April 2023
Test Results for Mobile Device Acquisition Tool:
Belkasoft Evidence Center X v1.16.12797
Contents
Introduction ..................................................................................................................................... 1
How to Read This Report ............................................................................................................... 1
1 Results Summary .................................................................................................................... 2
2 Mobile Devices ....................................................................................................................... 5
3 Testing Environment............................................................................................................... 6
3.1 Execution Environment .................................................................................................. 6
3.2 Internal Memory Data Objects........................................................................................ 6
4 Test Results............................................................................................................................. 8
4.1 Android Mobile Devices................................................................................................. 9
4.2 iOS Mobile Devices...................................................................................................... 15
ii
Introduction
The Computer Forensics Tool Testing (CFTT) program is a joint project of the
Department of Homeland Security’s (DHS) Science and Technology Directorate, the
National Institute of Justice, and the National Institute of Standards and Technology’s
(NIST) Special Programs Office and Information Technology Laboratory. CFTT is
supported by other organizations, including the Federal Bureau of Investigation, the U.S.
Department of Defense Cyber Crime Center, U.S. Internal Revenue Service’s Criminal
Investigation Division Electronic Crimes Program, and U.S. Immigration and Customs
Enforcement, U.S. Customs and Border Protection and U.S. Secret Service. The objective
of the CFTT program is to provide measurable assurance to practitioners, researchers,
and other applicable users that the tools used in computer forensics investigations provide
accurate results. Accomplishing this requires the development of specifications and test
methods for computer forensics tools and subsequent testing of specific tools against
those specifications.
Test results provide the information necessary for developers to improve tools, users to
make informed choices, and the legal community and others to understand the tools’
capabilities. The CFTT approach to testing computer forensics tools is based on well-
recognized methodologies for conformance and quality testing. Interested parties in the
computer forensics community can review and comment on the specifications and test
methods posted on the CFTT website (https://www.cftt.nist.gov/).
This document reports the results from testing Belkasoft Evidence Center X v1.16.12797
across supported mobile devices.
Test results from other tools can be found on DHS’s computer forensics webpage at
https://www.dhs.gov/science-and-technology/nist-cftt-reports.
How to Read This Report
This report is divided into four sections. Section 1 identifies and provides a summary of
any significant anomalies observed in the test runs. This section is sufficient for most
readers to assess the suitability of the tool for the intended use. Section 2 identifies the
mobile devices used for testing. Section 3 lists testing environment, the internal memory
data objects used to populate the mobile devices. Section 4 provides an overview of the
test case results reported by the tool.
Test Results for Mobile Device Acquisition Tool
Tool Tested: Belkasoft Evidence Center X
Software Version: v1.16.12797
Supplier: Belkasoft
Address: 702 San Conrado Terrace, Unit 1
Sunnyvale, CA 94085
Phone: +1 (650) 272-0384
E-mail: sales@belkasoft.com
WWW: https://belkasoft.com/x
1 Results Summary
Belkasoft Evidence Center X v1.16.12797 was tested for its ability to acquire active data
from the internal memory of supported mobile devices.
The data reported for the devices below varies based upon the data extraction technique
supported. For instance, a physical and/or file system extraction will provide the user
with more data than a logical extraction. Each supported data extraction technique was
performed. Except for the following anomalies, the tool acquired all supported data
objects completely and accurately for all mobile devices tested.
