Belkasoft X Forensic vs Timesketch
Belkasoft X Forensic
belkasoft.comTimesketch
timesketch.orgSide by side
| Figure | Belkasoft X Forensic | Timesketch |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| iOS | Yes | — |
| Android | Yes | — |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Digital Forensics Software | 8.2 (#7) | 7.6 (#17) |
| Purpose | Belkasoft X Forensic acquires, analyzes, and reports digital evidence from computers, mobile devices, RAM, cars, drones, and cloud sources. | Timesketch is an open-source tool for collaborative forensic timeline analysis. |
| Security | Belkasoft says its license file is protected by a cryptographic signature to secure its integrity. | The installation guide documents optional TLS setup for the web server. |
| Support | Belkasoft lists [email protected] as its support contact. | The project lists user and developer mailing lists and a Timesketch Slack community as resources. |
Plans
In their own words
Belkasoft X Forensic
Belkasoft X Forensic acquires, analyzes, and reports digital evidence from computers, mobile devices, RAM, cars, drones, and cloud sources. Its acquisition options include DD/E01 imaging, iOS checkm8 and agent-based acquisition, and several Android methods. Analysis features include timeline and connection graph views, SQLite recovery, hash-set analysis, file carving, and picture and video analysis. The software can examine UFED and GrayKey images, virtual machines, Amazon S3-based images, Berla car exports, and data from services including Google Drive, iCloud, Microsoft 365, WhatsApp, and Telegram. Reports can be produced in formats such as HTML, XML, CSV, PDF, Excel, Word, ProjectVIC JSON, and Relativity Short Message Format. Colleagues can view shared findings with the free Evidence Reader, whether or not X Forensic is installed. The product is self-hosted and offered to government customers only. Its license is perpetual, with optional annual software maintenance and support; pricing is provided by quote. A 30-day trial requires internet access. Trial reports contain half of randomly selected artifacts, and several acquisition, decryption, virtual-machine, and command-line automation features are excluded. The company describes it as suited to digital forensic laboratories at federal and state-level law-enforcement agencies.
Timesketch
Timesketch is a free, open-source tool for collaborative forensic timeline analysis. A sketch normally represents one case and can contain multiple timelines, views, comments and stories. Investigators can search and filter timelines, inspect data in charts and save discoveries as views. Sketches may be private or shared with individuals, groups or all system users. Supported imports include Plaso storage files, CSV, JSON, JSONL, Pandas DataFrames, Python dictionaries and spreadsheet files. Python analyzers run in background workers to enrich events, add tags or create saved views; documented integrations include Sigma, Google Safe Browsing, BigQuery, Yeti and HashR. Sigma support is marked alpha with known performance and functionality issues. Timesketch offers a web interface, REST API and command-line client. Docker is the only tested and actively maintained installation method; documentation calls for Ubuntu 22.04 and at least 8 GB of RAM. Indexes depend on physical disk space, and searches may fail above 150 indices in a timeline. The self-hosted plan is free.