Exporting URLs from Magnet AXIOM for Use with Web Page Saver
Hi! Jessica Hyde here to share with you about how to take URLs of interest from Magnet AXIOM for capture with MAGNET Web Page Saver (WPS). MAGNET Web Page Saver is a free stand-alone tool that allows you to navigate to web pages and save the results. You can learn more about MAGNET Web Page Saver in this Tips and Tricks session with our CTO and Founder, Jad Saliba.
This post focuses on exporting content from Magnet AXIOM for use in MAGNET Web Page Saver. The full detailed workflow finding web pages of interest in a case, tag and export those results, capturing those web pages with WPS, and bringing the results back into AXIOM for combined reporting and analysis is demonstrated in this video by Tarah Melton.
This whole workflow may not always be needed—in some instances, you may start the case, export the results to view in WPS and those saved screenshots may be all that is needed. In other instances, you may be conducting searches with WPS to add other elements to a case that exists or a new case.
Identify Websites of Interest and Export
First, you will want to tag any artifacts containing URLs of interest in AXIOM—this could include both Web Related artifacts and/or artifacts in Refined Results. In this example, I tagged several URLs from a memory image from the Potential Browser Activity category.
Once you are done, you will want to export these URLs so that they can be imported into WPS. WPS allows for the ingestion of delineated files. For this purpose, we can use a CSV export. In order to do this, I am using a custom export template. Directions on creating your own export templates can be found in this post. Alternatively, you can create a report and create a CSV export for these artifacts as demonstrated by Tarah Melton in this demo video showing how to use AXIOM with WPS.
First select the template—the template will automatically apply the appropriate artifacts. Then, you can select tagged items and, if applicable, the tag you designated for URLs you wished to export. By selecting the template first and then selecting tagged items, AXIOM will select only the artifacts identified in the export. If you are a Magnet AUTOMATE customer, you can use this export template in your automation.
On the next screen, you have the option to configure artifact details and columns. You can leave the defaults here. The template already knows to not include attachments and threads. Magnet WPS knows to ignore columns with other content, so you can simply leave this setting as “All columns”.
On the next screen, select “Create one report that includes all artifact types.” Save the report and you are ready to bring the results into WPS.
Bringing WPS Export into WPS
Once you have your export you can now bring it into Magnet Web Page Saver. In WPS, Select Add URLs to get started.
A screen will pop up where you can manually enter URLs or Import URLs. We will select “Import from CSV file containing other fields” to add our export created in AXIOM.
Next, select your file and hit Open. The URLs will be extracted from the export and will now display in your add URLs screen. If desired, you can add additional URLS to the bottom of the list. Hit Save and Close once this is complete. Next, WPS scans all the URLs you input and saves the content to the SQLite db.
Before hitting Start, you’ll want to verify your options. If you plan to bring your WPS results back into AXIOM, you will want to utilize the SQLite capture format. AXIOM will then be able to parse the resultant SQLite database.
Now it is time to start the capture. Select Start with Automated Capture selected to begin the automated acquisition of all the web pages you requested!
Want to see WPS in action? Download Magnet Web Page Saver for free and give it a try!
Want to bring these results back into the case? Check out the Ingesting Web Page Saver Results into AXIOM blog post for details on this process.
If you have any questions or comments, feel free to reach out to me at jessica.hyde@magnetforensics.com.