Personal Information Management (PIM) data:
Contacts are partially reported. (Devices: Google Pixel 4, Google Pixel 6, Galaxy
S9, Galaxy S10, Galaxy Note 8, Galaxy Note 10, Galaxy Tab S7 FE, Galaxy Tab
S8, Huawei P20 Pro, iPhone 8, iPhone X, iPhone XR, iPhone SE, iPhone 11,
iPhone 13, iPhone 13 Pro, iPhone 13 Pro Max, iPhone 13 Mini)
Long contact entries are truncated. (Devices: iPhone 8, iPhone X, iPhone XR,
iPhone SE, iPhone 11, iPhone 13, iPhone 13 mini)
Calendar data is not reported. (Devices: Google Pixel 6, Google Pixel 6 Pro)
Calendar data is partially reported. (Devices: Google Pixel 4, Galaxy Tab S7 FE,
Galaxy Tab S8, Huawei P20 Pro)
Notes or Memo entries are not reported. (Devices: Google Pixel 4, Google Pixel
6, Google Pixel 6 Pro, Galaxy S9, Galaxy S10, Galaxy Note 8, Galaxy Note 10,
Galaxy Tab S7 FE, Galaxy Tab S8, Huawei P20 Pro)
Call log data (incoming, outgoing, missed calls) is not reported. (Devices: Google
Pixel 6, Google Pixel 6 Pro)
Belkasoft Page 2 of 19 Belkasoft Evidence Center X v1.16.12797
MMS Messages:
MMS (graphic, audio, video) messages are partially reported. (Devices: Google
Pixel 4, Google Pixel 6, Google Pixel 6 Pro, Galaxy S9, Galaxy S10, Galaxy Note
8, Huawei P20 Pro)
MMS (graphic, audio) messages are partially reported. (Device: Galaxy Note 10)
Stand-alone files:
Document files are not reported. (Devices: Galaxy Tab S7 FE, Galaxy Tab S8,
Huawei P20 Pro)
Social media Data:
Social media related data (TikTok) is not reported. (Devices: Google Pixel 6,
Galaxy Tab S7 FE, Galaxy Tab S8, iPhone 11)
Social media related data (LinkedIn, Instagram, Snapchat) is not reported.
(Devices: Galaxy S9, iPhone X). Social media related data (LinkedIn, Instagram,
Pinterest, Snapchat, WhatsApp) is not reported. (Device: Galaxy Note 8)
Social media related data (Facebook, Twitter, Instagram, Pinterest, Snapchat,
WhatsApp) is not reported. (Device: Google Pixel 6)
Social media related data (Facebook, Twitter, LinkedIn, Instagram, Pinterest,
Snapchat) is not reported. (Devices: Google Pixel 6 Pro, Galaxy Tab S7 FE,
Galaxy Tab S8)
Social media related data (Twitter, LinkedIn, Instagram, Pinterest, Snapchat) is
not reported. (Devices: Google Pixel 4, Galaxy Note 10, iPhone 8)
Social media related data (Pinterest, Snapchat) is not reported. (Device: Galaxy
S10)
Social media related data (WhatsApp) is partially reported. (Devices: Galaxy Tab
S7 FE, Galaxy Tab S8)
Social media related data (Facebook, Snapchat) is not reported. (Device: Huawei
P20 Pro)
Social media related data (Facebook) is not reported. (Device: iPhone 8)
Social media related data (Pinterest) is not reported. (Device: iPhone X)
Social media related data (Facebook, Twitter, LinkedIn, Pinterest, Snapchat) is
not reported. (Devices: iPhone XR, iPhone SE, iPhone 11, iPhone 13, iPhone 13
Pro, iPhone 13 Pro Max, iPhone 13 Mini)
Social media data (LinkedIn, Instagram, Snapchat) is not reported. (Device:
Galaxy S9)
Internet Data:
Internet data (browser history, bookmarks, and emails) is not reported. (Devices:
Google Pixel 4, Google Pixel 6, Google Pixel 6 Pro, Galaxy S9, Galaxy S10,
Galaxy Note 8, Galaxy Note 10, Galaxy Tab S7 FE, Galaxy Tab S8, Huawei P20
Pro, iPhone X)
Internet data (emails) is not reported. (Device: iPhone 11)
Belkasoft Page 3 of 19 Belkasoft Evidence Center X v1.16.12797
GPS Location Data:
GPS related data (coordinates, locations, geotagged pictures & videos) is not
reported. (Devices: Google Pixel 4, Google Pixel 6, Google Pixel 6 Pro, Galaxy
S10, Galaxy Note 10, Galaxy Tab S7 FE, Galaxy Tab S8, Huawei P20 Pro)
GPS related data (coordinates, locations, geotagged pictures and videos) is
partially reported. (Devices: iPhone 8, iPhone X)
NOTES:
The Android devices must be rooted for the tool to report the equipment related
data (IMEI). None of the devices used during testing fall under such conditions,
therefore no IMEI was reported for any of the devices.
For more test result details see section 4.
Belkasoft Page 4 of 19 Belkasoft Evidence Center X v1.16.12797
2 Mobile Devices
The following table lists the mobile devices used for testing Belkasoft Evidence Center X
v1.16.12797.
