Topic: Computer

From extraction to courtroom: Accelerating digital evidence review and case preparation

By

Digital evidence is often central to building and proving a case but reviewing and preparing that evidence shouldn’t become an impediment in moving investigations and prosecutions forward.
 
In this session, discover how device examiners, investigators, and prosecutors can quickly access, review, organize, and prepare digital evidence using Portable Case and Magnet Review. Learn how collaborative, cloud-enabled workflows simplify case preparation, improve communication between investigative and legal teams, and help you present digital evidence with confidence in court. 
In this session, see how you can utilize a no-license and user-friendly way to quickly find, review, and prepare significant evidence so you can move cases forward faster and present it with confidence in court.
 
In this session, you’ll learn how to:
 
Load and review a Portable Case with ease
Navigate and search mobile evidence to find what matters faster
Filter and tag key evidence for case building
Export exhibits and prepare evidence for court
Streamline review workflows, including cloud-based access

S1:E10 // Preparing the court for trial: Strategic Motions in Limine in criminal prosecutions

By

This presentation focuses on the strategic use of motions in Limine to address digital evidence issues before the trial begins. Participants will learn how to use pretrial motions to obtain advance rulings on the admissibility and scope of digital evidence, define evidentiary boundaries, and clarify how technical material may be presented at trial. Emphasis is placed on educating the court early, reducing trial interruptions, and establishing clear expectations for the use of digital evidence before the first witness is called.

S3:E4 // Living off the land: Investigating attacks that leave no malware behind

By

Modern attackers increasingly rely on tools already present on the systems they compromise — PowerShell, WMI, scheduled tasks, RDP, and other built-in utilities that blend into normal administrative activity. This episode works through the LOLBin problem in three layers: the detection foundation (baselining tool usage and building appropriately scoped alerts), filtering legitimate from malicious usage by parent process, argument structure, and behavioral context, and the forensic reconstruction — the host artifacts that survive when SIEM telemetry is gone. Covers PowerShell ScriptBlock logs, WMI event subscriptions, scheduled task XML definitions, Shimcache, Amcache, prefetch, and RDP/SMB lateral movement artifacts, with Magnet Axiom Cyber for endpoint artifact analysis and Magnet Nexus for enterprise-wide scoping.