Belkasoft Evidence Center 2020 v.9.9 (or, in short, BEC) is an all-in-one forensic solution, combining mobile and computer forensics as well as memory, cloud and remote forensics, and incident investigations in a single tool. Given its affordable price, it is one of the best choices among other available products on the market.

The version 9.9 of Belkasoft Evidence Center mostly focuses on three major improvements: checkm8-based full file system acquisition of iOS devices, correctness of analysis of GrayKey images and zip containers in general, and carving performance. With v.9.9 you can robustly analyze all zip-based data sources. The speed of artifact and file carving is now as quick as never before.

Sign up for a webinar on BEC v.9.9!

Upgrading to version 9.9 is free to all customers with a non-expired Extended Software Maintenance and Support contract. Customers without a current contract can purchase it from the Customer Portal. Affordable training with optional certification is available.

More on new features

Mobile Forensics

• checkm8-based acquisition of the full file system supported
• Keychain extraction from jailbroken iOS devices or whilst checkm8-based acquisition
• iOS Signal chat app decryption
• GrayKey images analysis massively improved and accelerated
• Full file system extraction based on agent approach without jailbreak on iOS 10 to 13.4.1 and wide range of iOS devices
• ADB-based Android device acquisition improved
• Agent-based Android device acquisition improved
• Android apps supported or updated
  • Android OneDrive support updated to v. 5.40.4
  • Android Google Docs supported
  • Android Google Maps improved
  • Android Google Translate supported
• iOS apps supported or updated
  • iOS Yahoo Mail app improved
  • Text extraction improved for iOS Evernote app
  • Attachments for iOS Evernote now extracted properly
  • Contacts extracted from Facebook profiles when analyzing iTunes backup
  • iOS Hangouts messenger supported (including geolocation data extraction)

Computer Forensics

• Carving performance is significantly improved
• Zip-based data sources analysis is massively improved
• Carved data is no more stored in database what will also save significant amount of space for every case
• Virus Total analysis fixed
• Analysis of Puffin browser for Windows improved
• LNK files analysis improvements continued
• LNK carving and analysis of carved LNK files is significantly improved
• Reports are improved for LNK artifacts
• Folder names are extracted for mailboxes of Mail 163 Windows app
• Windows OneDrive app support updated
• Issues when creating Key dictionary for password bruteforce are fixed
• Hex is now displayed for Jumplists and LNK files
• Incorrect filter criteria by 'has embedded files' for Documents fixed

Incident Investigation

• OpenSavePdl artifacts cleared up
• Author field extraction fixed for Scheduled Tasks artifacts
• Prefetch files, Shim cache and Windows Power Shell artifacts presented better
• Origin path for Prefetch files filled
• Data from the future extracted for Scheduled Tasks artifacts—fixed
• Windows RDP-Related Events Log analysis supported

Remote Acquisition

• Deployment via GPO is available again. Now there are three deployment types: local (using thumbdrive or network share), via WMI, via GPO
• Remote agent stability improved when Server and Agent are of different versions

SQLite Viewer

• Carved SQLite unallocated data now always shown on the corresponding page inside SQLite Viewer (it was blank in some circumstances before)
• SQLite loading made quicker for switching between different artifacts in artifact list
• Report creation from SQLite Viewer fixed
• WAL records count properly shown at the bottom of each SQLite Table

Other Improvements

• Windows Google Drive data extraction improved. Offset is now shown for Google Drive artifacts. Hex now properly highlights them
• Video keyframe analysis for faces, skin etc improved
• Length extraction improved for OneDrive artifacts on Windows
• Google Consent Page fixed for Google Drive and Gmail cloud downloading
• Incorrect count for pictures in Overview when key frames are presented—fixed
• The "Copy files" option doesn't work for videos from Overview—fixed
• Search terms from cases made with previous BEC version are not displayed on Search Result tab—fixed

Sign up for a webinar on new BEC v.9.9