Make
Model Name
OS
Model #
CDMA
8
iOS 11.3.1
15E302
CDMA
X
iOS 11.3.1
15E302
CDMA
XR
iOS 15.1
NQCK2LL/A
CDMA
SE
iOS 15.1
MX9N2LL/A
CDMA
11
iOS 15.1
15E302
CDMA
13
iOS 15.6
MNGD3LL/A
CDMA
13 Pro
iOS 15.6
MNDT3LL/A
CDMA
13 PRO Max
iOS 15.6
MNCP34LL/A
CDMA
13 Mini
iOS 15.6
MNF83LL/A
CDMA
Pixel 4
Android 10
G0201
CDMA
Pixel 6
Android 12
GR1YH
CDMA
Pixel 6 Pro
Android 12
GF5KQ
CDMA
S9
Android 8.0.0
SM-G960U1
CDMA
S10
Android 9
SM-G973U1
CDMA
Note 8
Android 7.1.1
SM-N950U1
CDMA
Note 10
Android 9
SM-N97OU1
CDMA
Tab S7 FE
Android 12
R52T50EMQ6V
CDMA
Tab S8
Android 12
SM-X700
CDMA
9
Android 11
LE2115
CDMA
10 Pro
Android 12
NE2215
CDMA
P20 Pro
Android 8.1.0
CLTL29810106
(C636)
CDMA
Z Fold3 5G
Android 12
SM-F926U1
CDMA
Table 1: Mobile Devices
Belkasoft Page 5 of 19 Belkasoft Evidence Center X v1.16.12797
3 Testing Environment
The tests were run in the NIST CFTT lab. This section describes the selected test
execution environment, and the data objects populated onto the internal memory of
mobile devices.
3.1 Execution Environment
Belkasoft Evidence Center X v1.16.12797 was installed on Windows 10 Pro version
10.0.19044 Build 19044.
3.2 Internal Memory Data Objects
Belkasoft Evidence Center X v1.16.12797 was measured by analyzing acquired data
from the internal memory of pre-populated mobile devices. Table 2 defines the data
objects and elements used for populating mobile devices provided the mobile device
supports the data element.
Data Objects
Data Elements
Address Book Entries
Regular Length
Maximum Length
Special Character
Blank Name
Regular Length, email
Regular Length, graphic
Regular Length, Address
Deleted Entry
Non-Latin Entry
Contact Groups
PIM Data: Datebook/Calendar; Memos
Regular Length
Maximum Length
Deleted Entry
Special Character
Blank Entry
Call Logs
Incoming
Outgoing
Missed
Incoming – Deleted
Outgoing – Deleted
Missed - Deleted
Belkasoft Page 6 of 19 Belkasoft Evidence Center X v1.16.12797
Data Objects Data Elements
Text Messages Incoming SMS – Read
Incoming SMS – Unread
Outgoing SMS
Incoming EMS – Read
Incoming EMS – Unread
Outgoing EMS
Incoming SMS – Deleted
Outgoing SMS – Deleted
Incoming EMS – Deleted
Outgoing EMS – Deleted
Non-Latin SMS/EMS
MMS Messages Incoming Audio
Incoming Graphic
Incoming Video
Outgoing Audio
Outgoing Graphic
Outgoing Video
Application Data Device Specific App Data
Stand-alone data files Audio
Graphic
Video
Audio – Deleted
Graphic - Deleted
Video - Deleted
Internet Data Visited Sites
Bookmarks
E-mail
Location Data GPS Coordinates
Geo-tagged Data
Social Media Data Facebook
Twitter
LinkedIn
Instagram
Pinterest
Snapchat
WhatsApp
Table 2: Internal Memory Data Objects
Belkasoft Page 7 of 19 Belkasoft Evidence Center X v1.16.12797
4 Test Results
This section provides the test cases results reported by the tool. Sections 4.1 through 4.2
identify the mobile device operating system type, media type such as Android, iOS and
UICCs, the make and model of mobile devices used for testing Belkasoft Evidence
Center X v1.16.12797.
The Test Cases column (internal memory acquisition) in sections 4.1 through 4.2 are
comprised of two sub-columns that define a particular test category and individual sub-
categories that are verified when acquiring the internal memory for supported mobile
devices and UICCs within each test case. Each individual sub-category row results for
each mobile device/UICC tested. The results are as follows:
As Expected: the mobile forensic application returned expected test results – the tool
acquired and reported data from the mobile device/UICC successfully.
Partial: the mobile forensic application returned some of data from the mobile
device/UICC.
Not As Expected: the mobile forensic application failed to return expected test results –
the tool did not acquire, or report supported data from the mobile device/UICC
successfully.
NA: Not Applicable – the tool does not provide support for the acquisition for a particular
data element.
