Acquiring cloud evidence
Use AXIOM Cloud to get the most complete story using data from the cloud. In addition to cloud-based user accounts, you can ingest warrant return packages, user-requested archive files (for example, Google Takeout), and publicly available information from Twitter and Instagram.
With a Magnet AXIOM Cyber license, you can access Office 365and Google Workspace accounts with administrator credentials and selectively acquire evidence, and you can acquire evidence from Amazon S3 and EC2, and Microsoft Azure virtual machines.
AXIOM Cloud is available with a valid cloud license. To find out how to purchase a cloud license, contact sales@magnetforensics.com.
Changes to supported cloud services and content
When acquiring cloud evidence, AXIOM Process acquires live data. If a supported platform makes a change to their product, this change might affect the types of services or content AXIOM Process can acquire and process. For a current list of any known changes to our ability to acquire data from our supported platforms (including specific artifacts that might be impacted), please log in to the Customer Portal to read the following article: Status of supported cloud acquisition platforms.
For example, Google announced that it would begin blocking logins to Google accounts from embedded browser frameworks starting in June 2019 and began enforcing this change in January 2021. When this change comes into effect, AXIOM Process might not be able to support WhatsApp and the following data sources for Google accounts: Google Activity, Google Timeline Locations, Google Connected Apps, Recent Devices, Passwords, and Google Hangouts. For more information, log in to the Customer Portal to read the following article: Changes to supported data sources for Google accounts.
Note: Due to changes made to the iCloud backup protocol by Apple, as of Magnet AXIOM 4.6.0, support for acquiring iCloud Backups has been temporarily removed from AXIOM Process while we research a solution.