Skip to content

Belkasoft

Belkasoft is a digital forensic software manufacturer since 2002. The company develops a range of forensic products aimed at law enforcement officials, investigators and experts in IT security and intelligence. The company delivers solutions that work right out of the box, without requiring a steep learning curve or any specific skills to operate. Belkasoft is registered within DUNS, SAM, CCR, ORCA and WAWF. 'Belkasoft' is a registered trademark.

Products

The company's flagship product is Belkasoft Evidence Center, an all-in-one digital forensic solution. Belkasoft Evidence Center makes it easy for an investigator to acquire, search, analyze, store and share digital evidence found inside computer and mobile devices, RAM and cloud. The toolkit will quickly extract digital evidence from multiple sources by analyzing hard drives, drive images, cloud, memory dumps, iOS, Blackberry and Android devices, GrayKey, UFED, OFB, ZIP/TAR, TWRP images, JTAG, and chip-off dumps. Evidence Center X automatically analyzes the data source and lays out the most forensically important artifacts for an investigator to review, examine more closely or add to a report.

Belkasoft Evidence Center

The Belkasoft Evidence Center X is a commercial forensic solution for acquiring, locating, extracting, and analyzing digital evidence stored inside computers and mobile devices.

The toolkit acquires and analyzes digital evidence from multiple sources including hard drives, drive images, memory dumps, mobile devices and chip-off dumps. Discovers 1500+ types of artifacts, including 300+ mobile applications, as well as major document formats, browsers, email clients, dozens of picture and video formats, instant messengers, social networks, system and registry files, P2P and file transfer tools, etc.

Key features

  • Built-in acquisition of multiple types of digital devices and clouds
  • Automated extraction and analysis of 1500+ types of evidence for both mobile and computer devices
  • Destroyed and hidden evidence recovery via data carving, Volume Shadow Copy recovery and other means
  • In-depth SQLite forensics including freelist, WAL and journal file analysis as well as SQLite Unallocated
  • Live RAM analysis
  • Connection graph with communities detection
  • Investigation of corporate incidents
  • Cross-case search
  • Adjustable reports

Belkasoft Triage (Belkasoft T)

Belkasoft Triage is a new digital forensic and incident response tool developed specifically for a quick analysis of a live computer and making a partial image of important data.

Belkasoft T is designed to assist in situations when an investigator or a first responder is at the scene of incident and needs to quickly identify and obtain specific digital evidence stored on a Windows machine.

The product is irreplaceable in situations of time pressure, when there is a need to quickly detect presence of specific data and obtain investigative leads instead of conducting an in-depth analysis of all the digital evidence.

Key features

  • Launch Belkasoft Triage from a dongle connected to a device being investigated
  • Detect 1500+ types of computer, mobile and cloud artifacts such as emails, chats, browsers, system settings and others
  • Automatically acquire a computer RAM dump
  • Detect presence of virtual machines, memory files and mobile backups
  • Detect skin tone in found pictures
  • Calculate file hash values and show an immediate alert on files with known hashes
  • Stop the analysis at any time once you got enough information
  • Export discovered results partially or entirely
  • Select evidence to be included into the resulting image
  • Use the same dongle to store the image

Belkasoft Remote Acquisition (Belkasoft R)

Belkasoft Remote Acquisition (Belkasoft R) is a new digital forensic and incident response tool developed specifically for forensically sound remote extractions of hard and removable drives, RAM, connected mobile devices, and even specific types of data. Belkasoft R will be useful in cases when an incident response analyst or a digital forensic investigator needs to gather evidence quickly and the devices in question are situated in geographically distributed locations

Key features

  • Ease of agent deployment
  • Support for Windows and macOS operating systems
  • Straightforward acquisition
  • Mobile device support
  • Support for various network configurations
  • Quick partial acquisition
  • Network bandwidth management with flexible image upload scheduling
  • Management of a large network consisting of various devices under your control

Belkasoft Acquisition Tool (BelkaImager)

The Belkasoft Acquisition Tool (BelkaImager) is a free forensic imaging utility developed by Belkasoft. Four types of data sources are currently supported:

  • Hard and removable drives
  • Mobile devices
  • Windows RAM memory
  • Cloud data

The acquired image can be then analyzed with Belkasoft Evidence Center or any similar third-party tool.

Hard and removable drive imaging

BelkaImager can acquire hard drives, SSD drives and removable drives connected to a computer, laptop or tablet. The drive can be acquired as DD or E01 image. Physical or logical acquisition can is performed.

Mobile device acquisition

The product acquires data from Android and iOS devices (iPhones, iPads).

RAM capturing

RAM memory of a running Windows computer, laptop or tablet can be dumped in a raw format.

Cloud data downloading

BelkaImager can download data from a number of cloud services such as iCloud and Google Drive.

Free tools

In addition to commercial products, Belkasoft offers a range of free forensic tools.

Belkasoft Live RAM Capturer is a tiny free forensic tool to reliably extract the entire content of the computer's volatile memory - even if protected by an active anti-debugging or anti-dumping system. Memory dumps captured with Belkasoft Live RAM Capturer can be analyzed with any forensic tool including Live RAM Analysis in Belkasoft Evidence Center.

Belkasoft Evidence Reader enables Evidence Center users to share evidence collected with the main suite. Users of Evidence Reader can access evidence collected during an investigation from any computer, even if Belkasoft Evidence Center is not installed on that PC.

Belkasoft Live RAM Capturer

The Belkasoft Live RAM Capturer is a free volatile memory acquisition tool developed by Belkasoft. It allows to reliably extract the entire contents of computer's volatile memory – even if protected by an active anti-debugging or anti-dumping system. Separate 32-bit and 64-bit builds are available in order to minimize the tool's footprint as much as possible. Memory dumps captured with Belkasoft Live RAM Capturer can be analyzed with Live RAM Analysis in Belkasoft Evidence Center or any other similar product.

Bypassing Anti-Debugging and Anti-Dumping Protection

Acquiring volatile memory from a computer running a debugging protection or anti-dumping system is tricky. Most memory acquisition tools run in the system's user mode, and are unable to bypass the defense of such protection system (which run in the systems' most privileged kernel mode).

Belkasoft Live RAM Capturer is designed to work correctly even if an aggressive anti-debugging or anti-memory dumping system is running. By operating in kernel mode, Belkasoft Live RAM Capturer plays on the same level with these protection systems, being able to correctly acquire address space of applications protected with the most sophisticated systems such as nProtect GameGuard.

Compatibility and System Requirements

Belkasoft Live RAM Capturer is compatible with 32-bit and 64-bit editions of Windows including XP, Vista, Windows 7/8/10, 2003 and 2008 Server. The tool does not require installation, and can be launched from a USB thumb drive.

Customer Base

Belkasoft customers include government and private organizations in more than 130 countries, including the FBI, US Army, DHS, police departments in Germany, Norway, Australia and New Zealand, PricewaterhouseCoopers, and Ernst & Young.