AX250 Axiom Advanced Computer Forensics

This is an advanced level course designed for students who are familiar with the principles of digital forensics and use Magnet Axiom in Windows investigations. You can purchase training classes directly online using a credit card or if payment by purchase order is required, please request a quotation from sales@magnetforensics.com.

Description

This is an advanced level course designed for students who are familiar with the principles of digital forensics and use Magnet Axiom in Windows investigations.

The course is divided into learning modules, each with a similar structure, that includes identified learning objectives. Module content is presented using open discussion, demonstration, and practical exercises that are both instructor-led and performed by students on their own. Review questions also appear in various locations to check learning of key concepts.

Modules often conclude with a scenario-based exercise designed to test students’ understanding and application of what they’ve learned.

 

Course prerequisites

Because AX250 is an expert-level course, it is recommended that students first complete AX100 Forensic Fundamentals, which teaches the fundamentals of digital forensic investigation and AX200 Magnet Axiom Examinations, which provides a thorough understanding of Axiom. 

 

Course modules

Module 1: Course scenario and Windows overview

  • Build upon knowledge of the Windows registry by learning how to track down operating system installation upgrade history.
  • Learn more about Windows recovery and how to leverage it in forensic analysis.
  • Expand knowledge of local and internet accounts, combined with Windows user authentication.
  • Learn more in-depth Windows topics, including Taskbar pinned apps, WER, and wireless artifacts.

Module 2: Tracking down volume serial numbers

  • Interpret volume serial numbers and their importance to an investigation.
  • Use volume serial numbers to track down volumes using LNK files and Windows Event Logs.
  • Using volume serial numbers as filter searches, learn how to track down additional volumes including virtual machines.

Module 3: Missing files and folders

  • Track down information concerning items that are not present among the evidence sources they have.
  • Understand Microsoft’s Program Compatibility Assistant and how to leverage the Application Compatibility Cache.
  • Investigate AmCache and Shellbags.

Module 4: Investigating prefetched data

  • Find out more about what Windows Prefetch is and what it does.
  • Understand the forensic implications and advantages of using Prefetch information in their investigations.
  • Further learn how to correlate the information using other artifacts and verify those artifacts using external tools.

Module 5: Investigating suspicious documents

  • Identify and examine suspicious documents.
  • Learn how to correctly interpret MRU artifacts and verify their interpretations using the registry.
  • Further learn about Microsoft 365 including its unique MRU artifacts and registry locations that are better investigated manually.
  • Find out how to recover previous versions of PDF documents from embedded file data and how to compare those versions to detect malicious or historical activity.

Module 6: Memory investigations

  • Capture and process active memory from a running Windows computer using Magnet Forensics Comae Toolkit.
  • Add new RAM evidence to an existing Axiom case and process it with Axiom Process.
  • Gain further experience using Axiom Examine to apply analysis techniques to identify information of interest and artifacts pertinent to your investigation.

Module 7: Tracking down shared files

  • Learn how comprehensive cross-device sharing via Microsoft Cloud services can be.
  • Dive deeper into OneDrive in particular, including source evidence information locations, tracing file and folder sharing, recovering deleted OneDrive files, analyzing OneDrive URLs, and determining sync status.
  • Gain further insight into cloud data syncing as it pertains to Microsoft Edge, Wi-Fi profiles, and other general items.

Module 8: iOS backups in Windows

  • Reinforce prior learning concerning mobile backups found on Windows systems with the focus being Apple devices.
  • Learn about iOS encryption and how to use an index attack to gain access to encrypted iOS backups.
  • Explore artifact results in Axiom with particular attention paid to Microsoft 365 document and Apple keychain artifacts.

Module 9: Windows encryption and passwords

  • Learn more about Windows credential security and storage, focusing on user account passwords.
  • Understand how to recover Windows user and BitLocker passwords and do this in practical exercises.
  • Bypass application encryption for the Signal Messenger desktop app within a practical exercise.

Module 10: Investigating Google Drive

  • Explore advanced knowledge and concepts pertaining to Google Drive for desktop, building on their prior learning from basic Windows forensic courses.
  • Understand the difference between metadata and mirror-tracking databases and the purposes of each.
  • Learn about some highly valuable forensic data and their implications in forensic investigation that they can look out for in the future.
  • Get opportunities for hands-on practice deriving the secrets Google Drive may hold.

