AX250 Axiom Advanced Computer Forensics
This is an advanced level course designed for students who are familiar with the principles of digital forensics and use Magnet Axiom in Windows investigations. You can purchase training classes directly online using a credit card or if payment by purchase order is required, please request a quotation from sales@magnetforensics.com.
Description
This is an advanced level course designed for students who are familiar with the principles of digital forensics and use Magnet Axiom in Windows investigations. The course is divided into learning modules like chapters in a book. Each one has similar structure, including learning objectives that are identified at the beginning. Module content is presented using open discussion, demonstration, and practical exercises that include both instructor-led and those students perform on their own. Review questions appear in various locations to check learning of key concepts. Modules often conclude with a scenario-based exercise designed to test students’ understanding and application of what they’ve learned.
Course prerequisites
Because AX250 is an expert-level course, it is recommended that students first complete AX100 Forensic Fundamentals and AX200 Magnet Axiom Examinations. AX100 teaches the fundamentals of digital forensic investigation and AX200 provides a thorough understanding of Axiom. Click here to find out more about AX100 and click here to find out more about AX200.
Course modules
Module 1: Course Scenario and Windows Overview
- Students build upon their knowledge of the Windows registry by learning how to track down operating system installation upgrade history.
- Students learn more about Windows recovery and how they can leverage it in forensic analysis.
- Students expand their knowledge of local and Internet accounts combined with Windows user authentication.
- Students also learn more in-depth Windows topics, including Taskbar pinned apps, WER, and wireless artifacts.
Module 2: Tracking Down Volume Serial Numbers
- Students learn how to interpret volume serial numbers and their importance to an investigation.
- Students learn how to use volume serial numbers to track down volumes using LNK files and Windows Event Logs.
- Using volume serial numbers as filter searches, students also learn how to track down additional volumes including virtual machines.
Module 3: Missing Files and Folders
- Students learn how to track down information concerning items that are not present among the evidence sources they have.
- Students learn about Microsoft’s Program Compatibility Assistant and how to leverage the Application Compatibility Cache.
- Students also learn how to investigate AmCache and Shellbags.
Module 4: Investigating Prefetched Data
- Students learn what Windows Prefetch is and what it does.
- Students also learn the forensic implications and advantages of using Prefetch information in their investigations.
- Students further learn how to correlate the information using other artifacts and verify those artifacts using external tools.
Module 5: Investigating Suspicious Documents
- Students learn how to identify and examine suspicious documents.
- Students also learn how to correctly interpret MRU artifacts and verify their interpretations using the registry.
- Students further learn about Microsoft 365 including its unique MRU artifacts and registry locations that are better investigated manually.
- Finally, students learn how to recover previous versions of PDF documents from embedded file data and how to compare those versions to detect malicious or historical activity.
Module 6: Memory Investigations
- Students learn how to capture and process active memory from a running Windows computer using Magnet Forensics Comae Toolkit.
- Students also learn how to add new RAM evidence to an existing Axiom case and process it with Axiom Process.
- Students gain further experience using Axiom Examine to apply analysis techniques to identify information of interest and artifacts pertinent to your investigation.
Module 7: Tracking Down Shared Files
- Students learn how comprehensive cross device sharing via Microsoft Cloud services can be.
- Students learn about OneDrive in particular, including source evidence information locations, tracing file and folder sharing, recovering deleted OneDrive files, analyzing OneDrive URLs, and determining sync status.
- Students also gain further insight into cloud data syncing as it pertains to Microsoft Edge, Wi-Fi profiles, and other general items.
Module 8: iOS Backups in Windows
- Students reinforce prior learning concerning mobile backups found on Windows systems with the focus being Apple devices.
- Students learn about iOS encryption and how to use an index attack to gain access to encrypted iOS backups.
- Students also explore artifact results in Axiom with particular attention paid to Microsoft 365 document and Apple keychain artifacts.
Module 9: Windows Encryption and Passwords
- Students learn more about Windows credential security and storage, focusing on user account passwords.
- Students learn how to recover Windows user and BitLocker passwords and do this in practical exercises.
- Students learn how to bypass application encryption for the Signal Messenger desktop app and do this in a practical exercise.
Module 10: Investigating Google Drive
- Students explore advanced knowledge and concepts pertaining to Google Drive for desktop, building on their prior learning from basic Windows forensic courses.
- Students learn the difference between metadata and mirror-tracking databases and the purposes of each.
- Students learn about some highly valuable forensic data and their implications in forensic investigation that they can look out for in the future.
- Students also have opportunities for hands-on practice deriving the secrets Google Drive may hold.
Module 11: Investigating Windows Backups
- Students learn about Microsoft backup features for Windows with specific attention paid to File History.
- Students learn about user settings, access to backups, and restoration.
- Students also go deeper into File History internals, learning how it works and how to understand it forensically.
- Further, students explore investigative techniques and the use of Event Logs to further the investigation.
Module 12: Windows Apps Overview
- Students are introduced to Windows apps and the Microsoft Store.
- Students explore important considerations for investigating Windows apps usage and focused on three example apps — iTunes, Windows Subsystem for Linux, and Photos.
Module 13: File System Logging
- Students learn more about Microsoft’s New Technology File System logging and how to take advantage of it in their investigations.
- Students explore the $ObjId/$40 attribute to identify MAC addresses and other information. Students explore the $Secure, $UsnJrnl, and $LogFile metafiles to gather even more information about New Technology File System object owners and actions, including information from removable devices.
Additional information
Who should attend: Participants who are unfamiliar with the principles of digital forensics
Advanced preparation: None
Program level: Advanced-level
Field of study: Computer software & applications
Delivery method: Group internet based & group live
Refunds and cancellations: Training Course(s) can be rescheduled to a later date or cancelled by either Magnet Forensics or you without charge or penalty if written notice is received twenty-one (21) days or more prior to the date of the Training Course. No rescheduling shall be permitted on less than twenty-one (21) days written notice, which shall constitute a cancellation without a refund. Your written rescheduling or cancellation notice must be emailed to training@magnetforensics.com or contact 202.984.3417. If Magnet Forensics cancels a Training Course due to insufficient attendance, you will have the option to register in a different scheduled Training Course or receive a full refund. Please do not book travel until you have confirmed that the Training Course will be running.
Magnet Forensics is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website:www.nasbaregistry.org.