To start creating a new case in BEC, perform the following steps:
- Click New case button, fill the following fields:
- Case name: The case name or number.
- Root folder: The folder where the data from all the cases is stored.
- Case folder: The folder where the current case data is stored.
- Investigator: Examiner's name.
- Time zone: The time zone used for displaying timestamps (UTC is recommended).
- Description: The case overview:
- Create and open button will bring you to the next window that is, Add data source window:
Belkasoft provides testing images with the product, so we can use an Android backup for demonstration purposes. Of course, it's possible to use your own image, both logical and physical. If you do not have an image, but want to acquire one, you can choose the Mobile option from the Acquire and analyze section:
- As we decided to work with provided Android backup, we can just click Next and choose the artifacts we want to extract from it:
A good strategy would be to choose only Android-related artifacts, but sometimes choosing more artifacts may bring you better results, so if you have enough time, you can process the image with all types of artifacts selected.
As we are dealing with a logical image, the Carve option is unavailable. Working with physical images enables this option, so en examiner can use data carving to recover and extract more data.
- Clicking the Finish button will initialize the image-processing process. If you have only one image for the case, click the No button in the last window:
