Amazon S3 bucket

Step 1: Sign in to an AWS account

To sign in to and acquire S3 buckets, you must provide authentication details for the AWS account required for your organization's AWS configuration. Depending on your organization's AWS configuration, you might be prompted to provide additional authentication details. You can find these authentication details in the AWS Management Console. For more information about how to find each of the required authentication details, review the Find AWS authentication details article in the Magnet Forensics Customer Portal.

  1. In AXIOM Process, click Evidence sources > Cloud > Acquire evidence.
  2. Confirm that you have proper search authorization.
  3. Click Amazon.
  4. Provide the required authentication details for the AWS account.
  5. Click Sign in.

Step 2: Select a date range

After you gain access to the Amazon account, you can select a date range to acquire data from. By default, AXIOM Process acquires data from as far back in time as possible for the account. Acquiring some accounts can take a long time depending on the amount of data they contain, so you might want to narrow the date range to decrease the amount of time the acquisition takes.

  1. In the Date range drop-down list, select one of the following options:
    • To acquire data after a specified date, click After.
    • To acquire data before a specified date, click Before.
    • To acquire data between two specified dates, click Custom date range.
  2. Click the calendar icon and choose a date.

Step 3: Select services and content

After you gain access to the AWS account, you can specify that you want to acquire an S3 bucket, and then select the buckets or files that you want to download.

  1. In Select services and content, select the Amazon S3 files source type option.
  2. In the Content column, click Edit.
  3. Select the buckets or files that you want to acquire.
  4. To continue setting up your case, click Next

Supported data sources by authentication type

The following types of data can be acquired from an Amazon S3 bucket.

Amazon Web Services

Authentication type 2FA/MFA support Data sources
Security credentials ✓
  • AWS EC2 Instance
  • AWS S3 Files
Session credentials  
  • AWS EC2 Instance
  • AWS S3 Files

For a complete list of supported cloud data sources by authentication type, review supported cloud data sources by authentication type.