Blog

New Features

Exporting URLs from Magnet AXIOM for Use with Web Page Saver

Hi!  Jessica Hyde here to share with you about how to take URLs of interest from Magnet AXIOM for capture with MAGNET Web Page Saver (WPS). MAGNET Web Page Saver is a free stand-alone tool that allows you to navigate to web pages and save the results. You can learn more about MAGNET Web Page Saver in this Tips and Tricks session with our CTO and Founder, Jad Saliba.

This post focuses on exporting content from Magnet AXIOM for use in MAGNET Web Page Saver. The full detailed workflow finding web pages of interest in a case, tag and export those results, capturing those web pages with WPS, and bringing the results back into AXIOM for combined reporting and analysis is demonstrated in this video by Tarah Melton.

This whole workflow may not always be needed—in some instances, you may start the case, export the results to view in WPS and those saved screenshots may be all that is needed. In other instances, you may be conducting searches with WPS to add other elements to a case that exists or a new case.

Identify Websites of Interest and Export

First, you will want to tag any artifacts containing URLs of interest in AXIOM—this could include both Web Related artifacts and/or artifacts in Refined Results.  In this example, I tagged several URLs from a memory image from the Potential Browser Activity category.

Tagging relevant web artifacts in AXIOM
Figure 1- Tagging relevant web artifacts in AXIOM

Once you are done, you will want to export these URLs so that they can be imported into WPS. WPS allows for the ingestion of delineated files. For this purpose, we can use a CSV export. In order to do this, I am using a custom export template. Directions on creating your own export templates can be found in this post. Alternatively, you can create a report and create a CSV export for these artifacts as demonstrated by Tarah Melton in this demo video showing how to use AXIOM with WPS.

Using the WPS_Export template
Figure 2- Using the WPS_Export template

First select the template—the template will automatically apply the appropriate artifacts. Then, you can select tagged items and, if applicable, the tag you designated for URLs you wished to export. By selecting the template first and then selecting tagged items, AXIOM will select only the artifacts identified in the export. If you are a Magnet AUTOMATE customer, you can use this export template in your automation.

On the next screen, you have the option to configure artifact details and columns. You can leave the defaults here. The template already knows to not include attachments and threads. Magnet WPS knows to ignore columns with other content, so you can simply leave this setting as “All columns”.

On the next screen, select “Create one report that includes all artifact types.” Save the report and you are ready to bring the results into WPS.

Exporting one CSV for use with WPS
Figure 3 – Exporting one CSV for use with WPS

Bringing WPS Export into WPS

Once you have your export you can now bring it into Magnet Web Page Saver. In WPS, Select Add URLs to get started.

Selecting Add URLs in WPS
Figure 4- Selecting Add URLs in WPS

A screen will pop up where you can manually enter URLs or Import URLs. We will select “Import from CSV file containing other fields” to add our export created in AXIOM.  

Adding AXIOM URL export to WPS
Figure 5 – Adding AXIOM URL export to WPS

Next, select your file and hit Open.  The URLs will be extracted from the export and will now display in your add URLs screen. If desired, you can add additional URLS to the bottom of the list. Hit Save and Close once this is complete. Next, WPS scans all the URLs you input and saves the content to the SQLite db.

URLs extracted from AXIOM export
Figure 6- URLs extracted from AXIOM export

Before hitting Start, you’ll want to verify your options. If you plan to bring your WPS results back into AXIOM, you will want to utilize the SQLite capture format.  AXIOM will then be able to parse the resultant SQLite database.

Selecting SQLite
Figure 7- Selecting SQLite

Now it is time to start the capture. Select Start with Automated Capture selected to begin the automated acquisition of all the web pages you requested!

Starting the acquisition
Figure 8- Starting the acquisition
Figure 9- WPS capturing from a list of URLs
Completed Capture in WPS
Figure 10- Completed Capture in WPS

Want to see WPS in action? Download Magnet Web Page Saver for free and give it a try!

Want to bring these results back into the case? Check out the Ingesting Web Page Saver Results into AXIOM blog post for details on this process.

If you have any questions or comments, feel free to reach out to me at jessica.hyde@magnetforensics.com.

Start modernizing your digital investigations today.

Ready to explore on your own? Start a Free Trial

Top