were whose.

Some inappropriate traffic was detected, and the computer was taken away for investigation. The investigator was able to successfully find the URL history they were looking for using built-in Evidence Center functionality. They even restored some of the recently cleared browser histories by analyzing a memory dump created with Belkasoft Live RAM Capturer. The issue was that there were merely harmless data mixed with obviously fault activities, and the investigator needed to separate those. They contacted our support asking if the product was capable of doing it. Such a narrow feature was not built into the product, and there is where BelkaScript came in handy. Using the scripting module the customer created a script, which allowed sorting all of the found records by time, as the investigator required, since the employees were taking shifts to work.

Let’s see how easy it was.

Please register to access full versions of Belkasoft articles

Yuri Gubanov, Danil Nikolaev © Belkasoft Research