December 2018
Beginner to intermediate
328 pages
8h 29m
English
Different features of BEC are spread across multiple tabs. Let's look at some of them, starting with Case Explorer:

Here we have the number of artifacts extracted after processing, in our case it's 210. The actual data can be viewed on the right pane. There are a number of view options: you can check the item's properties, or view it in its regular form or in hex. BEC also has a powerful SQLite browser that support extracting data from the Write-Ahead Log (WAL) and recovering deleted records from free lists and unallocated space.
Another useful tab is Timeline:
It's especially useful for Android ...
Read now
Unlock full access