Belkasoft Page 8 of 19 Belkasoft Evidence Center X v1.16.12797
4.1 Android Mobile Devices
The internal memory contents for Android devices were acquired and analyzed with
Belkasoft Evidence Center X v1.16.12797. All test cases pertaining to the acquisition of
supported Android devices were successful except for the following across all Android
devices.
Contacts partially reported for the Google Pixel 4, Google Pixel 6, Galaxy Note 8,
Galaxy Tab S7 FE, Galaxy Tab S8. Graphic file associated with a contacts entries
are not reported.
Long contact entry is truncated for the Galaxy Tab S7 FE and Galaxy Tab S8.
Contacts partially reported for the Galaxy Note 10. Graphic file associated with a
contacts entries are reported separately under the pictures category for the Galaxy
S9, Galaxy S10, Galaxy Note 10 and Huawei P20 Pro.
Calendar event entries are not reported for the Google Pixel 6, Google Pixel 6
Pro, Galaxy Tab S7 FE.
Calendar event location and a note added to an event was the only calendar data
reported for the Google Pixel 4, Galaxy Tab S7 FE, Galaxy Tab S8 and Huawei
P20 Pro.
Memo or Note entries are not reported for the Google Pixel 4, Google Pixel 6,
Google Pixel 6 Pro, Galaxy S9, Galaxy S10, Galaxy Note 8, Galaxy Note 10,
Galaxy Tab S7 FE, Galaxy Tab S8 and Huawei P20 Pro.
Call log data (incoming, outgoing, missed calls) is not reported for the Google
Pixel 6, Google Pixel 6 Pro.
MMS attachments are not reported together with the text portion of the message
for the Google Pixel 4, Google Pixel 6, Google Pixel 6 Pro, Galaxy S9, Galaxy
S10, Galaxy Note 8 and Huawei P20 Pro.
MMS outgoing audio are found under cloud files category.
Incoming MMS graphic, audio and video file attachments are not reported with
the text message but are reported under the audio and images categories for the
Google Pixel 4.
Incoming MMS graphic and audio file attachments are not reported with the text
message but are reported under the audio and images categories for the Galaxy
Note 10.
Incoming MMS audio and graphic file attachments are not reported with the text
message, but are reported under the audio and images categories for the Google
Pixel 6 Pro.
Outcoming MMS graphic and video file attachments are not reported with the text
message but are reported under their respective “images” and “videos” categories
for the Galaxy Note 10.
Outcoming MMS video and audio file attachments are not reported with the text
message, but are reported under their respective “videos” and “audio” categories
for the Google Pixel 6 Pro.
Outcoming MMS graphic, audio and video file attachments are not reported with
the text message but are reported under their respective “videos” and “audio”
categories for the Google Pixel 4.
PDF files are not reported for the Galaxy Tab S7 FE, Galaxy Tab S8 and Huawei
P20 Pro.
Belkasoft Page 9 of 19 Belkasoft Evidence Center X v1.16.12797
Social media related data (TikTok) is not reported for the Google Pixel 6, Galaxy
Tab S7 FE and Galaxy Tab S8.
Social media related data (Facebook, Twitter, LinkedIn, Instagram, Pinterest,
Snapchat) is not reported for the Google Pixel 6 Pro, Galaxy Tab S7 FE, and
Galaxy Tab S8.
Social media related data (LinkedIn, Instagram, Snapchat) is not reported for the
Galaxy S9.
Social media related data (Twitter, LinkedIn, Instagram, Pinterest, Snapchat) is
not reported for the Google Pixel 4 and Galaxy Note 10.
Social media related data (Pinterest, Snapchat) is not reported for the Galaxy S10.
Social media related data (WhatsApp) is partially reported for the Galaxy Tab S7
FE and Galaxy Tab S8. Tool only reports pictures from messages sent/received.
Social media related data (LinkedIn, Instagram, Pinterest, Snapchat, and
WhatsApp) is not reported for the Galaxy Note 8.
Social media related data (Facebook, Twitter, Instagram, Pinterest, Snapchat,
WhatsApp) is not reported for the Google Pixel 6.
Social media related data (Facebook, Snapchat) is not reported for the Huawei
P20 Pro.
Internet data (browser history, bookmarks, emails) is not reported for the Google
Pixel 4, Google Pixel 6, Google Pixel 6 Pro, Galaxy S9, Galaxy S10, Galaxy Note
8, Galaxy Note 10, Galaxy Tab S7 FE, Galaxy Tab S8 and Huawei P20 Pro.
