Portable Case with Belkasoft Evidence Reader
Export to Evidence Reader function allows you to share all your findings with anyone with a PC, even if they do not have a paid Belkasoft Evidence Center X license. Evidence Reader is a free product, which helps a user to review cases or their parts exported from Belkasoft X.
Why use Evidence Reader
Evidence Reader works in read-only mode, is portable, does not require any installation. And is particularly useful for splitting work on a case. Apart from splitting work among several investigators, Evidence Reader helps you with long-running cases. Consider this, if you would like to make sure that your case database is read without flaws in a year or more from the day it was created, export your case to Evidence Reader. Since Belkasoft X is evolving quickly, in a year or two, an older case may become unreadable by a newer versions of Belkasoft X. At that point, the best way to open such case would be to use Evidence Reader created at the time as export to Reader was performed.
Exporting data to Evidence Reader
In order to export case data to Evidence Reader, go to Dashboard window and select Export to Evidence Reader item from the Actions list:
The following window will open, allowing you to select profiles to export. You can choose to export the whole case or only selected profiles:
Select data sources and profiles you would like to export and click Next. Data sources and profiles, which are not checked, will not be exported.
On the second screen of the export process, you will be asked for a target path for output files. Besides, youmay opt to Copy Evidence Reader to the target folder. If you export Reader multiple times, you may decide not to include it to every folder and only do this for the first time. This helps you to save disk space and time spent for exporting.
Click on the Finish button and wait until the task is completed. Inside the target folder, you will find a subfolder with the case name, which contains all needed files. You can copy all the subfolder contents and give to another user.
Why cannot I export data to Evidence Reader?
If Export to Evidence Reader button or menu item is greyed out, this means that your SMS plan is expired. It is not allowed to create Evidence Reader cases after the support expiration, so please renew your SMS plan.
In addition, trial version of Belkasoft X does not allow exporting data to Evidence Reader.
Evidence Reader and saving files to database
Larger size files are not stored in a case database. Types of files which are not saved, include pictures, videos, documents, SQLite databases, and so on. If you export a case with these types of artifacts to Evidence Reader, you will not be able to open or preview them. Only textual information will be available, such as metadata or plain texts (for documents).
If you would like to be able to review pictures, preview documents and so on, you should save needed artifacts to database before exporting them to Evidence Reader. To do so, select artifacts you need in a corresponding artifact list and choose Save checked items to database context menu item:
Evidence Reader limitations
Reader has an interface similar to Belkasoft X, but a bit more simplified. Particularly, you will not be able to:
- create a case
- acquire data
- add or delete data sources
- analyze or re-analyze a data source
- check for malware
- do hashset analysis
- extract keyframes from videos
- analyze pictures
- and so on
However, you will be able to:
- do searches
- run reports
- create, edit, and delete bookmarks
It also has different color scheme to help distinguishing Evidence Reader from Belkasoft X:
Request a price quote for Belkasoft X below.