Attribution, use, and possession: Thorough CSAM investigations with Magnet Axiom

Proving the elements of possession, file use, knowledge, and user attribution is central to CSAM investigations and is often the most contested aspect in court. This session demonstrates how Magnet Axiom can be leveraged to uncover and correlate artifacts that show file access, user activity, and intent. Attendees will learn practical methods for identifying traces of file interaction across operating systems, validating metadata and system logs, and linking activity back to specific users or accounts. Emphasis will be placed on workflows that transform raw digital artifacts into defensible evidence, ensuring that possession and knowledge can be clearly established and reliably presented in legal proceedings.