Belkasoft Evidence Center X (Belkasoft X), is Belkasoft's new flagship product for digital forensics and incident investigations.

Version 1.7 of Belkasoft X features Spreadtrum acquisition support, grouping similar faces found in pictures, decryption of Signal backups for Android devices, support for MacQuisition APFS T2 images and a number of new and updated mobile artifacts.

Upgrading from previous versions of Belkasoft X to version 1.7 is free to all customers with a non-expired Software Maintenance and Support contract. Customers without a current contract can purchase it from the Customer Portal. Customers with a valid Belkasoft Evidence Center SMS, can upgrade with discounts: please contact sales@belkasoft.com for your upgrade quote.

You can also purchase affordable training with optional certification. A new on-demand training course has been recently made available.

More on new features

Mobile forensics

• A new Android acquisition method: now for Spreadtrum SoC. The new method supports almost 90 phone models and allows a user to acquire a full physical image of a device. With the new release, Belkasoft X now supports 10 different ways to acquire various types of Android devices, from standard ADB to EDL/Qualcomm to MTK to APK downgrade and others.

  The list of 88 supported devices (click to expand):

  • Alcatel 1C 5003D
  • Alcatel 1S 5024D
  • Archos 40D Titanium
  • Archos 55 Platinum
  • ARK Benefit Note 1
  • ARK Benefit S402
  • ARK Benefit S453
  • Assistant AS-5411
  • BLU G5
  • BLU G60
  • BQ 5528L Strike Forward
  • BQ 5731L Magic S
  • BQ 6040L Magic
  • BQ 6042L Magic E
  • Coolpad Mega 5A
  • DEXP Ixion E140 Strike
  • DEXP Ixion E150 Soul
  • DEXP Ixion E250 Soul
  • DEXP Ixion E345 Jet
  • DEXP Ixion E350 Soul 3
  • DEXP Ursus TS370
  • Digma Citi Z520
  • Digma Hit Q400
  • Digma Linx A400
  • Digma Linx A401
  • Digma Linx A420
  • Digma Linx A450
  • Digma LINX Rage 4G
  • Digma LINX Trix 4G
  • Digma Plane 7574s
  • Digma Vox A10
  • Digma VOX E502 4G
  • Digma Vox G450
  • Digma Vox S507
  • FinePower C2
  • FinePower C5
  • Fly FS528 Memory Plus
  • Fly FS551 Nimbus4
  • Fly IQ436i Era Nano 9
  • Fly IQ4490i Era Nano 10
  • Gigaset GS80
  • Ginzzu S4020
  • Gionee Max
  • GoClever Max
  • HTC Desire 326G DualSim
  • INOI 7
  • Intex 7
  • Intex Elyt Dual
  • Intex Indie 6
  • Intex Staari 11
  • Irbis SP05
  • Irbis SP06
  • Itel P36 Pro
  • Itel Vision 1
  • Itel Vision 1 Plus
  • Jinga A400
  • Leagoo Z5c
  • Lenovo A1000
  • Lenovo A2800D
  • Lenovo A398T+
  • Micromax Q301
  • Micromax Q326
  • Micromax Q346
  • Micromax Q346 Lite
  • Micromax Q379
  • Micromax Q385
  • Micromax Q465
  • Nobby X800
  • Philips S260
  • Philips S307
  • Prestigio Muze V3 LTE
  • Prestigio Wize NV3 3537Duo
  • TeXet TM-4003
  • TeXet TM-5073
  • TeXet TM-5075
  • TeXet TM-5076
  • TeXet TM-5077
  • TeXet X-line TM-5006
  • TeXet X-quad TM-4503
  • Vertex Impress Wolf
  • Wiko Sunny 2
  • Wiko Sunny 3
  • Wiko Sunny 4
  • ZTE Blade A3 2019
  • ZTE Blade A3 2020
  • ZTE Blade A5
  • ZTE Blade AF3
  • ZTE Blade GF3
• Signal backup decryption supported for Android. You will need a decryption key for the successful acquisition. Please see our BelkaCTF #2 write-up, which includes a video of how this feature is used in a close-to-real-life case
• New and updated iOS apps: Onion browser, CoverMe, VK app, Wickr
• New and updated Android apps: Google Maps, Google Maps Search, Slack, Telegram X
• APK downgrade improvements: Only selected applications are acquired during acquisition from an Android device using application downgrade method

Computer forensics

• Parsing of APFS T2 volumes acquired by MacQuisition is supported
• Passware integration updated to PKF 2021.2.1
• macOS apps analysis updated for Notes and Messages
• Support of AFF4 images of physical and logical drives improved
• Built-in Registry Viewer usability improved
• LUKS decryption with a known password supported

Media File Analysis

• A new feature is added: Face Grouping. If you opt to detect faces in still images and video keyframes, the product will group found faces if they look similar to each other (and likely belong to the same person). The results are shown under the Faces subnode of the Overview's Picture node inside the Artifacts window:

• A new face detection algorithm was integrated and is now based on the most modern ANN (Artificial Neural Network), which made the new face detection quicker and more robust

User interface

If you apply a local or a global filter, the list of applied filter criteria is now shown on top of the grid next to the artifacts number. With this new feature, you can easily see, which filters are currently applied and easily delete any of them by using the X button next to the criterion name.

There are two filters currently applied: by Camera name and by GPS. You can remove any of them with the X button next to the filter name

Issues fixed

• File system acquisition of iOS 14.2 with the help of agent-based method updated and became more robust
• Error 31 fixed when creating an image via Android agent or APK downgrade for devices running Android versions 7 to 11
• A number of issues with MTK acquisition fixed
• Adding a HiSuite Huawei backup data source now asks for a password instantly, not under Tasks window
• 'Copy folder' function improved for cases when directory length exceeds Windows limits. Now you can copy data into a tar archive, what allows you to preserve full paths including original symbols (even if not allowed by file system and even if a path is too long)
• Analysis startup is fixed for .AD1 images
• Qualcomm acquisition now detects that a device is not switched to the EDL mode and prompts a user to correct this
• Work with multiple keychain items is improved for cases with multiple iOS images in the same case
• 'Go to parent' function now correctly navigates to a correct item for Gallery view (before it was showing first item)