Overview
Belkasoft X (Belkasoft Evidence Center X) is a flagship tool by Belkasoft for computer, mobile and cloud forensics. It can help you to acquire and analyze a wide range of mobile and computer devices, run various analytical tasks, perform case-wide searches, bookmark artifacts, and create reports.
“The short story: Belkasoft X gives great value in both cost and features.”
Brett Shavers, USA
Comprehensive investigations
Belkasoft X acquires, examines, analyzes, and presents digital evidence from major sources—computers, mobile devices, RAM and cloud services—in a forensically sound manner. If you need to share the case details with your colleagues, use a free-of-charge portable Evidence Reader.
Easy-to-use
Belkasoft X works out of the box and can be easily integrated into customer workflows. The software interface is so user-friendly that you can start working with your cases right after the Belkasoft X deployment.
Quick and smart
While performing search tasks for evidence, Belkasoft X uses approaches that enable it to find the most forensically significant artifacts quickly instead of wasting time on redundant operations.
Powerful analytical features such as a connection graph, a timeline and advanced picture and video analysis help you to uncover facts rapidly.
Save your time and efforts
Belkasoft X automates search tasks, and thus the product can run unattended, you can multitask and complete an investigation at a quick pace.
Tailored to your needs
You can select a product edition that suits your workflow, whether you are an expert in a digital forensic laboratory of a federal law enforcement agency or in a digital forensic and incident response consulting company, an investigator in a local or state police department, or a private practitioner.
Thanks to the flexible price structure you will find the product edition which perfectly fits your needs and budget.
Time-proven
Belkasoft X is based on the successful Belkasoft Evidence Center and encompasses many years of experience, a large amount of user feedback, and expert suggestions from numerous investigators from both a law enforcement and corporate world.
Mobile and Computer Acquisition
The product allows you to acquire data from a computer, a laptop or a mobile device. Hard and removable drives are acquired into DD and E01 formats with optional hash calculation and verification. For mobile devices running iOS Belkasoft X acquires iTunes backup and full file system copy with keychain by means of agent-based and checkm8-based methods or when a device is jailbroken; for Android devices there are multiple approaches to data acquisition: standard ADB or agent-based backup, Qualcomm and MTK-specific dumps, physical and logical backup for rooted devices, APK downgrade and other methods.
acquisition
Mobile and Computer Device Examination
Supporting all major desktop and mobile operating systems, Belkasoft X is suitable for mobile and computer forensics. It can parse real and logical drives and drive images, virtual machines, mobile device backups, UFED and GrayKey images, JTAG and chip-off dumps.
Smart and Comprehensive Analysis
The product looks everywhere on the device completely automatically and can successfully identify thousands types of digital artifacts. Convenient artifact search, sorting, bookmarking and filtering help to narrow down the findings.
video analysis
Customizable reports in multiple formats
Reports in numerous formats such as text, HTML, XML, CSV, PDF, RTF, Excel, Word, EML, KML, ProjectVIC JSON, Relativity Short Message Format, Semantics21 and others.
Free portable case viewer
Free Evidence Reader allows sharing your findings with your colleagues with or without Belkasoft X installed.
What is new in the latest version of Belkasoft X
Learn moreEditions
X Forensic
X Forensic edition is the complete solution for conducting in-depth investigations on all types of digital media devices and data sources, including computers, mobile devices, RAM and the cloud. It is an irreplaceable analytical tool for digital forensic laboratories of federal law enforcement agencies and state-level police departments.
When you purchase this edition, you get all the features available in X Mobile and X Computer editions.
Additionally, you get to
- Acquire and analyze data from cloud sources
- Use checkm8-based acquisition to extract data even from locked iPhones without a jailbreak (right on your Windows workstation)
- Access devices encrypted with whole device encryption (WDE), such as APFS, Bitlocker, TrueCrypt and others
X Corporate
X Corporate edition is the digital forensic and incident response solution with enhanced analytical functionality specifically developed to meet the business requirements of large corporate organizations, which prefer to have a DFIR team in-house or provide DFIR services. Corporate incident responders can take advantage of a combination of X Forensic capabilities and advanced X Corporate features incorporated into the product specifically to respond to the demands of corporate customers.
When you purchase this edition, you get all the features available in X Forensic edition.
