What's new in Belkasoft X v.1.7

Belkasoft Evidence Center X (Belkasoft X), is Belkasoft's new flagship product for digital forensics and incident investigations.

Version 1.7 of Belkasoft X features Spreadtrum acquisition support, grouping similar faces found in pictures, decryption of Signal backups for Android devices, support for MacQuisition APFS T2 images and a number of new and updated mobile artifacts.


Upgrading from previous versions of Belkasoft X to version 1.7 is free to all customers with a non-expired Software Maintenance and Support contract. Customers without a current contract can purchase it from the Customer Portal. Customers with a valid Belkasoft Evidence Center SMS, can upgrade with discounts: please contact sales@belkasoft.com for your upgrade quote.

You can also purchase affordable training with optional certification. A new on-demand training course has been recently made available.

More on new features

Mobile forensics

Computer forensics

  • Parsing of APFS T2 volumes acquired by MacQuisition is supported
  • Passware integration updated to PKF 2021.2.1
  • macOS apps analysis updated for Notes and Messages
  • Support of AFF4 images of physical and logical drives improved
  • Built-in Registry Viewer usability improved
  • LUKS decryption with a known password supported

Media File Analysis

  • A new feature is added: Face Grouping. If you opt to detect faces in still images and video keyframes, the product will group found faces if they look similar to each other (and likely belong to the same person). The results are shown under the Faces subnode of the Overview's Picture node inside the Artifacts window:

  • A new face detection algorithm was integrated and is now based on the most modern ANN (Artificial Neural Network), which made the new face detection quicker and more robust

User interface

If you apply a local or a global filter, the list of applied filter criteria is now shown on top of the grid next to the artifacts number. With this new feature, you can easily see, which filters are currently applied and easily delete any of them by using the X button next to the criterion name.

There are two filters currently applied: by Camera name and by GPS. You can remove any of them with the X button next to the filter name

Issues fixed

  • File system acquisition of iOS 14.2 with the help of agent-based method updated and became more robust
  • Error 31 fixed when creating an image via Android agent or APK downgrade for devices running Android versions 7 to 11
  • A number of issues with MTK acquisition fixed
  • Adding a HiSuite Huawei backup data source now asks for a password instantly, not under Tasks window
  • 'Copy folder' function improved for cases when directory length exceeds Windows limits. Now you can copy data into a tar archive, what allows you to preserve full paths including original symbols (even if not allowed by file system and even if a path is too long)
  • Analysis startup is fixed for .AD1 images
  • Qualcomm acquisition now detects that a device is not switched to the EDL mode and prompts a user to correct this
  • Work with multiple keychain items is improved for cases with multiple iOS images in the same case
  • 'Go to parent' function now correctly navigates to a correct item for Gallery view (before it was showing first item)