Belkasoft Industry
Research 2023

Geography and participants

People from 74 countries took part in the survey

The geography of our survey was very diverse. This diversity not only reflected the global reach of our research but also underscored the widespread relevance of the Digital Forensics and Incident Response (DFIR) field.

Participants’ positions

Our survey participants work in law enforcement and government organizations as well as other industries, such as corporate security, private DFIR laboratories, and education.

Workload and challenges

Workload: actual vs desirable

We expected to see a considerable gap between the actual and desirable workload. Surprisingly, the results revealed that many figures were remarkably close, indicating that overall, most examiners are comfortable with the number of tasks on their plates.


The most frequently highlighted challenges included tasks like bypassing passcodes, decryption, coping with limited hardware and software resources, and managing tight timeframes.

In addition to these, respondents also highlighted less-known yet equally significant challenges, such as cross-checking cases for similarities, adhering to strict ISO and legal compliance, and dealing with skill shortages.

An expert from the United Kingdom articulated a common concern among law enforcement workers quite effectively:

"Not enough software and hardware resources for the number of analysts that need to use them at any one time. For example, we have twice as many mobile phone analysts as we do licenses, leading to an inevitable bottleneck and frustration.

The need to release licenses to another analyst means that processing can be rushed and that the time to really, really deep-dive into an exhibit just isn't available. At some point, something pivotal will be missed and that will cause major issues in court, with reputational risks following."

If some tasks beyond one's capabilities are repeated from time to time, there is one interesting case worth mentioning that we see for the first time:

"I've been asked to deal with game machines. Also, I had to reverse engineer a device whose main task was to work with a thermal camera."

Have you ever been challenged with tasks beyond the capabilities of your DFIR stack? Could you share what they were?

"Yes. Surprisingly often! We commonly see new devices well in advance of any vendor support for them, and quite often, we just have to do the best that we can using the techniques and experience available to us. The adoption of ISO will make this non-standard way of working largely redundant, I suspect, leaving us in a situation where if a device isn't supported by an approved tool, then we'll have to just leave it until it's officially supported, which is utterly ridiculous."

"Things get complicated when multiple devices are involved. Most tools are seen happiest dealing with one device at a time. Building that cross-device narrative always feels like you're doing a lot manually, otherwise, things get confusing or missed," shares another expert from the United Kingdom.


How do you stay up-to-date with the latest industry trends and technological advancements?

In this part of the survey, our objective was to find out how DFIR specialists gain the necessary skills to stay current with rapidly evolving technology. The findings demonstrate that free training and articles stand out as the most preferred options, which unequivocally validates Belkasoft’s commitment to creating quality courses and content.

There are numerous DFIR blogs and websites that respondents follow. In fact, the number of unique resources exceeds a hundred. We have listed the majority of them at the end of the report.

We were especially glad and proud to read notes like these one:

"One of my favorites is Belkasoft's Newsletter. Other than that, I am also following,, and for more content related to forensics and others. SANS publication is also a good resource to update yourself for forensics," wrote a security engineer from India.

"I follow Yuri. However, I also utilize SWGDE for best practices and some other cybersecurity authors," wrote an expert from the USA. 

How often do you take training?

Despite demanding workloads and busy schedules, a substantial number of survey participants manage to carve out time for enhancing their DFIR expertise. They do so by regularly enrolling in various training courses.

Sharing / Mingling

Moving forward, we explored the main "watering holes" where DFIR specialists come for knowledge sharing, learning, and social interaction. At the forefront, we found LinkedIn taking the lead. However, the fact that YouTube secured a strong second position sends a clear message—don’t miss this source of knowledge! Your industry peers find this platform very useful.

Which social networks do you use for accessing work-related content?

While the most respondents mentioned LinkedIn and YouTube, others emphasized the significance of platforms such as Discord, Reddit, and Twitter. These mentions highlight that these media are valuable for learning and networking, so they're definitely worth checking out if you haven't used them before.

Digital forensics tools

How satisfied are you with your current toolkit?

In the dynamic world of DFIR, perfection is elusive, and no toolkit reigns supreme in every aspect. Yet, the data paints an interesting picture—nearly half of our respondents lean towards contentment rather than dissatisfaction, and a select few are happy with their toolkits. Meanwhile, a quarter of peers describe their experience as neutral.

