One of the most popular secure messaging apps currently on the market, Signal, stands apart from its competitors with a unique take on development. It’s open source, the subject of numerous independent audits, and ad-free. Signal is widely regarded as a role model showing how secure messaging ought to look. Today, Signal is wholly owned … Continued
Beginning in Magnet AXIOM 3.11, the dar file format (or Disk ARchive) is now supported for image processing. In Cellebrite-generated .dar files, Accessed, Modified, and Changed are stored inside the .dar file. However, the Created timestamp is stored in external .plists, typically found alongside your extraction in the “MetaData” folder. For a further explanation of … Continued
The Identifiers artifact has been a staple for Magnet AXIOM users for quite some time. The premise of this artifact is relatively simple, yet quite helpful in most investigations: Identifiers will search through all of the recovered artifacts for anything that might uniquely identify a person or user. This could be a real name, username, … Continued
Mac investigations can be challenging for a number of reasons. Learn about the Apple File System (APFS) and the changes made as part of the update from HFS+, while discussing the best techniques for successfully completing macOS investigations in Magnet AXIOM. In this lab we will not only discuss changes made with the latest macOS … Continued
Pictures, videos, and chats can all be key pieces of evidence in building cases for possession, distribution, and/or production of child sexual abuse material (CSAM), solicitation of a minor, and related crimes. However, these data quantities can range well into terabytes or even petabytes as investigators evaluate the evidence across multiple cases. In this lab, … Continued
Whether you’re a new or a long-time user of Magnet Axiom, we want to make sure you know about some of the advanced functionality that Axiom has to offer to make your investigations easier. Have you tried Connections yet? If not, you might be missing out on an incredibly streamlined way to analyze your evidence. … Continued
The ongoing trend for many application services is transitioning to storing user data in the cloud, rather than on the user’s physical device. This cloud data can be vital to your examinations! Now, in Magnet AXIOM 3.10, we’ve added the ability to acquire and process data from a user’s Uber account. Uber is one of … Continued
Magnet AXIOM 3.10 is now available to download within AXIOM or over at Customer Portal. AXIOM 3.10 allows you to acquire from Uber, get new timestamps in Google search URLs, as well get more than 20 updated artifacts. If you haven’t tried AXIOM yet, request a free trial here. Acquisition from Uber Uber is a … Continued
Google Search URLs have always been a gold mine of information to forensic examiners. Not only can you get a lot of detail on the search itself but there’s a plethora of timestamps potentially available with these searches as well. Historically, AXIOM has always recovered the Date/Time from the source system (usually the Last Visit … Continued
As a part of the AXIOM 3.9 release, we’ve added a new Windows 10 artifact for examiners wanting to quickly visualize what a user’s desktop looked like at the time of imaging. Update within AXIOM or download AXIOM 3.9 over at Customer Portal today! Rebuilt Desktops is a new artifact that allows users to view an … Continued