GPS related data (coordinates, locations, geotagged pictures and videos) is not
reported for the Google Pixel 4, Google Pixel 6, Google Pixel 6 Pro, Galaxy S10,
Galaxy Note 10, Galaxy Tab S7 FE, Galaxy Tab S8 and Huawei P20 Pro.
NOTE:
Deleted data recovered for the Google Pixel 6 Pro: contacts, but its status was
reported as active, and stand-alone multimedia files.
Deleted data recovered for the Google Pixel 6: stand-alone audio, graphic and
video files, and .txt file.
The only acquisition method that was successful for the Galaxy Z Fold 3 5G was
MTP/PTP acquisition.
“Android Generic” profile was used to acquire the following devices: Galaxy Z
Fold 3 5G, Galaxy Note8, Galaxy Note 10, One Plus 9, One Plus 10 Pro, Google
Pixel 4, Google Pixel 6, Google Pixel 6 Pro, Huawei P20 Pro, Galaxy Tab S8 and
Galaxy Tab S7 FE. For the rest of the devices the tool provided its own profile.
Tool prompts the user to enter information for WhatsApp. Information not
available, therefore it was not entered for the purpose of this testing.
Tool message when trying to acquire the One Plus 10 Pro: “Acquisition finished
with errors.” However, no data was reported. Acquisition was attempted 3 times
using Android Debug Bridge (ADB) Backup and Advanced ADB Backup
methods.
Tool message when trying to acquire the One Plus 9: “Acquisition finished with
errors.” However, no data was reported in GUI, but media were saved in the case
folder. Acquisition was attempted three times using ADB Backup and Advanced
ADB Backup methods.
Tool message, “Acquisition finished with errors.” was shown when acquiring the
Google Pixel 6 and Google Pixel 6 Pro.
Belkasoft Page 10 of 19 Belkasoft Evidence Center X v1.16.12797
See Table 3a, 3b below for more details.
Internal Memory Acquisition
Belkasoft Evidence Center X v1.16.12797
Mobile Device Platform: Android
Test Cases:
Google
Pixel 4
Google
Pixel 6
Google
Pixel 6
PRO
Galaxy S9
Galaxy S10
Galaxy
Note 8
Galaxy
Note 10
Acquisition:
Acquire All
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Acquisition:
Disrupted
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Reporting:
Preview-Pane
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Reporting:
Generated Reports
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Equipment/User Data:
IMEI/MEID/ESN
NA
NA
NA
NA
NA
NA
NA
Equipment/User Data:
MSISDN
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
PIM Data:
Contacts
Partial
Partial
As
Expected
Partial
Partial
Partial
Partial
PIM Data:
Calendar
Partial
Not As
Expected
Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
PIM Data:
Memos/Notes
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Call Logs:
Incoming
As
Expected
Not As
Expected
Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Call Logs:
Outgoing
As
Expected
Not As
Expected
Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Call Logs:
Missed
As
Expected
Not As
Expected
Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
SMS Messages:
Incoming
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
SMS Messages:
Outgoing
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
MMS Messages:
Graphic
Partial
Partial
Partial
Partial
Partial
Partial
Partial
MMS Messages:
Audio
Partial
Partial
Partial
Partial
Partial
Partial
Partial
MMS Messages:
Video
Partial
Partial
Partial
Partial
Partial
Partial
As
Expected
Stand-alone Files:
Graphic
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Stand-alone Files:
Audio
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Belkasoft Page 11 of 19 Belkasoft Evidence Center X v1.16.12797
Test Cases:
Google
Pixel 4
Google
Pixel 6
Google
Pixel 6
PRO
Galaxy S9
Galaxy S10
Galaxy
Note 8
Galaxy
Note 10
Stand-alone Files:
Video
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Application Data:
Documents (txt, pdf files)
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Social Media Data:
Facebook
As
Expected
Not As
Expected
Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Social Media Data:
Twitter
Not As
Expected
Not As
Expected
Not As
Expected
As
Expected
As
Expected
As
Expected
Not As
Expected
Social Media Data:
LinkedIn
Not As
Expected
As
Expected
Not As
Expected
Not As
Expected
As
Expected
Not As
Expected
Not As
Expected
Social Media Data:
Instagram
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
