Blog

New Features

Ingesting Web Page Saver Results into Magnet AXIOM

Hi!  Jessica Hyde here to share with you about how to integrate results from the MAGNET Web Page Saver (WPS) tool into Magnet AXIOM. MAGNET Web Page Saver is a free stand-alone tool that allows you to navigate to webpages and save the results. You can learn more about MAGNET Web Page Saver in this Tips and Tricks session with our CTO and Founder, Jad Saliba.

Starting with AXIOM 4.4, you can bring your WPS results into AXIOM as a new source and have artifacts parsed from the results. This workflow is focused on ingesting exports from WPS. For details on exporting URLs from AXIOM for use with WPS check out the Exporting URLs from AXIOM for use with Web Page Saver blog.

Options in WPS

When using Web Page Saver with the intent of ingesting the results into AXIOM, you will want to utilize the SQLite capture format. AXIOM will then be able to parse the resultant SQLite Database. Before hitting Start, verify that the SQLite checkbox has been selected.

Selecting SQLite
Figure 1- Selecting SQLite

Now it is time to start the capture. Select Start with Automated Capture selected to begin the automated acquisition of all the webpages you requested.

Starting the acquisition
Figure 2- Starting the acquisition
WPS capturing from a list of URLs
Figure 3- WPS capturing from a list of URLs
Completed Capture in WPS
Figure 4- Completed Capture in WPS

Bringing WPS Results into AXIOM

AXIOM 4.4 introduces an artifact specific to parsing Web Page Saver results that were saved as a SQLite DB. You can introduce these results as a source to a new or existing case. Load this source as Computer > Windows > Load Evidence > Files and Folders > File Browser. Then select your SQLite DB. Once you get to artifact details, ensure you are using the MAGNET Web Page Saver artifact—this should be the only artifact necessary for processing this source.

Selecting the Magnet Web Page Saver Artifact in AXIOM
Figure 5- Selecting the Magnet Web Page Saver Artifact in AXIOM

Examine will then open and you will see your MAGNET Web Page Saver results in the Web Related artifacts in AXIOM. You will see three separate artifacts: MAGNET Web Page Saver Captured HTML, MAGNET Web Page Saver Captured Media, and MAGNET Web Page Saver Captured Webpages.

The MAGNET Web Page Saver Captured Webpages artifact will display the preview of the web page, extracted text, URL, and the Captured Date and Time. The capture date and time as well as the resultant MD5 hash may be valuable for the integrity of the data captured for the case.

Magnet Web Page Saver Captured Web Pages artifact
Figure 6- Magnet Web Page Saver Captured Web Pages artifact

Want to see WPS in action? Download MAGNET Web Page Saver for free and give it a try!

Looking for a more complete workflow where you discover URLs of interest in AXIOM, export them for capture in Web Page Saver and then bring those results back into AXIOM to complete reporting and analysis? Check out this video from Tarah Melton that walks through the entire workflow:

I hope this post is helpful in your analysis of URLs! How are you using MAGNET Web Page Saver in your investigations? Feel free to reach out and let me know at jessica.hyde@magnetforensics.com.

Start modernizing your digital investigations today.

Ready to explore on your own? Start a Free Trial

Top