Exporting specialized outputs

Export evidence that is in a different language

If you want to share evidence that’s in a different language, export it to an Excel, HTML, or PDF file. Excel spreadsheets, HTML files, and PDF files support multi-line UTF-8 encoded text (for example, chat messages in different languages), so you won’t see display errors that are common in other types of exports (like .csv files).

1. In AXIOM Examine, select and right-click an artifact group or items that you want to export.
2. Click Create export / report.
3. Under Export / report format, click Excel, HTML, or PDF.
4. Follow the instructions to customize and create your export.

Export a chat thread

When you save a chat thread to your case, the file is named with the name of the chat application and the date and time stamp of the last message in the thread. For example, "Skype Chat Messages - 7_05_2016 3_09_04 PM."

1. In AXIOM Examine, in the Conversation view, right click the chat thread that you want to export.
2. Click Create report / export.
3. In the Export type drop-down list, select HTML or PDF.
4. Next to the File path field, click Browse and select where you want to save the export. Click Select folder.
5. In Items to include, select the chat threads that you want to export.
6. In Level of detail, complete one of the following options:
   • To save the information to one report, select High-level information
   • To create individual reports for each artifact type (for example, one report for Skype Chat Messages and another for GoogleTalk messages), select Detailed information .
7. Click Create.

Export media categorizations from a case to Project VIC or CAID

After you've categorized pictures and videos in your case, you can create a JSON export of the reviewer graded media to share with Project VIC or CAID. You can select the media items you want to include in the export such as graded media. If you have any media in your case that has been precategorized by CAID but is missing from their database, you can help them fill in these gaps by choosing the option to include attachments for media items that are missing from the CAID database. For more information about choosing which media items to include, see Items to include in your export. If you've enabled a pre-set media categorization country profile, the following categories are included in the export by default:

• Canada (Project VIC): Category 1
• International (Project VIC): Categories 1-2
• United Kingdom (CAID): All categories except 8
• United States (Project VIC): Categories 1-3

After you choose the category metadata you want to include, select the subset of categories you want to include attachments for in the export. Your export will include a .json file and a folder with attachments for included metadata items.

1. In AXIOM Examine, on the File menu, click Create report / export.
2. In the Export type drop-down list, click VICS 1.3 or VICS 2.0.
3. Next to the File path field, click Browse and select where you want to save the export. Click Select folder.
4. In Items to include, select the media options you want to include in your export.
5. In Contact information, provide your contact information so that other organizations can contact you if they get a match on one of your identifiers.
6. Click Create.

Export metadata

In the File system explorer, you can export the metadata associated with files or folders to a .csv file. By default, AXIOM Examine saves exported metadata to your case folder.

1. In AXIOM Examine, in the File system view, browse to the file or folder of interest.
2. In Evidence, right-click the item you want to export metadata for. To select multiple items, press CTRL and click the items. Then, right-click one of the highlighted items.
3. Click Export details.
4. Click Browse to location and select the location where you want to save the export. Enter a file name.
5. Click Save file.

Export timeline data

If you want to share evidence from the timeline, export it to a .csv file.

1. In AXIOM Examine, in the Timeline explorer, select and right-click items that you want to export.
2. Click Create report / export.
3. In the Export type drop-down list, click CSV.
4. Next to the File path field, click Browse and select the location you want to save the export. Click Select folder.
5. Click Create.

Export memory artifacts

You can use AXIOM Examine to export memory artifacts from your case to import into other tools. You can choose to export files based on their type:

• Process executable files (procdump)
• Dynamic link library files loaded by the process (dlldump)
• Memory associated with a particular process (memdump)
• Open files in memory (dumpfiles)
• Range of pages described by a VAD node (vaddump)

To export memory artifacts, complete the following steps:

1. In AXIOM Examine, right-click the memory artifact you want to export, and then click Export memory items.
2. In the Export memory items dialog, complete the following actions:
   1. In Export details, provide the Folder name and File path that you want to use.
   2. In Items to include, select the memory items that you want to export.
3. Click Export.

Print or export a connections map as a PDF

If you want to include a map of connections in your report, you can print it to paper or PDF. When you print a map, the primary node and focus nodes get included.

1. In AXIOM Examine, in the Connections explorer, right-click a node.
2. Click Print.
3. Follow the instructions on screen to print the map.

Export a connections map as an HTML file

If you want to include a map of connections in your HTML report, you can save the connections map as an HTML file.

1. In AXIOM Examine, in the Connections explorer, right-click anywhere in the map.
2. Click View source.
3. In the .txt file that appears, on the File menu, click Save as.
4. Browse to the location where you want to save the file.
5. Provide a File name ending in .html.
6. Click Save.