Additionally, you get to:
- Investigate hacking and intrusions into Windows-based computers with the help of Incident Investigations module
- Find malware using powerful YARA rules
X Computer
X Computer edition is a cost-effective solution developed specifically for investigators in local police departments, experts in small to medium consulting companies providing digital forensic and incident response services, and individual customers such as private investigators or digital forensic consultants.
Customers who typically deal with only a few computer-related cases per year and/or have a limited budget will enjoy the very affordable price of X Computer edition.
When you purchase this edition, you get to:
- Extract data from hard drives, mount and analyze hard drives, disk images, virtual machines, and RAM
- Examine and analyze hundreds of artifacts: instant messengers, browsers, mailboxes, documents, images and videos, system files, online games, and payment applications, cloud artifacts
- Use analytical features:
- Connection graph to reveal connections between artifacts and people in a case
- Timeline to identify all the events within a specific timeframe
- Smart and powerful carving feature to locate evidence that was deleted, destroyed, or never permanently stored on the hard drive at (page file, hibernation file, RAM contents)
- Perform in-depth examinations into the contents of files and folders on the device with File System Explorer
- Find even more evidence with Plist, Registry, and SQLite Viewers
X Mobile
X Mobile edition is a cost-effective solution developed specifically for investigators in local police departments, experts in small to medium consulting companies who provide digital forensic and incident response services, as well as individual customers (i.e. private investigators or digital forensic consultants).
Customers who typically deal with just few cases per year involving unlocked mobile devices, and usually have limited budgets will enjoy the affordable price of X Mobile edition.
When you purchase this edition, you get to:
- Acquire images of multiple iOS and Android device models, analyze Blackberry and Windows phones
- Extract data from iOS devices by means of several acquisition methods such as jailbreaks, agents, and lockdown files
- Examine and analyze mobile artifacts—calls and messages, mailboxes, messenger apps data (WhatsApp, Signal, Telegram, Snapchat, WeChat, etc.), social media apps (Facebook, Twitter, Tinder, etc.), cryptocurrencies, browsers, and many more
- Utilize Belkasoft X functionality to mount third-party tools images (UFED, GrayKey, etc.), mobile backups, chip-off dumps, TWRP images, JTAG dumps, etc.
Learn more about Belkasoft X Editions
DownloadTechnical specifications
Belkasoft X allows data acquisition and analysis from multiple sources
- Operating systems: Windows (all versions, including Windows 11), macOS, Unix-based systems (Linux, FreeBSD, etc.)
- Storage devices: hard drives and removable media
- Disk images: EnCase, FTK, X-Ways, AFF4, L01/Lx01, DD, SMART, Atola, DAR, DMG, archive files (such as tar, zip and others)
- Virtual machines: VMWare, Virtual PC/Hyper-V, VirtualBox, XenServer
- Cloud storage: Amazon S3-based images
- Memory: RAM dumps, hibernation files, page files
- File systems: APFS, BTRFS, FAT, exFAT, NTFS, HFS, HFS+, ext2, ext3, ext4, XFS
- Acquisition: Available to DD or E01 images with optional hash calculation and verification
- Operating systems: iOS (iPhone/iPad), Android, Windows Phone 8/8.1, Blackberry
- Data sources: Mobile backups, GrayKey, UFED and OFB images, chip-off and JTAG dumps, TWRP images, Blackberry IPD and BBB backups, Android physical and logical dumps, Xiaomi MIUI backups, Huawei HiSuite backups
- File systems: APFS, HFS+, F2FS, YAFFS, YAFFS2, ext2, ext3, ext4
- Acquisition
- iOS: iTunes, agent-based, checkm8-based, lockdown file support, AFC, jailbroken devices support, crash logs, screen capture
- Android: ADB backup, advanced ADB backup, agent backup, rooted devices support, PTP/MTP, EDL for Qualcomm, APK downgrade, agent-based/logical/physical MTK acquisition, Spreadtrum acquisition, automated screen capture
- SIM cards: SIM cards cloning through a SIM reader device
- Google Clouds: Google Drive, Google Sync, Google Keep, GMail, Google Timeline, Google MyActivity
- iCloud
- Email: Yahoo, Hotmail, Opera, Yandex, Mac.com and 25 more webmail clouds
- Huawei
- Microsoft 365
- WhatsApp: backups downloading and QR code-based chat downloading
- Telegram
- VK
Talk to an expert who can help you to identify your needs and answer your questions
Talk to us