Belkasoft X Forensic

Today, a case rarely consists of a single device. A computer, two phones, a cloud account, perhaps a drone or a vehicle's infotainment system – and ultimately everything has to end up in the same timeline.

That's precisely what Belkasoft X Forensic is built for. Acquisition, analysis, and reporting run in one application, across all sources. You create a case, add data sources, and the analysis finds the artifacts – without you having to open a different tool for each device class.

The connection graph shows who had contact with whom, via which service, and how often. The timeline overlays the events from all sources. Both are not mere gimmicks, but rather the points where an investigative approach often first emerges.

With mobile devices, the acquisition method determines whether a case can even proceed. For iOS, Belkasoft X covers agent-based acquisition, checkm8, lockdown files, AFC, jailbroken devices, crash logs, and screen capture.

On the Android side, the range extends from ADB backup, agent-based methods, and rooted devices to EDL for Qualcomm, MTK, and Spreadtrum acquisition, APK downgrade, and wireless acquisition via an agent on the SD card. Chip-off and JTAG dumps, as well as images from GrayKey, UFED, and OFB, are also imported.

On the computer side, Windows, macOS, and Unix systems are included, along with disk images in EnCase, FTK, X-Ways, AFF4, L01, DD, DMG, and archive formats, virtual machines, RAM dumps, hibernation, and page files. File systems from APFS to BTRFS and NTFS to ext4 and XFS are read directly.

With BelkaGPT, Belkasoft brings an AI component directly into the analysis. You can ask questions in natural language about the case instead of sifting through tens of thousands of chat messages.

Version 2.11 from May 2026 added topic detection: chat messages are automatically sorted into predefined or self-defined classes. Additionally, an improved Q&A assistant with automatic speech recognition and speech-to-text was added to the BelkaGPT Hub.

Also new in 2.11: agent-based iOS acquisition for iOS 17 and 18, Telegram cloud acquisition via active Android sessions without two-factor authentication, Microsoft 365 with all login procedures, and a dedicated node under which all SQLite databases found in a data source are collected.

Belkasoft X Forensic is designed by the manufacturer for government agencies – law enforcement, investigative agencies, forensic labs at federal, state, and municipal levels. For businesses and service providers, there's the sister edition Belkasoft X Corporate, which you can also get from us.

A point that counts in budget planning: The license is perpetual. Belkasoft does not sell subscriptions that block analysis after expiration. For sharing cases with colleagues, prosecutors, or the court, there is the free Evidence Reader.

LanCologne is a Belkasoft partner and authorized training partner; the training is conducted by a Belkasoft-certified instructor. This means you get procurement, introduction, and training from a single source – in German, with a contact person in Cologne.

Belkasoft officially lists LanCologne as an Authorized Training Partner – you can see the certificate here. For you, this means you don't have to separate procurement and training: We train your team to the same standard we work at ourselves and remain your point of contact after the introduction.