As
Expected
Not As
Expected
Not As
Expected
Social Media Data:
Pinterest
Not As
Expected
Not As
Expected
Not As
Expected
As
Expected
Not As
Expected
As
Expected
Not As
Expected
Social Media Data:
Snapchat
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Social Media Data:
WhatsApp
As
Expected
Not As
Expected
As
Expected
As
Expected
As
Expected
Not As
Expected
As
Expected
Social Media Data:
TikTok
NA
Not As
Expected
As
Expected
NA
NA
NA
NA
Internet Data:
Bookmarks
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Internet Data:
History
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Internet Data:
Email
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
GPS Data:
Coordinates/Geo-tagged
Not As
Expected
Not As
Expected
Not As
Expected
As
Expected
Not As
Expected
As
Expected
Not As
Expected
Non-Latin Character:
Reported in native format
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Hashing:
Case File/ Individual Files
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Case File Data Protection:
Modify Case Data
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
SQLite Data:
Report Active Data
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
SQLite Data:
Run SQLite Commands
NA
NA
NA
NA
NA
NA
NA
Table 3a: Android Devices
Belkasoft Page 12 of 19 Belkasoft Evidence Center X v1.16.12797
Internal Memory Acquisition
Belkasoft Evidence Center X v1.16.12797
Mobile Device Platform: Android
Test Cases:
Galaxy Tab
S7 FE
Galaxy Tab
S8
Huawei
P20 Pro
Galaxy Z
Fold3 5G
Acquisition:
Acquire All
As
Expected
As
Expected
As
Expected
NA
Acquisition:
Disrupted
As
Expected
As
Expected
As
Expected
NA
Reporting:
Preview-Pane
As
Expected
As
Expected
As
Expected
NA
Reporting:
Generated Reports
As
Expected
As
Expected
As
Expected
NA
Equipment/User Data:
IMEI/MEID/ESN
NA
NA
NA
NA
Equipment/User Data:
MSISDN
As
Expected
As
Expected
As
Expected
NA
PIM Data:
Contacts
Partial
Partial
Partial
NA
PIM Data:
Calendar
Partial
Partial
Partial
NA
PIM Data:
Memos/Notes
Not As
Expected
Not As
Expected
Not As
Expected
NA
Call Logs:
Incoming
NA
NA
As
Expected
NA
Call Logs:
Outgoing
NA
NA
As
Expected
NA
Call Logs:
Missed
NA
NA
As
Expected
NA
SMS Messages:
Incoming
NA
NA
As
Expected
NA
SMS Messages:
Outgoing
NA
NA
As
Expected
NA
MMS Messages:
Graphic
NA
NA
Partial
NA
MMS Messages:
Audio
NA
NA
Partial
NA
MMS Messages:
Video
NA
NA
Partial
NA
Stand-alone Files:
Graphic
As
Expected
As
Expected
As
Expected
As
Expected
Stand-alone Files:
Audio
As
Expected
As
Expected
As
Expected
As
Expected
Stand-alone Files:
Video
As
Expected
As
Expected
As
Expected
As
Expected
Belkasoft Page 13 of 19 Belkasoft Evidence Center X v1.16.12797
Test Cases:
Galaxy Tab
S7 FE
Galaxy Tab
S8
Huawei
P20 Pro
Galaxy Z
Fold3 5G
Application Data:
Documents (txt, pdf files)
Not As
Expected
Not As
Expected
Not As
Expected
NA
Social Media Data:
Facebook
Not As
Expected
Not As
Expected
Not As
Expected
NA
Social Media Data:
Twitter
Not As
Expected
Not As
Expected
As
Expected
NA
Social Media Data:
LinkedIn
Not As
Expected
Not As
Expected
As
Expected
NA
Social Media Data:
Instagram
Not As
Expected
Not As
Expected
As
Expected
NA
Social Media Data:
Pinterest
Not As
Expected
Not As
Expected
As
Expected
NA
Social Media Data:
Snapchat
Not As
Expected
Not As
Expected
Not As
Expected
NA
Social Media Data:
WhatsApp
Partial Partial As
Expected
NA
Social Media Data:
TikTok
Not As
Expected
Not As
Expected
NA NA
Internet Data:
Bookmarks
Not As
Expected
Not As
Expected
Not As
Expected
NA
Internet Data:
History
Not As
Expected
Not As
Expected
Not As
Expected
NA
Internet Data:
Email
Not As
Expected
Not As
Expected
Not As
Expected
NA
GPS Data:
Coordinates/Geo-tagged
Not As
Expected
Not As
Expected
Not As
Expected
NA
Non-Latin Character:
Reported in native format
As
Expected
As
Expected
As
Expected
NA
Hashing:
Case File/ Individual Files
As
Expected
As
Expected
As
Expected
NA
Case File Data Protection:
Modify Case Data
As
Expected
As
Expected
As
Expected
NA
SQLite Data:
Report Active Data
As
Expected
As
Expected
As
Expected
NA
SQLite Data:
Run SQLite Commands
NA NA NA NA
Table 3b: Android Devices
Belkasoft Page 14 of 19 Belkasoft Evidence Center X v1.16.12797
4.2 iOS Mobile Devices
The internal memory contents for iOS devices were acquired and analyzed with Belkasoft
Evidence Center X v1.16.12797.
