Topic: Computer

Tips & Tricks // Acquiring and Analyzing Microsoft Teams Data

By

Now more than ever, organizations are faced with the need for remote collaboration and many have turned to Microsoft Teams to fill that need. Whether exporting MS Teams data directly from the Microsoft 365 Compliance Center or directly acquiring that data with the Magnet AXIOM Cyber API, examiners have the power to process and analyze the … Continued

Tips & Tricks // Custom Artifacts

By

As new applications are used and updated, forensic tools do not always support every artifact. Often times examiners manually parse artifacts from a variety of sources. What if you could easily automate that parsing for future cases and large data sets… and still analyze those results in your tools?  What if you could share your … Continued

Zoom Artifact Support in Magnet AXIOM

By

We at Magnet Forensics are constantly trying to keep up with new artifacts that are relevant to the changing times to help assist in your examinations. Recently added into Magnet AXIOM was the support of Zoom application artifacts, which in recent times has become an extremely popular way for us to connect and communicate in … Continued

Skype Warrant Returns in Magnet AXIOM

By

We know how useful it can be to analyze the data from your warrant returns alongside your other evidence sources in AXIOM. AXIOM has long supported the processing of warrant returns from Apple, Facebook, Google/Gmail, Instagram, and Snapchat. And now, new in Magnet AXIOM 4.2 is the ability to ingest and process Skype Warrant Return … Continued

Free Mac & iOS Resources for the DFIR Community

By

Members of the forensic community often take it upon themselves to create scripts, custom artifacts, or software to aid in their investigations, then share with others, which I’ve always loved. The talent our community guild has is truly awesome, and I’m thankful to be a part of it. This blog isn’t meant to be an end all, be all of every publicly available Mac … Continued

Magnet Virtual Summit APAC //macOS: 調查Mac系統必要的跡證和技術

By

由於蘋果公司定期會針對macOS進行更動，因此調查Mac裝置頗具挑戰性。 一起來了解最新macOS檔案系統（APFS）與從HFS +更新至APFS後所做的改變，同時講述運用Magnet AXIOM來完善macOS的調查結果。 在此網絡研討會中，鑒真數位不僅會講述最新macOS 作業系統10.15（Catalina）更新後的改變，也會闡述macOS作業系統跡證和檔案，例如：KnowledgeC.db，FSEvents，Volume Mount Points，Quarantined Files，AirDrop和bash歷史記錄， 並將相關跡證建立起關聯性，以利協助調查。