Menlo Park, California (PRWEB)
June 20, 2017
Belkasoft updates Belkasoft Evidence Center 2017, offering new acquisition options to mobile forensic experts. Version 8.4 enables low-level physical acquisition of rooted Android devices, and enables logical and over-the-air extraction of iOS devices running the latest versions of iOS 10.
“Evidence Center is quickly becoming an all-in-one forensic acquisition and analysis tool,” says Yuri Gubanov, Belkasoft CEO. “What started as a dedicated desktop forensic tool now becomes a fully-featured suite that allows extracting, handling and analyzing evidence from a plethora of devices. The latest additions offer better compatibility with the last versions of iOS, and provide experts with a low-level acquisition option for rooted Android devices.”
Low-Level Android Extraction
Belkasoft Evidence Center 8.4 enables physical acquisition of Android devices. The new low-level acquisition algorithm requires superuser rights in order to access information. As a result, the physical acquisition method is designed to work on Android handsets that can be unlocked and either have root access already or can be rooted by the investigator.
Belkasoft’s physical acquisition technique works on all rooted devices regardless of encryption. While some other physical acquisition techniques may require unlocking the bootloader or making use of the low-level programming mechanism, most of those methods will fail to deliver meaningful evidence if full-disk encryption is enabled on the device. Notably, full-disk encryption is automatically enabled on Android handsets running Android 6.0 and newer, which, according to Google account for some 40.7% of all Android devices.
Belkasoft’s root-based extraction works regardless of the encryption status of a device. If a device is rooted, Belkasoft Evidence Center can successfully…