All test cases pertaining to the acquisition of supported iOS devices were successful
except for the following across all iOS devices.
Graphic files associated with contact entries are not reported for the iPhone 8,
iPhone X, iPhone XR, iPhone SE, iPhone 11, iPhone 13, iPhone 13 Pro, iPhone
13 Pro Max and iPhone 13 Mini.
Long contact entry is truncated for the iPhone 8, iPhone X, iPhone XR, iPhone
SE, iPhone 11, iPhone 13 and iPhone 13 Mini.
Social media related data (Facebook, Twitter, LinkedIn, Instagram, Pinterest,
Snapchat) is not reported for the iPhone 8.
Social media related data (LinkedIn, Instagram, Pinterest and Snapchat) is not
reported for the iPhone X.
Social media related data (Facebook, Twitter, LinkedIn, Pinterest, Snapchat) is
not reported for the iPhone XR, iPhone SE, iPhone 11, iPhone 13, iPhone 13 Pro,
iPhone 13 Pro Max and iPhone 13 Mini.
Social media related data (TikTok) is not reported for the iPhone 11.
Internet related data (browser history, bookmarks, emails) is not reported for the
iPhone X.
Internet related data (emails) is not reported for the iPhone 11.
GPS related data (latitude, longitude coordinates, geotagged pictures and videos)
is partially reported, only geotagged pictures are reported for the iPhone 8 and
iPhone X.
NOTE:
Acquisition method used, per device, to report results was the iTunes Backup.
However, the “Agent Backup” and “Checkm8” were also attempted, for the
supported devices, but without success due to the following reasons: the “Agent
Backup” requires a password and an Apple ID (which we don’t have set up on
testing devices) and “Checkm8” works on iOS 12+ and devices iOS were older.
Deleted data recovered for the iPhone XR, iPhone SE, iPhone 11, iPhone 13,
iPhone 13 Pro, iPhone 13 Pro Max and iPhone 13 Mini: memos but the tool
reported its status as “active.”
See Table 4a, 4b below for more details.
Belkasoft Page 15 of 19 Belkasoft Evidence Center X v1.16.12797
Internal Memory Acquisition
Belkasoft Evidence Center X v1.16.12797
Mobile Device Platform: iOS
Test Cases:
iPhone 8
iPhone X
iPhone XR
iPhone SE
iPhone 11
iPhone 13
Acquisition:
Acquire All
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Acquisition:
Disrupted
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Reporting:
Preview-Pane
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Reporting:
Generated Reports
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Equipment/User Data:
IMEI/MEID/ESN
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Equipment/User Data:
MSISDN
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
PIM Data:
Contacts
Partial
Partial
Partial
Partial
Partial
Partial
PIM Data:
Calendar
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
PIM Data:
Memos/Notes
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Call Logs:
Incoming
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Call Logs:
Outgoing
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Call Logs:
Missed
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
SMS Messages:
Incoming
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
SMS Messages:
Outgoing
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
MMS Messages:
Graphic
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
MMS Messages:
Audio
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
MMS Messages:
Video
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Stand-alone Files:
Graphic
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Stand-alone Files:
Audio
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Stand-alone Files:
Video
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Application Data:
Documents (txt, pdf files)
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Belkasoft Page 16 of 19 Belkasoft Evidence Center X v1.16.12797
Test Cases:
iPhone 8
iPhone X
iPhone XR
iPhone SE
iPhone 11
iPhone 13
Social Media Data:
Facebook
Not As
Expected
As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Social Media Data:
Twitter
Not As
Expected
