Belkasoft Evidence Center 2015 v.7.1 is out! What's new?
What's New in Version 7.1
We received fantastic feedback from our customers after announcing revolutionary release v.7.0 of Belkasoft Evidence Center. A lot of great ideas for improvement as well as noticed issues! In version 7.1 of Belkasoft Evidence Center 2015 we took a deep breath and focused on performance and usability improvements, as well as fixes for issues reported by our customers. We have also supported some new forensically important functions for both mobile and computer investigations, such as mounting iOS logical UFED images. Finally, the product is translated to Portuguese.
Upgrading to version 7.1 is free of charge to all customers with non-expired Extended Software Maintenance and Support contracts. New modules (such as File System and Scripting) are now available to purchase for any configuration of the tool (with v.7.0 it was only available for most advanced configuration).
Customers without the contract can purchase it from the Customer Portal. Affordable User Refresher Course is available for those who would like to catch up all recent improvements.
Issues fixed in v.7.1 of Belkasoft Evidence Center
Mobile devices
- Error with not adding found mobile backups, when searching inside a folder, is fixed. In the new version all nested backups are automatically added as a separate data source without a user having to add them manually.The analysis of such sources is also started automatically.
- Date for iMessages fixed.
- Android message direction fixed.
- Viber analyzer fixed.
- Odnoklassniki extraction improved.
Browsers
- Chrome cache data extraction fixed.
- Crash in IE carver fixed.
- Firefox date extraction improved.
Instant Messengers
- Kik Messenger crash fixed.
- MSN analysis fixed.
Reporting
- Cell background and borders fixed in exported PDF.
- Correct handling of links to attachments with spaces in HTML report added.
- Creating a report for carved data from Search window fixed.
- Attachment names validation improved to prevent incorrect symbol problem.
System files
- Crash during Shell bag extraction fixed.
- Mac OS logs false positives fixed.
- Registry search sometimes does not find "NTUser.dat" – fixed.
Pictures
- Problem of big/little endian EXIF fixed.
- Several crashes at picture preview fixed.
User interface
- Incorrect representation of bool value in SQLite Viewer fixed.
Other
- Incorrect behavior of Demo button at License dialog fixed (if you hit this issue, you can ask the trial version again).
- Analysis of a folder with no read access rights improved.
- Problem with not showing child data source after re-opening a case fixed.
- Possible loss of documents, pictures, event logs during asynchronous carving and file search fixed.
- Not loading automatically a case in Evidence Reader on startup fixed.
- Incorrect calculation of file dates fixed.
- Deflating of Evidence Reader to a target folder fixed.
- Portable version of the tool: startup problem fixed.
- Crash at Case Open window in configuration without Case Management fixed.
- Search Profiles wizard crash fixed.
- Imdisk mounting fixed for case when all available logical drive letters are used.
- VC90 runtime fixed (before it might have caused issues with older operating systems like XP).
Improvements and new features in v.7.1 of Belkasoft Evidence Center
Mobile devices
- iOS device name used instead of mdbd file name.
-
Android:
- Decryption of WhatsApp: both Crypt 7 and 8 are supported.
- Tinder support updated. UIN extraction improved.
- Foursquare app contact extraction added.
- BBM for Android supported.
- UIN extraction for SMS and call extraction improved.
- Growlr messenger supported.
- VK social network app supported.
- Google Maps analysis added (with a possibility to view geolocation data on the map and to create a report).
- Contact extraction improved for SMS.
- Odnoklassniki and Viber apps data extraction updated.
-
iOS (iPhone, iPad):
- Logical UFED images for iOS supported.
- Chrome iOS browser supported.
- Grindr app supported.
- UIN extraction for SMS and call extraction improved.
- IsDeleted column added for most of iOS analyzers.
- User notes extraction added.
- Google Maps analysis added (with a possibility to view geolocation data on the map and to create a report).
- Odnoklassniki and Viber extraction updated.
- iPhone data source now has nice Apple icon, rather than regular “drive” icon.
Browsers
- Passwords extraction is supported for Firefox versions 32 and newer.
- Carving of Internet Explorer version 10 supported.
- Access count was added for Chrome sites history.
- Browser cache visualization improved.
Instant Messengers
- "Read Status" added for a number of messengers.
- Skype chat sync extraction optimized.
- Instant messenger contact names are formatted as "UIN (Nick)".
- MailRu6 analysis improved.
- Skype analysis improved to work better with deleted and journal entries.
Reporting
- Export of found registry items supported.
- A report now can be created from Google Maps window of the tool. Particularly, locations for geo-enabled data from iPhone, Android and pictures can be shown and included to a report.
User interface
- Product interface and reports translated to Portuguese language.
- Case path added to the “Case Property” window.
- SQLite Viewer: Сorrupted data recovery improved.
- SQLite Viewer: Unallocated space support added. You can now review unallocated SQLite data in the Viewer, besides, the product tries to carve this data and see if it matches any known data format.
- While previous versions could analyze $LogFile and $MFT files, these types of analysis now added to the product interface explicitly, so that a user can select only them to analyze.
- GUI made much more responsive even while processor is heavy loaded with analysis.
Other
- yEnc format supported for decoding email attachments.
- yEnc carving supported.
- Dropbox decryption added (Windows XP and Vista supported).
- Mounting of more virtual machine types supported: XVA and VHD. VDI mounting improved.
Hundreds of other improvements and bugfixes made.