This course is ideal for those who require intermediate-level training with a digital investigation platform that covers cases involving smartphones, computers, or both. Magnet AXIOM goes beyond searching and processing artifacts by allowing deep analysis and enabling you to look at evidence in new ways.

Magnet AXIOM Examinations (AX200) is an intermediate-level course, designed for participants who are familiar with the principles of digital forensics, and seeking to use Magnet AXIOM for their investigations. At the conclusion of the four-day training course , participants will have the knowledge and skills they need to acquire forensic images from computer and smartphone evidence; configure Magnet AXIOM Process to recover the most-relevant artifacts; use Magnet AXIOM Examine to explore the evidence in greater depth, simplifying analysis activities by intuitively linking facts and data; and, preparing key artifacts for collaboration with other stakeholders. Each module of instruction employs extensive scenario-based exercises, to reinforce the learning objectives, and further enhance the participant’s understanding of AXIOM’s functionality, and its application within the forensic workflow.

Objectives of Magnet Axiom Examinations

  • Installation of AXIOM and its core components, AXIOM Process and AXIOM Examine
  • Configuration of AXIOM Process for the acquisition and processing of digital evidence, including the Single Stage Evidence Processing capabilities of AXIOM
  • Identification and decryption of encrypted evidence images such as Bitlocker
  • Analyzing case data in AXIOM Examine to focus on Artifact identification, extraction, and further investigation
  • Use of AXIOM Acquire and Process to demonstrate basic iOS and Android imaging capabilities including the ingestion and examination of iOS and Android backups
  • Utilization of hash sets, keywords, regular expressions, and filters to identify key artifacts
  • Utilize the functionality of AXIOM Process to leverage Project VIC and CAID files as well as PhotoDNA to categorize images automatically
  • Navigation within the evidence set, using the Artifact, File System, and Registry explorer functionality
  • Using the Dynamic App Finder to discover SQLite databases and extract data from within and keep templates of those databases for use in future examinations
  • Application of bookmarks, tags, and comments to prepare case evidence for exporting and reporting
  • Using AXIOM Examine visualization tools such as timeline and worldmap view to emphasize user behavior patterns
  • Enhance participant understanding of key artifacts; their locations and formats; the user and system behaviors which created them; and, the manner in which AXIOM recovers them
  • Building intuitive reports and sharing and managing portable cases with stakeholders

Instructor-Led
Classroom/Virtual Classes

Register Now

Self-Paced
Online Class

Sign up now

Training Class Schedule

Class Type Location Dates
Self-Paced Online Online Ongoing
Virtual Instructor-Led Online (CST) November 14-17
Classroom Instructor-Led Costa Mesa, CA November 28-December 1
Classroom Instructor-Led Cardiff, UK November 28-December 1
Virtual Instructor-Led Online (CST) December 12-15
Classroom Instructor-Led Kansas City, MO December 12-15
Classroom Instructor-Led Herndon, VA January 16-19
Virtual Instructor-Led Online (CST) January 30-February 2
Classroom Instructor-Led Las Vegas, NV January 30-February 2
Classroom Instructor-Led Rancho Cordova, CA February 20-23
Classroom Instructor-Led Edmond, OK February 20-23
Classroom Instructor-Led Wyboston, UK February 27-March 2
Classroom Instructor-Led Herndon, VA March 20-23
Virtual Instructor-Led Online (CST) March 26-29
Classroom Instructor-Led Herndon, VA April 17-20
Virtual Instructor-Led Online (CST) April 24-27
Classroom Instructor-Led Houston, TX May 15-18
Classroom Instructor-Led Costa Mesa, CA May 22-25
Virtual Instructor-Led Online (CST) June 12-15

SEE THE RIGHT TRAINING COURSE FOR YOU?

REGISTER NOW! >

AUTHORIZED TRAINING PARTNER SCHEDULE

Classroom Instructor-Led Training

Location Dates  
Rome, Italy October 24-27
More Info
Milan/Crema, Italy October 24-27
More Info
Kandel, Germany October 24-27
More Info

AXIOM Examinations Module Descriptions

Module 1: Intro and Installation of Magnet AXIOM

In this introductory module, participants will be presented with the learning objectives and expected outcomes for the four-day training event, and all related course materials. The module will conclude with hands-on exercises during which participants will install Magnet AXIOM, and learn about its associated programmatic components, AXIOM Process and AXIOM Examine.

Module 2: Evidence Processing and Case Creation

This module of instruction will focus on the many features available in AXIOM Process. At the conclusion of this module, participants will have the knowledge and skills necessary to successfully acquire forensic images from various evidence sources; configure case-specific and global settings in AXIOM Process for the recovery of key artifacts; and, create a case for analysis in AXIOM Examine. After the creation of the case, participants will be introduced to the AXIOM Examine interface, and the module includes instructor-led, and student practical exercises, to reinforce the learning objectives.

Module 3: Computer Artifact Analysis

The Computer Artifact Analysis section of the course is composed of several modules, each of which focusing on a specific set of key artifacts most commonly encountered during the analysis of computer evidence. The modules within this section will include presentations on Refined Results, Chat clients, Documents, Email, Media, Social Networking, Internet browsers, and operating system artifact analysis. For each of the modules, scenario-based instructor-led and student practical exercises will be used to demonstrate the navigation, searching, filtering, and tagging features in AXIOM, and reinforce the learning objectives.

Module 4: Mobile Artifact Analysis

The Mobile Artifacts Analysis section is composed of two modules, one focusing on iPhone artifacts, and the second on Android artifacts. Participants will explore smartphone evidence, parsed by Magnet AXIOM, from each operating system. In addition, the modules will explore the device file systems and structures to recover additional information, including device owner information; third party application data; core operating system data; Internet browser data; and, more. Scenario-based instructor-led, and student practical exercises will be used to demonstrate the navigation, searching, filtering, and tagging features in AXIOM, and reinforce the learning objectives.

Module 5: Reporting

In this final instructional module of the course, participants will explore the various exporting and reporting features available within AXIOM, used for the presentation of case evidence, and collaboration with other investigative stakeholders. Through the scenario-based instructor-led, and student practical exercises, participants will learn how to manage the exporting of artifacts; produce and merge portable cases; and, create a final investigative case report which is easily interpreted by both technical and non-technical recipients.

Module 6: Cumulative Review Exercises

Throughout the four-day training event, instructor-led and student practical exercises are used to reinforce the learning objectives and provide the participants with the knowledge and skills necessary to successfully utilize Magnet AXIOM in their investigative workflow. To further reinforce the instructional goals of the course, students are presented with a final scenario-based practical exercise which represents a cumulative review of the exercises conducted in each of the individual modules.

Get Certified today!

NEW! Registration for the Magnet Certified Forensics Examiner (MCFE) – AXIOM is now open!

Learn More

Showcase your expertise and competence in Magnet IEF with our MCFE – IEF certification today!

Learn More
Magnet Image

Arrange Private or Custom Training for your Organization

Please contact us for details and availability, via email or call +1 844-638-7884.

Contact Us