This course is ideal for those who require intermediate-level training with a digital investigation platform that covers cases involving smartphones, computers, or both. Magnet AXIOM goes beyond searching and processing artifacts by allowing deep analysis and enabling you to look at evidence in new ways.
Magnet AXIOM Examinations (AX200) is an intermediate-level course, designed for participants who are familiar with the principles of digital forensics, and seeking to use Magnet AXIOM for their investigations. At the conclusion of the four-day training course , participants will have the knowledge and skills they need to acquire forensic images from computer and smartphone evidence; configure Magnet AXIOM Process to recover the most-relevant artifacts; use Magnet AXIOM Examine to explore the evidence in greater depth, simplifying analysis activities by intuitively linking facts and data; and, preparing key artifacts for collaboration with other stakeholders. Each module of instruction employs extensive scenario-based exercises, to reinforce the learning objectives, and further enhance the participant’s understanding of AXIOM’s functionality, and its application within the forensic workflow.
Objectives of Magnet Axiom Examinations
- Installation of AXIOM and its core components, AXIOM Process and AXIOM Examine
- Configuration of AXIOM Process for the acquisition and processing of digital evidence, including the Single Stage Evidence Processing capabilities of AXIOM
- Identification and decryption of encrypted evidence images such as Bitlocker
- Analyzing case data in AXIOM Examine to focus on Artifact identification, extraction, and further investigation
- Use of AXIOM Acquire and Process to demonstrate basic iOS and Android imaging capabilities including the ingestion and examination of iOS and Android backups
- Utilization of hash sets, keywords, regular expressions, and filters to identify key artifacts
- Utilize the functionality of AXIOM Process to leverage Project VIC and CAID files as well as PhotoDNA to categorize images automatically
- Navigation within the evidence set, using the Artifact, File System, and Registry explorer functionality
- Using the Dynamic App Finder to discover SQLite databases and extract data from within and keep templates of those databases for use in future examinations
- Application of bookmarks, tags, and comments to prepare case evidence for exporting and reporting
- Using AXIOM Examine visualization tools such as timeline and worldmap view to emphasize user behavior patterns
- Enhance participant understanding of key artifacts; their locations and formats; the user and system behaviors which created them; and, the manner in which AXIOM recovers them
- Building intuitive reports and sharing and managing portable cases with stakeholders
Training Class Schedule
|Virtual Instructor-Led||Online (CST)||November 14-17|
|Classroom Instructor-Led||Costa Mesa, CA||November 28-December 1|
|Classroom Instructor-Led||Cardiff, UK||November 28-December 1|
|Virtual Instructor-Led||Online (CST)||December 12-15|
|Classroom Instructor-Led||Kansas City, MO||December 12-15|
|Classroom Instructor-Led||Herndon, VA||January 16-19|
|Virtual Instructor-Led||Online (CST)||January 30-February 2|
|Classroom Instructor-Led||Las Vegas, NV||January 30-February 2|
|Classroom Instructor-Led||Rancho Cordova, CA||February 20-23|
|Classroom Instructor-Led||Edmond, OK||February 20-23|
|Classroom Instructor-Led||Wyboston, UK||February 27-March 2|
|Classroom Instructor-Led||Herndon, VA||March 20-23|
|Virtual Instructor-Led||Online (CST)||March 26-29|
|Classroom Instructor-Led||Herndon, VA||April 17-20|
|Virtual Instructor-Led||Online (CST)||April 24-27|
|Classroom Instructor-Led||Houston, TX||May 15-18|
|Classroom Instructor-Led||Costa Mesa, CA||May 22-25|
|Virtual Instructor-Led||Online (CST)||June 12-15|
AXIOM Examinations Module Descriptions
Module 1: Intro and Installation of Magnet AXIOM
In this introductory module, participants will be presented with the learning objectives and expected outcomes for the four-day training event, and all related course materials. The module will conclude with hands-on exercises during which participants will install Magnet AXIOM, and learn about its associated programmatic components, AXIOM Process and AXIOM Examine.
Module 2: Evidence Processing and Case Creation
This module of instruction will focus on the many features available in AXIOM Process. At the conclusion of this module, participants will have the knowledge and skills necessary to successfully acquire forensic images from various evidence sources; configure case-specific and global settings in AXIOM Process for the recovery of key artifacts; and, create a case for analysis in AXIOM Examine. After the creation of the case, participants will be introduced to the AXIOM Examine interface, and the module includes instructor-led, and student practical exercises, to reinforce the learning objectives.
Module 3: Computer Artifact Analysis
The Computer Artifact Analysis section of the course is composed of several modules, each of which focusing on a specific set of key artifacts most commonly encountered during the analysis of computer evidence. The modules within this section will include presentations on Refined Results, Chat clients, Documents, Email, Media, Social Networking, Internet browsers, and operating system artifact analysis. For each of the modules, scenario-based instructor-led and student practical exercises will be used to demonstrate the navigation, searching, filtering, and tagging features in AXIOM, and reinforce the learning objectives.
Module 4: Mobile Artifact Analysis
The Mobile Artifacts Analysis section is composed of two modules, one focusing on iPhone artifacts, and the second on Android artifacts. Participants will explore smartphone evidence, parsed by Magnet AXIOM, from each operating system. In addition, the modules will explore the device file systems and structures to recover additional information, including device owner information; third party application data; core operating system data; Internet browser data; and, more. Scenario-based instructor-led, and student practical exercises will be used to demonstrate the navigation, searching, filtering, and tagging features in AXIOM, and reinforce the learning objectives.
Module 5: Reporting
In this final instructional module of the course, participants will explore the various exporting and reporting features available within AXIOM, used for the presentation of case evidence, and collaboration with other investigative stakeholders. Through the scenario-based instructor-led, and student practical exercises, participants will learn how to manage the exporting of artifacts; produce and merge portable cases; and, create a final investigative case report which is easily interpreted by both technical and non-technical recipients.
Module 6: Cumulative Review Exercises
Throughout the four-day training event, instructor-led and student practical exercises are used to reinforce the learning objectives and provide the participants with the knowledge and skills necessary to successfully utilize Magnet AXIOM in their investigative workflow. To further reinforce the instructional goals of the course, students are presented with a final scenario-based practical exercise which represents a cumulative review of the exercises conducted in each of the individual modules.