AX250 Axiom Advanced Computer Forensics
This is an advanced level course designed for students who are familiar with the principles of digital forensics and use Magnet Axiom in Windows investigations. You can purchase training classes directly online using a credit card or if payment by purchase order is required, please request a quotation from sales@magnetforensics.com.
Description
This is an advanced level course designed for students who are familiar with the principles of digital forensics and use Magnet Axiom in Windows investigations.
The course is divided into learning modules, each with a similar structure, that includes identified learning objectives. Module content is presented using open discussion, demonstration, and practical exercises that are both instructor-led and performed by students on their own. Review questions also appear in various locations to check learning of key concepts.
Modules often conclude with a scenario-based exercise designed to test students’ understanding and application of what they’ve learned.
Course prerequisites
Because AX250 is an expert-level course, it is recommended that students first complete AX100 Forensic Fundamentals, which teaches the fundamentals of digital forensic investigation and AX200 Magnet Axiom Examinations, which provides a thorough understanding of Axiom.
Course modules
Module 1: Course scenario and Windows overview
- Build upon knowledge of the Windows registry by learning how to track down operating system installation upgrade history.
- Learn more about Windows recovery and how to leverage it in forensic analysis.
- Expand knowledge of local and internet accounts, combined with Windows user authentication.
- Learn more in-depth Windows topics, including Taskbar pinned apps, WER, and wireless artifacts.
Module 2: Tracking down volume serial numbers
- Interpret volume serial numbers and their importance to an investigation.
- Use volume serial numbers to track down volumes using LNK files and Windows Event Logs.
- Using volume serial numbers as filter searches, learn how to track down additional volumes including virtual machines.
Module 3: Missing files and folders
- Track down information concerning items that are not present among the evidence sources they have.
- Understand Microsoft’s Program Compatibility Assistant and how to leverage the Application Compatibility Cache.
- Investigate AmCache and Shellbags.
Module 4: Investigating prefetched data
- Find out more about what Windows Prefetch is and what it does.
- Understand the forensic implications and advantages of using Prefetch information in their investigations.
- Further learn how to correlate the information using other artifacts and verify those artifacts using external tools.
Module 5: Investigating suspicious documents
- Identify and examine suspicious documents.
- Learn how to correctly interpret MRU artifacts and verify their interpretations using the registry.
- Further learn about Microsoft 365 including its unique MRU artifacts and registry locations that are better investigated manually.
- Find out how to recover previous versions of PDF documents from embedded file data and how to compare those versions to detect malicious or historical activity.
Module 6: Memory investigations
- Capture and process active memory from a running Windows computer using Magnet Forensics Comae Toolkit.
- Add new RAM evidence to an existing Axiom case and process it with Axiom Process.
- Gain further experience using Axiom Examine to apply analysis techniques to identify information of interest and artifacts pertinent to your investigation.
Module 7: Tracking down shared files
- Learn how comprehensive cross-device sharing via Microsoft Cloud services can be.
- Dive deeper into OneDrive in particular, including source evidence information locations, tracing file and folder sharing, recovering deleted OneDrive files, analyzing OneDrive URLs, and determining sync status.
- Gain further insight into cloud data syncing as it pertains to Microsoft Edge, Wi-Fi profiles, and other general items.
Module 8: iOS backups in Windows
- Reinforce prior learning concerning mobile backups found on Windows systems with the focus being Apple devices.
- Learn about iOS encryption and how to use an index attack to gain access to encrypted iOS backups.
- Explore artifact results in Axiom with particular attention paid to Microsoft 365 document and Apple keychain artifacts.
Module 9: Windows encryption and passwords
- Learn more about Windows credential security and storage, focusing on user account passwords.
- Understand how to recover Windows user and BitLocker passwords and do this in practical exercises.
- Bypass application encryption for the Signal Messenger desktop app within a practical exercise.
Module 10: Investigating Google Drive
- Explore advanced knowledge and concepts pertaining to Google Drive for desktop, building on their prior learning from basic Windows forensic courses.
- Understand the difference between metadata and mirror-tracking databases and the purposes of each.
- Learn about some highly valuable forensic data and their implications in forensic investigation that they can look out for in the future.
- Get opportunities for hands-on practice deriving the secrets Google Drive may hold.
Module 11: Investigating Windows backups
- Learn about Microsoft backup features for Windows with specific attention paid to File History.
- Explore user settings, access to backups, and restoration.
- Go deeper into File History internals, learning how it works and how to understand it forensically.
- Find out about additional investigative techniques and the use of Event Logs to further the investigation.
Module 12: Windows apps overview
- Get introduced to Windows apps and the Microsoft Store.
- Explore important considerations for investigating Windows apps usage and focus on three example apps—iTunes, Windows Subsystem for Linux, and Photos.
Module 13: File system logging
- Learn more about Microsoft’s New Technology File System logging and how to take advantage of it in their investigations.
- Understand the $ObjId/$40 attribute to identify MAC addresses and other information.
- Explore the $Secure, $UsnJrnl, and $LogFile metafiles to gather even more information about New Technology File System object owners and actions, including information from removable devices.
Additional information
Who should attend: Participants who are unfamiliar with the principles of digital forensics
Advanced preparation: None
Program level: Advanced-level
Field of study: Computer software & applications
Delivery method: Group internet based & group live
Refunds and cancellations: Training Course(s) can be rescheduled to a later date or cancelled by either Magnet Forensics or you without charge or penalty if written notice is received twenty-one (21) days or more prior to the date of the Training Course. No rescheduling shall be permitted on less than twenty-one (21) days written notice, which shall constitute a cancellation without a refund. Your written rescheduling or cancellation notice must be emailed to training@magnetforensics.com or contact 202.984.3417. If Magnet Forensics cancels a Training Course due to insufficient attendance, you will have the option to register in a different scheduled Training Course or receive a full refund. Please do not book travel until you have confirmed that the Training Course will be running.
Magnet Forensics is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website:www.nasbaregistry.org.