Module 11: Investigating Windows backups

  • Learn about Microsoft backup features for Windows with specific attention paid to File History.
  • Explore user settings, access to backups, and restoration.
  • Go deeper into File History internals, learning how it works and how to understand it forensically.
  • Find out about additional investigative techniques and the use of Event Logs to further the investigation.

Module 12: Windows apps overview

  • Get introduced to Windows apps and the Microsoft Store.
  • Explore important considerations for investigating Windows apps usage and focus on three example apps—iTunes, Windows Subsystem for Linux, and Photos.

Module 13: File system logging

  • Learn more about Microsoft’s New Technology File System logging and how to take advantage of it in their investigations.
  • Understand the $ObjId/$40 attribute to identify MAC addresses and other information.
  • Explore the $Secure, $UsnJrnl, and $LogFile metafiles to gather even more information about New Technology File System object owners and actions, including information from removable devices.

 

Additional information

Who should attend: Participants who are unfamiliar with the principles of digital forensics
Advanced preparation: None
Program level: Advanced-level
Field of study: Computer software & applications
Delivery method: Group internet based & group live

Refunds and cancellations: Training Course(s) can be rescheduled to a later date or cancelled by either Magnet Forensics or you without charge or penalty if written notice is received twenty-one (21) days or more prior to the date of the Training Course. No rescheduling shall be permitted on less than twenty-one (21) days written notice, which shall constitute a cancellation without a refund. Your written rescheduling or cancellation notice must be emailed to training@magnetforensics.com or contact 202.984.3417. If Magnet Forensics cancels a Training Course due to insufficient attendance, you will have the option to register in a different scheduled Training Course or receive a full refund. Please do not book travel until you have confirmed that the Training Course will be running.

Magnet Forensics is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website:www.nasbaregistry.org.

Similar courses

GK200 is an intermediate-level four-day training course, designed for participants who are familiar with the principles of digital forensics and are seeking to expand their knowledge base into iOS and Android examinations using Magnet Graykey. Students must be part of a law enforcement agency and must be cleared in advance to attend this course.

More Information

This course is an expert-level four-day training course, designed for participants who are familiar with the principles of digital forensics and who are seeking to improve their mobile device investigations. You can purchase training classes directly online using a credit card or if payment by purchase order is required, please request a quotation from sales@magnetforensics.com.

More Information

Magnet Axiom Examinations (AX200) is ideal for those who require intermediate-level training with a digital investigation platform that covers cases involving smartphones, tablets, computers, and cloud data in a single collaborative interface. This course is the perfect entry point for examiners who are new to Axiom. You can purchase training classes directly online using a credit card or if payment by purchase order is required, please request a quotation from sales@magnetforensics.com.

More Information

AX310 is an expert-level four-day training course, designed for participants who are familiar with the principles of digital forensics and who are seeking to expand their knowledge base on advanced forensics and incident response techniques and want to improve computer investigations. You can purchase training classes directly online using a credit card or if payment by purchase order is required, please request a quotation from sales@magnetforensics.com.

More Information

This course is an intermediate-level four-day training course, designed for participants who are somewhat familiar with the principles of digital forensics and who are seeking to expand their knowledge base into cloud-based and social media forensics. You can purchase training classes directly online using a credit card or if payment by purchase order is required, please request a quotation from sales@magnetforensics.com.

More Information

This course is an expert-level four-day training course, designed for participants who are somewhat familiar with the principles of digital forensics and who are seeking to expand their knowledge base on macOS and the forensic analysis of devices using the APFS file system and AXIOM. You can purchase training classes directly online using a credit card or if payment by purchase order is required, please request a quotation from sales@magnetforensics.com.

More Information

This course is an expert-level four-day training course, designed for participants who are somewhat familiar with the principles of digital forensics and who are seeking to expand their knowledge base on advanced forensics and improve their computer investigations. You can purchase training classes directly online using a credit card or if payment by purchase order is required, please request a quotation from sales@magnetforensics.com.

More Information

This course is an intermediate-level two-day training course, designed for participants who are familiar with the principles of digital forensics and who are seeking to expand their knowledge base into deep iOS file system examinations. You can purchase training classes directly online using a credit card or if payment by purchase order is required, please request a quotation from sales@magnetforensics.com.

