StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.Belkasoft
Belkasoft X Forensic
Belkasoft X is a single tool for computer, mobile, drone, vehicle and cloud evidence. Belkasoft sells X Forensic to government customers and X Corporate to businesses, both on a perpetual licence.
PlatformCommercialCurrent
Profile
- Manufacturer
- Belkasoft
- Category
- Computer forensics
- Product type
- Platform
- Platforms
- Not stated by the manufacturer
- Licensing
- Commercial
- Product status
- Current
- Educational level
- Intermediate
- Last verified
- 2 November 2026
Belkasoft's page heading reads Belkasoft X Forensic and the page also uses the name Belkasoft Evidence Center X. It states that X Forensic is offered to government customers only and lists X Corporate for business, including Belkasoft Remote Acquisition. The licence is described as perpetual. The operating systems named on the page are those it can examine, not the host, so platforms are left empty.
What Belkasoft X Forensic is
Belkasoft's page also calls the product Belkasoft Evidence Center X, a reminder of the Evidence Center name it carried for years. The tool acquires and analyses. On the computer side it images hard and removable drives into DD or E01 with optional hash verification and parses disk images, virtual machines and memory dumps. On the mobile side it lists agent-based and checkm8-based acquisition, iTunes backups and jailbroken devices for iOS, with ADB and rooted-device methods for Android. Drones, vehicle exports from Berla and cloud sources such as Google, iCloud, Microsoft 365, WhatsApp and Telegram are also listed.
Two features matter for a learner. Native SQLite parsing is built to read damaged and incomplete databases and bring back deleted records, which is where much app evidence sits. Carving recovers files and fragments from unallocated space. Belkasoft also sells BelkaGPT Hub to spread AI processing over machines with graphics cards and gives away two small tools, Belkasoft Triage and Live RAM Capturer. X Corporate, the edition for business, includes Belkasoft Remote Acquisition for collecting from distant computers and phones. The page says X Forensic is offered to government customers only.
Primary applications
Where it is used
- Examining a computer image, a phone extraction and a cloud return in one case
- iOS and Android acquisition with the methods the device and its state allow
- Recovering deleted app records from damaged SQLite databases
- Memory analysis for private browsing and cleared history evidence
- Drone and vehicle data review
- Remote acquisition in corporate investigations through X Corporate
Who uses it
- Government and police laboratories
- Corporate investigation teams using X Corporate
- Examiners who want one tool across computer and mobile evidence
- Students learning SQLite recovery and carving
Capabilities and limits
Major capabilities
- Drive imaging to DD and E01 with hash verification
- Parsing of disk images, virtual machines and RAM dumps
- iOS acquisition by agent, checkm8, iTunes backup and jailbroken-device methods
- Android acquisition by ADB and rooted-device methods
- Cloud acquisition from sources including Google, iCloud, Microsoft 365, WhatsApp and Telegram
- Drone artefacts and Berla vehicle export analysis
- Native SQLite parsing with recovery of deleted and corrupted records
- File carving from unallocated space
- Perpetual licence rather than a term subscription
Technical limitations
- X Forensic is sold to government customers only; others must look at X Corporate
- checkm8 and rooted or jailbroken methods depend on device model and state and change evidence state, so they need authority and documentation
- The page lists the systems it can examine but not the operating system the software runs on, so the platform is left empty
- Cloud acquisition is an action on a third-party system and must sit inside the legal authority for the case
- AI features need validation and human review before anything they suggest is reported
Learning with DFRTI
Independent professional education covering the principles and workflows of Belkasoft X Forensic. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- File systems, imaging and hashing
- SQLite structure, including free pages and write-ahead logs
- Mobile acquisition methods and their legal and evidential consequences
Disciplines
Related tools
- Magnet AxiomAxiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.Magnet Forensics
- OpenText Forensic (EnCase)EnCase Forensic, one of the oldest names in computer forensics, is now called OpenText Forensic (EnCase). OpenText says it is the same product, renamed to fit its cybersecurity portfolio.OpenText
- Exterro FTK Forensic ToolkitFTK is the Forensic Toolkit that AccessData built and Exterro has owned since late 2020. Today Exterro sells it as Exterro FTK in a standalone form and as FTK Central for teams, with FTK Imager alongside.Exterro
- X-Ways ForensicsX-Ways Forensics is the German examination tool that runs light, starts fast and gives the examiner the raw disk alongside the parsed view. Version 21.9 was current when this page was checked.X-Ways Software Technology AG
- Oxygen Forensic DetectiveOxygen Forensic Detective is an all-in-one extraction and analysis tool for phones, cloud accounts, drones and other connected devices. On 2 November 2026 the maker's website could not be checked, so this profile is marked unverified.Oxygen Forensics
- MOBILedit ForensicCompelson now sells its phone forensics tool as MOBILedit Forensic. The Forensic Express name survives only in old web addresses. The product comes in editions, from a single-phone licence to the ULTRA edition that the maker classes as a dual-use item.Compelson
- Volatility 3Volatility 3 reads a memory image and rebuilds what the operating system knew at the moment of capture: processes, connections, loaded modules, handles and code that never touched the disk. It replaced Volatility 2, which is now archived.The Volatility Foundation
Courses that cover this tool
StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.
MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reports
MobileMobile & IoT ForensicsiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone cases
MalwareIncident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.
MobileMobile & IoT ForensicsDrone ForensicsRecover DJI flight logs, GPS tracks and home points from drones, controllers and phone appsAdvancedAdvanced & Specialised ForensicsAutomotive / Vehicle ForensicsRecover paired phones, trip logs and events from infotainment and telematics unitsOfficial source
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.