Bookmarks
Belkasoft X allows you to create bookmarks for almost all artifacts or objects—such as an email, chat, contact, geolocation, or even a registry setting—presented after analysis under the Artifacts tab. For example, Belkasoft X highlights bookmarked artifacts with colors to help you to find and recognize them easily.
However, you cannot create bookmarks for these items: a file under the File System tab, an SQLite record under SQLite Viewer, a registry setting under Registry Viewer, and similar objects in those locations.
Creating a new bookmark
In order to create a new bookmark, check one or multiple artifacts in any artifact list, for example, list inside Artifacts, Connection Graph, Search Results, or other windows, which show a list of artifacts. When you have all artifacts selected, you can:
- Press Ctrl-Shift-B key combination or
- Right click, select Bookmark checked items context menu item and then Create new bookmark submenu:
On the Create new bookmark window, input a name and specify the category for the bookmark. Click on the OK button.
Bookmarked items are marked with a colored bookmark flag. The flag color depends on the bookmark category.
You could also use hot keys to bookmark selected artifacts by categories (see Settings -> Bookmarks).
Adding an artifact to an existing bookmark
Once you have created one or multiple bookmarks, you can add more items to any existing bookmark. To do so,
- Press Ctrl-B key combination. This will add checked artifacts to the last bookmark you created.
- Right click, select Bookmark checked items context menu item and then any existing bookmark from the list (see "Suspicious chats" bookmark on the screenshot below):
Note: Do not confuse artifact bookmarks with those in Hex Viewer. Hex viewer has its own bookmarks for a group of bytes. See "Hex Viewer" chapter for more.
Complex items bookmarking
When you bookmark an item, which was originated from another item, for example, a picture from email attachment, both these items are bookmarked, child and parent. This is useful, when you first look for some specific content (for instance, pictures with guns) and then need to investigate where these items came from (chats, emails, documents and so on).