由於蘋果公司定期會針對macOS進行更動，因此調查Mac裝置頗具挑戰性。 一起來了解最新macOS檔案系統（APFS）與從HFS +更新至APFS後所做的改變，同時講述運用Magnet AXIOM來完善macOS的調查結果。 在此網絡研討會中，鑒真數位不僅會講述最新macOS 作業系統10.15（Catalina）更新後的改變，也會闡述macOS作業系統跡證和檔案，例如：KnowledgeC.db，FSEvents，Volume Mount Points，Quarantined Files，AirDrop和bash歷史記錄， 並將相關跡證建立起關聯性，以利協助調查。
Within recent releases of AXIOM, we’ve added new artifacts to help examiners analyze images found on both iOS and macOS systems. Many investigations that examiners are faced with hinge on the images found during analysis of the data. These artifacts will help identify new points of interest and allow for more context to be drawn around images found during those investigations. We can all agree … Continued
macOS has created roadblocks for examiners for years. Investigators must contend with not only hardware-based encryption like the T-2 chip, to System Integrity Protection (SIP), which prevented disk and write access to specific directories across the Mac. Now with macOS Catalina (10.15) we find even more complications with the addition of a new read-only volume … Continued
This Free AXIOM Cyber Interactive Training will take two hours and will include tips and tricks on streamlining your investigative workflow. We’ll cover using AXIOM Cyber for your investigations focusing on remote collections with Windows and macOS devices with an ad hoc agent. Join us to learn about how to quickly and covertly perform collections. … Continued
sics, but your department won’t buy the mac forensics tools? You have a mac with the T2 chip and can’t image with conventional imagers?
在很多案件调查中，内存分析可以给我们提供一些通过常规硬盘取证得不到的数据，它甚至是获取案件调查关键数据的唯一方法。特别是恶意软件调查，内存分析可以提供极大的帮助；但除此类型之外，对于其他一些类型的调查取证，内存分析同样扮演很关键的角色。此次线上交流我们会探讨Magnet AXIOM所集成的Volatility，及其如何让取证分析人员更简便的进行深层内存分析。了解如何把内存痕迹及其他数据源中的痕迹包含在一个大的时间线，以便进行全面的调查。另外，我们将了解如何使用免费的Magnet Process Capture对特定的进程分析内存数据。
Learn how Canada is working with ProjectVic, and Magnet Forensics to protect children and combat online Child Sexual Exploitation (CSE). As well, a case study on how to export identifiers into other intelligence systems to find the truth in how your suspect is communicating with other CSE offenders and perhaps targeting children.
Reverse engineering (RE) is a skill that represents foundational work that our favorite forensic tools are built upon. But when you as an examiner encounter an app that isn’t supported anywhere, what recourse do you have? Join Chris Atha (NW3C) and Mike Williamson (Magnet Forensics) for an introduction to the fascinating, ever-changing world of RE. … Continued
A new challenge of forensics is upon us as Chromebooks become more and more popular. One of the challenges is understanding the difference obtained from different types of acquisitions as well as the cloud. Due to this challenge, a group of 30 forensic examiners came together to workshop the problem at a Brews and Bytes … Continued
We’re proud to announce the availability of Magnet AXIOM 4.0! Magnet AXIOM 4.0 and an updated Magnet AXIOM Cyber are now available to download within AXIOM or over at the Customer Portal. With this next step in AXIOM’s evolution, we’ve brought huge enhancements to the speed, flexibility, and reliability of AXIOM. And with AXIOM Cyber, … Continued
