702 San Conrado Terrace, Unit 1 Sunnyvale CA 94085 USA and Canada: +1 650 272 0384 Europe, other regions: +48 663 247 314 Web: https://belkasoft.com Email: [email protected] Belkasoft Evidence Center X User Reference Contents About ............................................................................................................................................... 7 What is this document about? .................................................................................................... 7 Other resources .......................................................................................................................... 7 Legal notes and disclaimers ........................................................................................................ 7 Introduction .................................................................................................................................... 9 What is Belkasoft Evidence Center (Belkasoft X) and who are its users? ................................... 9 Types of tasks Belkasoft X is used for ........................................................................................ 10 Typical Belkasoft X workflow .................................................................................................... 10 Forensically sound software ..................................................................................................... 11 When Belkasoft X uses the Internet ......................................................................................... 11 Why Belkasoft X? ...................................................................................................................... 12 Quick Start ..................................................................................................................................... 14 Installing Belkasoft X ................................................................................................................. 14 Belkasoft X Trial version limitations .......................................................................................... 21 Activating Belkasoft X license ................................................................................................... 22 Electronic License Activation ................................................................................................ 23 Trial Version Activation ......................................................................................................... 31 Floating (Dongle) License Activation ..................................................................................... 31 Home screen ............................................................................................................................. 34 Creating a case .......................................................................................................................... 34 Opening an existing case ........................................................................................................... 34 Adding a data source to a case ................................................................................................. 34 Creating a report ....................................................................................................................... 35 Dashboard ................................................................................................................................. 36 Artifacts ..................................................................................................................................... 37 File System ................................................................................................................................ 38 Timeline..................................................................................................................................... 39 Connection Graph ..................................................................................................................... 39 Incident Investigation ................................................................................................................ 40 Belkasoft Evidence Center X Editions ............................................................................................ 41 X Computer ............................................................................................................................... 41 Supported acquisition types ................................................................................................. 43 Supported extraction types .................................................................................................. 43 Supported analysis types ...................................................................................................... 44 Other functions ..................................................................................................................... 44 X Mobile .................................................................................................................................... 45 X Forensic .................................................................................................................................. 46 Belkasoft X user interface ............................................................................................................. 48 Home screen ................................................................................................................................. 49 Creating a case .......................................................................................................................... 50 Time zone setting for a case—and its importance ............................................................... 50 Opening a case .......................................................................................................................... 51 Other options and functions on Home ..................................................................................... 51 Opening Belkasoft X help ...................................................................................................... 51 Checking for updates ............................................................................................................ 51 Viewing Belkasoft X info ........................................................................................................ 51 Closing Belkasoft X ................................................................................................................ 51 Belkasoft X tutorials .............................................................................................................. 51 Accessing license info ............................................................................................................ 51 Dashboard ..................................................................................................................................... 52 Case Properties ......................................................................................................................... 52 Actions ...................................................................................................................................... 53 Automatic searches ................................................................................................................... 54 Data sources .............................................................................................................................. 54 Adding a new data source ..................................................................................................... 56 Case statistics ............................................................................................................................ 56 Application types ...................................................................................................................... 56 Artifacts ..................................................................................................................................... 57 Adding data source to a case ........................................................................................................ 59 Look for matches from a hashset database .............................................................................. 70 Artifacts ......................................................................................................................................... 74 Structure ................................................................................................................................... 74 Overview ................................................................................................................................... 75 Artifact list ................................................................................................................................. 76 Tools .......................................................................................................................................... 77 Properties .................................................................................................................................. 79 Top part ..................................................................................................................................... 79 File System ...................................................................................................................................