Discover Evidence on PCs and Mobile Devices with Belkasoft Evidence Center 2015

25th May 202020th November 2014 by Belkasoft

Belkasoft have released a major update to their flagship forensic tool, Belkasoft Evidence Center. With the version 7.0, Evidence Center becomes a true all-in-one forensic solution, reliably analyzing evidence from all imaginable sources.

Evidence Center is well known for its ability to easily find and analyze 500+ types of evidence (such as documents, emails, chats, system and registry files, etc.). What makes this new release different is the ability not just to analyze supported apps and formats, but also to perform low-level investigations of any piece of evidence on a suspect’s device or image.Here are the new modules in your arsenal:

• File System Explorer shows all files and folders, including deleted and special ones
• Hex Viewer helps investigator to conveniently glance over binary data, while Type Converter assists in interpreting it
• Scripting allows to extend Evidence Center with custom functionality
• Live RAM Process Explorer helps to extract and visualize process memory

Newly added features make Belkasoft Evidence Center 2015 one of the most complete solutions in the field of digital forensics.

File System Explorer

The File System Explorer allows forensic experts to access the complete structure of a device, dump, drive or memory image, mobile phone, tablet, or virtual machine. Within this module, investigators are able to analyze all volumes and partitions to browse existing and deleted files and folders, including special ones such as $OrphanFiles, $Log, $BadClus and so on.

On this picture you can see an Android phone (chip-off dump) file structure shown by File System module of Belkasoft Evidence Center 7.0. Particularly, you can see hidden special folder $OrphanFiles.

BelkaScript

Custom scripting engine BelkaScript makes Evidence Center a truly user-extendable tool. BelkaScript uses easy to learn simplified C# programming language, so that the experts can write their own modules to extend Evidence Center functionality. We included a number of samples in the product installation, allowing users to write the first script easily. To give an example, one of the sample scripts implements custom header-footer carving using a pre-defined signature.

Scripts are written in simplified C#. Scripting window allows to debug custom extensions using breakpoints, step-by-step debugging, variable values inspection and so on.

Hex Viewer and Type Converter

Hex Viewer enables binary analysis of any file on the disk, mobile device, image, process or memory dump. Handy Type Converter allows to inspect any selected value, interpreting it as various data types, such as numbers, date/time stamps, IPs, etc.

Built-in Hex Viewer allows low-level file investigation; it has a handy type converter, showing current selection in different formats; search and bookmarking; saving selection to a file; advanced Go to, including jump to a relative offsets and many more.

Live RAM Process Explorer

Live RAM Process Explorer works similarly to File System Explorer, but with processes instead of files. For example, investigators can view all processes – dead or alive – within Windows 7 memory dump and explore memory of, say it, Skype.exe and AppleMobileDev processes using Hex Viewer and Type Converter.

Windows 7 Live RAM processes are shown, including dead processes; it is possible to select a process and review its memory in Hex Viewer.

About Evidence Center

Belkasoft Evidence Center is one of the few digital forensic tools investigating both PC and mobile devices running not just Windows, but also Mac OS X, iOS, Linux/Unix, Android, and alternative systems.

In addition to low-level investigation, the tool provides out of the box evidence discovery and analysis for 500+ forensically important “low-hanging fruits”, such as email, documents, mobile apps, SQLite databases, registry and system files, internet chats, social networks, pictures, videos, encrypted files and volumes, and many more. The following data sources are supported:

• Computer hard drives
• Drive images
• Smartphone backups
• UFED images
• Raw chip-off dumps of mobile phones
• Live memory dumps
• Virtual machines
• Etc.

Time-limited offer

A number of newly released modules with a total value of $600 is available for existing customers at no charge. If you have a non-expired floating license for Belkasoft Evidence Center Ultimate with Case Management, or if you are just planning your purchase, you are eligible to upgrade and receive the new modules free of charge. The offer expires by December 31, 2014.

• Request a FREE trial:
http://belkasoft.com/trial

• More information about what’s new in version 7.0 is available at
http://belkasoft.com/bec/en/Whats_New_In_Version_7.0

Latest Videos

Forensic Focus

Throughout the past few years, the way employees communicate with each other has changed forever.

69% of employees note that the number of business applications they use at work has increased during the pandemic.

Desk phones, LAN lines and even VOIP have become technologies of the past workplace environment as employees turn to cloud applications on their computers and phones to collaborate with each other in today’s workplace environment.