More Information

Forensic Fundamentals (AX100) is a beginner-level course, designed for participants who are unfamiliar with the principles of digital forensics. You can purchase training classes directly online using a credit card or if payment by purchase order is required, please request a quotation from sales@magnetforensics.com.

More Information

Digital Video Investigations with Magnet Witness (DV200) is a beginner-level course, designed for participants who are not yet familiar with the concepts of the recovery and analysis of digital video files from commercially available digital video recorders.

More Information

Magnet Axiom to Cyber Transitions is ideal for those who are looking to continue their education and transition into the unique features of Axiom Cyber after taking the Axiom Examinations (AX200) course.

More Information

Magnet Axiom Examination (AX200 Microlearning) is ideal for those who are relatively new to forensics and want to learn how to utilize Axiom to get the most out of the forensic platform. Axiom is a platform that covers cases involving mobile device, computer, and cloud data in a single collaborative interface. Students will learn the workflows of how to interrogate and investigate devices containing digital media.

More Information

Core Mobile Acquisition and Analysis (AX150) is a beginner level course, designed for participants who are unfamiliar with the principles of mobile forensics. The course focuses on iOS and Android devices from the point of collection to the point of analysis whilst exploring Magnet Axiom and Magnet tools such as Magnet Acquire, the Magnet Custom Artifact Generator (MCAG) and Magnet Axiom Dynamic App Finder.

More Information

Core Mobile Acquisition and Analysis (AX150 Microlearning) is a beginner level course, designed for participants who are unfamiliar with the principles of mobile forensics. The course focuses on iOS and Android devices from the point of collection to the point of analysis whilst exploring Magnet Axiom and Magnet tools such as Magnet Acquire, the Magnet Custom Artifact Generator (MCAG) and Magnet Axiom Dynamic App Finder.

More Information

Magnet Axiom Advanced Mobile Forensics (AX300 Microlearning) details the use of Magnet Axiom’s advanced mobile analysis capabilities. Students will learn advanced analysis techniques and leverage Magnet Axiom Examine to become proficient in investigating advanced aspects of full file system extractions of both iOS and Android devices.

More Information

The Magnet Griffeye Examinations Course is a 3-day training course designed for students who have attended the Magnet Griffeye Lite online course or have already attained proficiency in Magnet Griffeye Advanced. The course is designed to equip you with the necessary skills and tools to handle media files effectively during a criminal investigation, thereby maximizing the productivity of the tool.

More Information

Magnet Verakey Examinations (VK200) is an intermediate-level four-day training course, designed for participants who are familiar with the principles of digital forensics and who are seeking to improve their mobile device investigations.

More Information

Magnet Axiom’s Portable Case is a lightweight version of the full capabilities found in Axiom—designed for easy access and analysis of forensic findings. It shares the ability to investigate the case data from digital devices and produce reports with non-technical stakeholders, such as investigators and attorneys.

More Information

Magnet Griffeye Lite is a limited, free version of Griffeye offered to law enforcement officials to navigate digital media more efficiently. In this free tutorial, available in numerous 20-minute-or-less modules, attendees will see how they can make the most out of their use of Griffeye Lite, including how to use the software, applying searching and filtering techniques, as well as creating reports and exporting.

More Information

This two-day instructor-led course provides students with the knowledge and skills necessary to perform structural comparative analysis on digital image and video files and to articulate expert results in both a report and court of law. Students will learn how to manually decode multimedia files at the binary level, performing authentication examinations using file metadata and structure. We will be working within Magnet Verify.

More Information

This 4-day course starts with training in detailed binary analysis of digital multimedia files, specifically focusing on the most common formats, i.e., ISO BMFF (MP4, MOV, 3GP, 3G2, M4V) and RIFF (AVI). Building from this foundational skillset, the course continues with a focus on troubleshooting video files with H264 encoded video, specifically focused on AVCC implementations of H264 encoding in ISO BMFF files.

More Information

This course is a two-day, expert-level training program designed to equip digital forensic examiners with advanced skills for navigating complex mobile data. Emphasizing unsupported third-party applications, advanced data structures, and custom artifact creation, this course will provide essential tools for analyzing mobile device data with confidence.

More Information

Get exam-ready with our certification prep materials.

More Information