What specific features or benefits attract you to new DFIR products or services?

What sets DFIR products apart? According to participant responses, it is not necessarily unique features but rather product quality, pricing, and versatility that matter most in today's DFIR landscape.

Belkasoft, in line with these priorities, focuses on three key aspects:

Ensuring High-Quality Products: We understand the critical importance of the findings derived from DFIR tools, and we are committed to delivering high-quality products.

Affordable and Transparent Pricing: Having worked with both government-funded and business organizations, we know the budget constraints you face. Hence, we always aim to provide cost-effective and transparent pricing for Belkasoft products. You can compare Belkasoft X pricing with your current toolkit by requesting the quote HERE.

Versatile Capabilities: Our flagship product, Belkasoft X, supports a wide range of devices and operating systems, empowering users to perform various tasks such as acquisition, triaging, analysis, and more.

Belkasoft user experience

We didn't miss the chance to gather insights on our peers' experiences with Belkasoft X, and here are the answers we received:

"Belskasoft X, the one I used, is a very useful tool, with one of the best GUI I've ever seen in my life, easy to use, very helpful with the organization of each case, low resources consume"

Axel Díaz Ortega, Colombia

"So far, I'm using Belkasoft X, and I find it very easy to use while being very fast in finding the artifacts needed."

Сhang Shiau Huei, Malaysia

"Belkasoft X improves my mobile forensics workflow. So far so great. User-friendly GUI. Highly recommended even for beginners."

Rehmark Paguio, the Philippines

"I have found greater recovery of some files on Apple laptops and Androids. Timelining to show unauthorized access post-seizure is most helpful."

Richard Grant Boddington, Australia

"I thoroughly enjoyed using the software. I applied it to analyze both my phone backup and RAM dump data. Specifically, I utilized it for assessing RAM dump information and extracting various artifacts. The software's structured organization and diverse data carving techniques stood out. Additionally, the tool allows for the generation of comprehensive reports based on the analysis results."

Tojo P. Thomas, India

"It worked and achieved the goal every time I needed it. User-friendly interface."

Ferreira, Portugal

"I like the amount and detail of the artifacts that Belkasoft X can handle. Easy-to-use UI. Easy-to-understand. Good support. Nice content about the usage. Supportive DFIR training."

Emre Caglar Hosgor, Turkey

"I use it daily, and I find the multipurpose aspect most beneficial. I am extremely comfortable with the tool, which is why I enjoy it so much. The product training has helped me discover many formerly unknown features of the software. I really enjoy the workflow in the tool."

Alec Tucker, the USA

"Belkasoft X gives you all the tools you need to conduct examination across multiple devices all in one product. I don't think I've ever come across another product that can provide this ability."

Daniel Roberts, Grenada

"I love the interface, the structure, and the user-friendly nature of the set. The capabilities are great and the pricing structure is terrific."

Tyler Hatch, Canada

"I use Belkasoft X every day, it helps me a lot in my cases and helped me to find an artifact that I've never known that was existing."

Hugo Dionne, France

"We have been using it for a long, and it has developed a lot… in HDD investigations, it's best.'

Tawhidur Rahman, Bangladesh

"I have used Belkasoft on a variety of successful cases. The latest has just seen a fraudster be sentenced to 4 years & 3 months in jail."

Mark Morris, the United Kingdom

"As I said, I did the trial run with Belkasoft X, and it did everything I needed really well (case management, artifact identification, streamlining the evidence to the investigator, ...). I love the product. It speeds up the investigation process a lot."

An expert from Croatia who wished to remain anonymous

'Belkasoft products are not time-consuming and give me the opportunity to quickly identify artifacts that are useful in a criminal case."

Ioan Ivan, Romania

New survey

Belkasoft has already started a new short survey titled "DFIR Lab Security Requirements."

Do you conduct your investigations in a strictly offline environment?

Currently, you can view the intermediate results on the left side of the pie chart, but we are still in the process of conducting this research. We encourage you to participate and influence the development of the Belkasoft X product. This mini-survey will take only 3 minutes. Participate HERE.

Did you enjoy Belkasoft's Industry Research? Share it on social media and with your colleagues.
Thank you!