Whether it’s conversations in Teams, file uploads in Slack chats, or confidential documents stored in Office 365, the amount of data stored and where it is stored, is growing quicker than IT and systems administrators can keep up with.

Corporate investigators and eDiscovery professionals need to seamlessly collect relevant data from cloud sources and accelerate the time to investigative and discovery review.

With the latest in Cellebrite’s remote collection suite of capabilities, investigators and legal professionals can benefit from secure collection with targeted capabilities for the most used workplace applications.

Join Monica Harris, Product Business Manager, as she showcases how investigators can:

- Manage multiple cloud collections through a web interface
- Cull data prior to collection to save time and money by gaining these valuable insights of the data available
- Collect data from the fastest growing cloud collaboration applications like Office365, Google Workspace, Slack and Box
- Login to a single source for workplace app collection without logging into every app and pulling data from multiple sources for every employee
- Utilize a single unified collection workflow for computer, mobile and workplace cloud applications without the need to purchase multiple tools for different types of collections – a solution unique to Cellebrite’s enterprise solution capabilities

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_g6nTjfEMnsA

Tips And Tricks Data Collection For Cloud Workplace Applications

Forensic Focus 20th March 2023 11:00 am

As a hybrid working environment continues to be a way of life for many professionals, the way employees communicate has been altered as well. The scope and volume of data that needs to be collected and reviewed from computers, mobile devices and cloud applications is evolving.

As the devices and collaboration platforms employees use changes, the approach to collecting data generated on emerging devices and platforms grows increasingly complex as a result. In a 2022 Endpoint Intelligence benchmark survey, only 65% of legal professionals are confident in their ability to collect relevant data from endpoints.

Understanding this ever-changing collection landscape is essential for legal and litigation technology professionals as modern data increases in volume in discovery.

Join Monica Harris, Product Manager at Cellebrite Enterprise Solutions for an educational discussion on the what, when, why and how of modern data collections for legal teams.

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_jVTDS1UTTtA

We’re Not in Document Land Anymore: Modern Data Collections for Litigation Technology Professionals

Forensic Focus 6th March 2023 10:00 am

In this episode of the Forensic Focus podcast, Si and Desi explore the cutting-edge technology of deepfake videos and image manipulation. In addition to discussing the latest technological developments and efforts being made to detect manipulated media, they also examine the associated legal and ethical implications.

Show notes:

Boris Johnson image - https://www.theguardian.com/politics/2023/jan/10/spot-the-difference-boris-johnson-appears-scrubbed-from-photo-posted-by-grant-shapps

Deep Fake Neighbour Wars - https://m.imdb.com/title/tt21371376/

Stalin image - https://www.history.com/news/josef-stalin-great-purge-photo-retouching

Nvidia eye contact AI - https://www.polygon.com/23571376/nvidia-broadcast-eye-contact-ai and https://www.youtube.com/watch?v=xl87WTDrReo

Birthday problem - https://en.wikipedia.org/wiki/Birthday_problem

Same frightening woman in AI images - https://petapixel.com/2022/09/09/the-same-frightening-woman-keeps-appearing-in-ai-generated-images/

Inherent mysogeny of AI portraits - https://www.theguardian.com/us-news/2022/dec/09/lensa-ai-portraits-misogyny

Midjourney - https://www.midjourney.org/

Deepfake porn legality - https://www.theverge.com/2022/11/25/23477548/uk-deepfake-porn-illegal-offence-online-safety-bill-proposal and https://www.technologyreview.com/2021/02/12/1018222/deepfake-revenge-porn-coming-ban/

AIATSIS - https://aiatsis.gov.au/cultural-sensitivity

Fake tiger porn story - https://www.dailydot.com/unclick/tiger-porn-britain-law/

Group photo with no blinking - https://www.countrylife.co.uk/comment-opinion/curious-questions-group-photo-179102

Emma Watson deefake audio - https://www.thetimes.co.uk/article/ai-4chan-emma-watson-mein-kampf-elevenlabs-9wghsmt9c

Domestika - https://www.domestika.org/en/courses/981-introduction-to-interviewing-the-art-of-conversation

Investigative Interviewing - https://www.amazon.co.uk/dp/0199681899?ref=ppx_pop_mob_ap_share

Forensic Focus events calendar - https://www.forensicfocus.com/events/

Si Twitter - https://twitter.com/si_biles

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_i41eg24YGZg

Deepfake Videos And Altered Images - A Challenge For Digital Forensics?

Forensic Focus 13th February 2023 10:30 am

Load More... Subscribe

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.