As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Social Media Data:
LinkedIn
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Social Media Data:
Instagram
Not As
Expected
Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Social Media Data:
Pinterest
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Social Media Data:
Snapchat
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Social Media Data:
WhatsApp
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Social Media Data:
TikTok
NA
NA
NA
NA
Not As
Expected
NA
Internet Data:
Bookmarks
As
Expected
Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Internet Data:
History
As
Expected
Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Internet Data:
Email
As
Expected
Not As
Expected
As
Expected
As
Expected
Not As
Expected
As
Expected
GPS Data:
Coordinates/Geo-tagged
Partial
Partial
As
Expected
As
Expected
As
Expected
As
Expected
Non-Latin Character:
Reported in native format
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Hashing:
Case File/ Individual Files
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Case File Data Protection:
Modify Case Data
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
SQLite Data:
Report Active Data
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
SQLite Data:
Run SQLite Commands
NA
NA
NA
NA
NA
NA
Table 4a: iOS Devices
Belkasoft Page 17 of 19 Belkasoft Evidence Center X v1.16.12797
Test Cases:
iPhone 13
Pro
iPhone 13
Pro Max
iPhone 13
Mini
Acquisition:
Acquire All
As
Expected
As
Expected
As
Expected
Acquisition:
Disrupted
As
Expected
As
Expected
As
Expected
Reporting:
Preview-Pane
As
Expected
As
Expected
As
Expected
Reporting:
Generated Reports
As
Expected
As
Expected
As
Expected
Equipment/User Data:
IMEI/MEID/ESN
As
Expected
As
Expected
As
Expected
Equipment/User Data:
MSISDN
As
Expected
As
Expected
As
Expected
PIM Data:
Contacts
Partial
Partial
Partial
PIM Data:
Calendar
As
Expected
As
Expected
As
Expected
PIM Data:
Memos/Notes
As
Expected
As
Expected
As
Expected
Call Logs:
Incoming
As
Expected
As
Expected
As
Expected
Call Logs:
Outgoing
As
Expected
As
Expected
As
Expected
Call Logs:
Missed
As
Expected
As
Expected
As
Expected
SMS Messages:
Incoming
As
Expected
As
Expected
As
Expected
SMS Messages:
Outgoing
As
Expected
As
Expected
As
Expected
MMS Messages:
Graphic
As
Expected
As
Expected
As
Expected
MMS Messages:
Audio
As
Expected
As
Expected
As
Expected
MMS Messages:
Video
As
Expected
As
Expected
As
Expected
Stand-alone Files:
Graphic
As
Expected
As
Expected
As
Expected
Stand-alone Files:
Audio
As
Expected
As
Expected
As
Expected
Stand-alone Files:
Video
As
Expected
As
Expected
As
Expected
Application Data:
Documents (txt, pdf files)
As
Expected
As
Expected
As
Expected
Social Media Data:
Facebook
Not As
Expected
Not As
Expected
Not As
Expected
Belkasoft Page 18 of 19 Belkasoft Evidence Center X v1.16.12797
Test Cases:
iPhone 13
Pro
iPhone 13
Pro Max
iPhone 13
Mini
Social Media Data:
Twitter
Not As
Expected
Not As
Expected
Not As
Expected
Social Media Data:
LinkedIn
Not As
Expected
Not As
Expected
Not As
Expected
Social Media Data:
Instagram
As
Expected
As
Expected
As
Expected
Social Media Data:
Pinterest
Not As
Expected
Not As
Expected
Not As
Expected
Social Media Data:
Snapchat
Not As
Expected
Not As
Expected
Not As
Expected
Social Media Data:
WhatsApp
As
Expected
As
Expected
As
Expected
Social Media Data:
TikTok
NA NA NA
Internet Data:
Bookmarks
As
Expected
As
Expected
As
Expected
Internet Data:
History
As
Expected
As
Expected
As
Expected
Internet Data:
Email
As
Expected
As
Expected
As
Expected
GPS Data:
Coordinates/Geo-tagged
As
Expected
As
Expected
As
Expected
Non-Latin Character:
Reported in native format
As
Expected
As
Expected
As
Expected
Hashing:
Case File/ Individual Files
As
Expected
As
Expected
As
Expected
Case File Data Protection:
Modify Case Data
As
Expected
As
Expected
As
Expected
SQLite Data:
Report Active Data
As
Expected
As
Expected
As
Expected
SQLite Data:
Run SQLite Commands
NA NA NA
Table 4b: iOS Devices
Belkasoft Page 19 of 19 Belkasoft Evidence Center X v1.16.12797