Belkasoft Evidence Center 2019 v.9.6 (or, in short, BEC)
is an all-in-one forensic solution, combining mobile, computer,
RAM, cloud and remote forensics as well as incident investigations in a
single tool. Given its affordable price, it is one of the best choices among
other available products on the market.
The following new functions are included in BEC v.9.6:
- Updated search engine. The new engine, namely ElasticSearch,
is known for its greater speed and precision. One of the benefits of having
ElasticSearch is a number of third-party tools capable of working with indexed
data
- Updated graphical timeline. This feature gives you a possibility
to glance over various events in a case, make filters with your mouse and
synchronize with text timeline to narrow your search
- TikTok support for Android and iPhone. This new media app is
becoming extremely popular nowadays
- FileVault decryption with a known password
- iPhone acquisition with lockdown file authentication. One more
way to get inside an Apple device!
- Acquisition of jailbroken iPhones is updated to support the latest iTunes
Windows 10 App
- Multiple improvements in Remote Acquisition including NAT
support
- Many more new and updated apps
Sign up for a webinar on BEC v.9.6!
Upgrading to version 9.6 is free to all customers with a non-expired Extended
Software Maintenance and Support contract. Customers without a current contract
can purchase it from the Customer Portal.
Affordable training with optional certification is
available.
New features in detail
Updated search engine
One of the biggest changes with BEC v.9.6 is completely redone indexing engine.
We went away from pure Lucene engine and replaced it with ElasticSearch, one
of the most powerful indexing engines existing nowadays. ElasticSearch makes
indexing process much quicker and robust, allowing multi-threading access to
the index and third-party tools to examine it.
Thanks to the new indexing engine, the total time to complete analysis of
various data sources significantly decreased while the accuracy of various types
of searches is significantly improved, including regular expression based searches.
Graphical timeline
Graphical timeline is finally back and can be found at the Timeline tab,
where you can switch between Grid View and Graph View. Using the graphical timeline
you can visually locate various anomalies, events density points, and simply
create time-based filters using a mouse.
Hint: use Ctrl-Q/W/E to switch between different views of Graphical
Timeline.
iPhone acquisition with lockdown files
According to
this article, "Lockdown records, or pairing records, are files that are stored on the computer
to which the iOS device syncs to. These files are created the first time the
user connects their iOS device to a PC that has iTunes installed."
In v.9.6 Belkasoft Evidence Center can acquire iOS devices even if they
are locked, in case there is a valid (not expired) lockdown file. In order to
successfully acquire a device using this method, it is recommended to use the
original Apple lightning cable.
Decryption
A number of improvements were made to the supported decryption types:
- FileVault decryption with known password supported (Decryption
module is required)
- Encrypted iPhone backup acquired with UFED Physical Analyzer supported
- Nested decryption is supported: FileVault, Bitlocker and McAfee Endpoint Security decryption
is now supported
inside encrypted images, for example, inside encrypted DMG files
(Decryption module is required, a known password is required)
File systems
- Multiple improvements to ext4 file system support
- Hash set analysis can be run for any data source type including folders
- More tweaks with APFS volumes with regards to hashing
- SHA-256 hashing algorithm added
Remote Acquisition
- Remote agent port configuration supported
- Support NAT in remote acquisition
- Hash values are stored next to an acquired image
- SHA-256 hashing algorithm added
- Stability improved for various scenarios of the remote agent or remote computer
becoming irresponsive/crashed
- New feature: Remote artifact extraction supported
- Issues fixed:
- Сonnected iOS device is not visible through a remote agent
- RAM image is not created under some circumstances
- BEC cannot create RAM image for a remote PC when there is not enough
space on the remote drive
Artifact analysis
New or updated artifacts:
- iOS
- WhatsApp updated
- Apple Mail updated
- iChat (more correct time extraction)
- Telegram (time extracted correctly now; all accounts are parsed,
not only primary)
- Growlr (voicemail file name is now extracted)
- Ebuddy XMS (picture name is now extracted for picture transfer)
- ICQ (call duration fixed)
- Vipole (call duration fixed, other updates)
- TextMe (call duration fixed)
- ShareIT supported
- Telegram (updated)
- TikTok supported
- SMSes (owner phone extracted)
- iMessage (updates for v.11.0)
- iOS Frequent Locations for iOS 11 and higher supported
Android
- Chaatz updated
- Telegram X updated
- ShareIT supported
- LINE (dates in chats fixed)
- TikTok supported
- SMSes (owner phone extracted)
- VKCofee (updates for v.7.91; profile owner fixes, unallocated records
analyzed)
- Signal updated
Windows
- Skype (updates for v.8.36.0.52, call duration fixed)
- ShellBag (time type explicitly specified in UI)
- ShareIT supported
- Internet Explorer (cache is properly displayed in properties)
- Backups of setupapi.dev log files supported
- Viber (updates for v.10.7.0)
All platforms
- Mails with the quoted-printable encoding
- MIME mails (carving improved)
- Thunderbird (smaller issues)
- Firefox v.66.0.3 (cache is properly displayed in properties)
Cloud artifacts
- Google Timeline geolocation data parsing improved
Incident investigations
- More useful filters added to the Incident Investigation window
Issues fixed
- Artifacts with type 'Others' are not shown in Overview
- Impossible to adjust a column list for a report from Overview -> Browsers
- Empty lines are shown in SQLite Viewer when SQLite database has WAL or journal
records
- Thumbnails are not generated in reports with HEIC pictures
- Too long loading data for Unallocated table in SQLite
- Sorting by time does not work for URLs
- Incorrect sorting by Last Visit Time for URLs in Case Explorer
- Origin path is not saved for installed applications on macOS
- Origin path is not saved for Wi-Fi configurations on macOS
- Errors while analysis of Instagram pictures
- Voicemail is not shown in Attachments tab inside the Overview window
- Name of the owner account in Messages is duplicated
- HTML part is not extracted for a carved mail
- Date is not extracted for a carved MIME mail
Usability and GUI
- Disk acquisition options are separated into two windows
- List of properties for jumplists and file links are extended in Overview
- Carving signatures window is adjusted for the German locale
- VirusTotal analysis is enabled from the folders tree of the File System
window
Sign up for a webinar on
new BEC v.9.6
