Cross-Case Search module allows you to find intersections between the currently investigated case and other BEC cases. The information found in the current case is compared with the information found in the selected older cases and all matches will be reported on the Search Results screen. The product can find the following types of data whilst the cross-case search:

• phone numbers
• email addresses
• application UINs and profile names

File System module is designed to allow you to perform an even more thorough low-level forensic analysis.

This module allows you to view and navigate through all folders and files within a data source added to your case, including hidden, deleted and special system files and folders, for example, $OrphanFiles or $Extends. Memory processes are extracted from RAM dumps.

You can browse any mobile or computer file system as well as a memory dump, acquired with Belkasoft or any third-party software. Convenient Hex Viewer window allows you to review chosen file or process binary contents.

Customers that have File System module can also enjoy Hashset analysis function. You could use a NSRL hashset database or a folder with previously known files.

With this module you can also check memory processes and files for malware using various methods, including fake system process names detection and checking with VirusTotal.

Incident Investigations module is aimed to help users investigate hacking attempts of Windows-based computers. By analyzing numerous sources such as registry, event logs and memory dumps, it can find traces, which are typical to various tricks used by hackers to penetrate company's infrastructure.

Belkasoft Evidence Center looks at various artifacts located inside Amcache, Shimcache, Syscache, BAM/DAM, AppInit DLLs, Change of default file association, scheduled tasks, remote connections (RDP, Remote Connection, TeamViewer and others), startup tasks, browser extensions and so on; it detects suspicious connections and scripts.

The results of analysis are then presented inside separate Incident investigations window, making it easy to separate suspicious activities from regular forensic artifacts.

With this module, the product can acquire and analyze various mobile devices. Inside an acquired image or dump it will find and analyze several hundred different kinds of artifacts for Android, iOS, Blackberry, and Windows Phone devices. Among these artifacts are calls and messages, email, messenger apps data (for example: WhatsApp, Kik, Telegram, Snapchat, WeChat), social media apps (for example: Facebook, Twitter, Tinder, VK), online payment systems and wallets, browsers, and more.

Supported formats include mobile device backups for Android, iOS and Blackberry, UFED images, JTAG and chip-off dumps.

Extended by this module, your copy of Belkasoft Evidence Center will be able to analyze Office and SQLite files, important in modern investigations.

Office documents of multiple formats are supported, such as Microsoft Office, Open Office, PDF and RTF. The product extracts metadata and texts, carves deleted documents and creates a full-text index enabling nearly instant search.

BEC supports in-depth analysis of SQLite databases, used by multiple popular modern apps. Built-in SQLite Viewer allows review of raw records, while out-of-the-box analysis of various artifacts can be significantly improved by the product's analysis of important SQLite areas such as freelist, write-ahead log and journal file, and SQLite unallocated space. Even partially damaged and corrupted SQLite databases can be opened by the viewer.

Remote Acquisition module allows you to perform acquisition of various data sources from remote locations. Available data source types include

• hard or removable drives
• RAM memory
• mobile device

The acquisition is performed with the help of an agent, installed to a remote device such as a computer or a laptop. The agent can be deployed with Group Policy Object (GPO) inside a Windows domain or by manually copying and running at a remote device.