This is the first part in a two-part series. You can read Part 2 here. In our previous blog post, “Telling the Story of Digital Evidence,” we outlined how the Connections feature in Magnet AXIOM automatically shows where key digital evidence came from, where it is currently located, who it was shared with and when … Continued
In digital forensics, demonstrating attribution—using operating system artifacts to prove that the suspect had knowledge of the document or image files found on a device—is one of the key elements of building a case. The ability to tell an evidentiary story is even better. How did a file get here? Where did it go—to whom … Continued
Our previous two blogs covered the reasons why we think file system forensics’ marginal returns are rapidly diminishing, and the changes in consumer electronics that continue to drive the need for a focus on artifacts and the apps they come from in digital forensics. In our final post, we’re discussing how the artifacts-oriented approach allows … Continued
The latest version of Magnet AXIOM is ready for customers to download either at the Customer Portal or when you open AXIOM. Magnet AXIOM 1.2.6 brings improvements to Cloud acquisition — including support for Google Hangouts — as well as an update to our Passware integration that uses a password dictionary list to attempt to … Continued
Our previous blog covered the reasons why we think file system forensics’ marginal returns are rapidly diminishing, and why we think the process needs to be balanced with a more efficient, artifacts-oriented approach that relies on the file system to verify and validate. In this blog, we offer the historical context for how we think … Continued
Digital forensics has relied on the file system for as long as hard drives have existed. The structures associated with File Allocation Tables (FAT), the New Technology File System (NTFS), Extended File System (EXT), and other file systems—as well as the partitions within—could be mined for file metadata, carved for deleted files, and accessed to … Continued
Magnet AXIOM supports many different services and platforms in its cloud product from Google, Microsoft, Facebook, Twitter, Dropbox, and many more. We also include a generic POP/IMAP connector to allow examiners to pull additional email services not explicitly included in the regular cloud providers. As long as the webmail provider supports either POP or IMAP, … Continued
There is a current misconception by many in the mobile forensics field that every acquisition method conducted on a mobile phone is specific to that model. Quite often, I will get requests from examiners asking for a list of mobile devices our tools support. I will often reply with a list of the models we … Continued
As a continuation of our series around analyzing mobile images in multiple tools, this blog is going to focus around using images created by MSAB XRY. For more information around the multi-tool approach and other image formats, see our intro blog here. MSAB XRY creates both physical and logical forensic images in a proprietary format … Continued
As a continuation of our blog series around using multiple tools to be successful in your forensic investigations, this post is going to look at loading images from Oxygen into AXIOM. You can read the intro blog here which will also link to others in the series. Oxygen allows you to archive extraction and case data … Continued
