Creating a case
To create a new case, click on Create case.
On the Create case window, fill in the Name box, specify the Folder to which Belkasoft X stores the case, choose your preferred Time zone, fill in the Investigator box, and fill in the Description box.
We recommend you select a root folder (inside a big drive) as the location to which Belkasoft X saves cases. The cases may be huge, so you should try to make preparations free up as much space as possible.
If your machine has a small-sized SSD, then you you can still use it. Ideally, you should get a big HDD drive and store your cases there. You cannot change the Case folder (for a case) later, so you must make the correct decision before you create your case.
Belkasoft X determines the path automatically based on the root folder and case name.
Time zone setting for a case—and its importance
The Time zone is an important setting in digital forensics. Artifacts are stored in UTC time or local time—this setting allows Belkasoft X to assign different times to points on a specific timeline. Belkasoft X sets the time zone automatically to the default (in use) on your computer.
When you work with devices or sources from a time zone that differs from yours, you may want to change your time zone setting.
Note: When your case contains multiple devices or sources from different time zones, you can—and we recommend that you do—set the time zone for each device separately. For more information, see Supported analysis types.
Opening a case
To open a case, you previously created in Belkasoft X, click on Open case.
On the Open case window, click on the case you want Belkasoft X to open.