We at Magnet Forensics are constantly trying to keep up with new artifacts that are relevant to the changing times to help assist in your examinations. Recently added into Magnet AXIOM was the support of Zoom application artifacts, which in recent times has become an extremely popular way for us to connect and communicate in … Continued
We know how useful it can be to analyze the data from your warrant returns alongside your other evidence sources in AXIOM. AXIOM has long supported the processing of warrant returns from Apple, Facebook, Google/Gmail, Instagram, and Snapchat. And now, new in Magnet AXIOM 4.2 is the ability to ingest and process Skype Warrant Return … Continued
Members of the forensic community often take it upon themselves to create scripts, custom artifacts, or software to aid in their investigations, then share with others, which I’ve always loved. The talent our community guild has is truly awesome, and I’m thankful to be a part of it. This blog isn’t meant to be an end all, be all of every publicly available Mac … Continued
由於蘋果公司定期會針對macOS進行更動，因此調查Mac裝置頗具挑戰性。 一起來了解最新macOS檔案系統（APFS）與從HFS +更新至APFS後所做的改變，同時講述運用Magnet AXIOM來完善macOS的調查結果。 在此網絡研討會中，鑒真數位不僅會講述最新macOS 作業系統10.15（Catalina）更新後的改變，也會闡述macOS作業系統跡證和檔案，例如：KnowledgeC.db，FSEvents，Volume Mount Points，Quarantined Files，AirDrop和bash歷史記錄， 並將相關跡證建立起關聯性，以利協助調查。
Within recent releases of AXIOM, we’ve added new artifacts to help examiners analyze images found on both iOS and macOS systems. Many investigations that examiners are faced with hinge on the images found during analysis of the data. These artifacts will help identify new points of interest and allow for more context to be drawn around images found during those investigations. We can all agree … Continued
macOS has created roadblocks for examiners for years. Investigators must contend with not only hardware-based encryption like the T-2 chip, to System Integrity Protection (SIP), which prevented disk and write access to specific directories across the Mac. Now with macOS Catalina (10.15) we find even more complications with the addition of a new read-only volume … Continued
This Free AXIOM Cyber Interactive Training will take two hours and will include tips and tricks on streamlining your investigative workflow. We’ll cover using AXIOM Cyber for your investigations focusing on remote collections with Windows and macOS devices with an ad hoc agent. Join us to learn about how to quickly and covertly perform collections. … Continued
sics, but your department won’t buy the mac forensics tools? You have a mac with the T2 chip and can’t image with conventional imagers?
在很多案件调查中，内存分析可以给我们提供一些通过常规硬盘取证得不到的数据，它甚至是获取案件调查关键数据的唯一方法。特别是恶意软件调查，内存分析可以提供极大的帮助；但除此类型之外，对于其他一些类型的调查取证，内存分析同样扮演很关键的角色。此次线上交流我们会探讨Magnet AXIOM所集成的Volatility，及其如何让取证分析人员更简便的进行深层内存分析。了解如何把内存痕迹及其他数据源中的痕迹包含在一个大的时间线，以便进行全面的调查。另外，我们将了解如何使用免费的Magnet Process Capture对特定的进程分析内存数据。
Learn how Canada is working with ProjectVic, and Magnet Forensics to protect children and combat online Child Sexual Exploitation (CSE). As well, a case study on how to export identifiers into other intelligence systems to find the truth in how your suspect is communicating with other CSE offenders and perhaps targeting children.
