AX220 Axiom Filesystem Analysis
This course is an intermediate-level two-day training course, designed for participants who are familiar with the principles of digital forensics and who are seeking to expand their knowledge base into deep iOS and android file system examinations. You can purchase training classes directly online using a credit card or if payment by purchase order is required, please request a quotation from sales@magnetforensics.com.
Description
This course is an intermediate-level two-day training course, designed for participants who are familiar with the principles of digital forensics and who are seeking to expand their knowledge base into deep iOS and android file system examinations.
Throughout this course, participants will be introduced to the installation and foundational components of Magnet Axiom, including both Axiom Process and Axiom Examine. Students will gain practical experience in acquiring forensic images from various evidence sources, configuring case-specific settings, and creating cases for analysis. The course also delves into the intricacies of mobile device security, offering an overview of best practices for data handling, preservation, and acquisition across different device states and scenarios.
Furthermore, students will learn to identify core artifacts vital for user attribution, enabling them to determine essential information about the device's software and user accounts. The course concludes with an exploration of Magnet Axiom's Communications category, teaching participants how to navigate and filter conversation data, including iOS iMessage/SMS/MMS and Android SMS/MMS messages, as well as messages from third-party applications.
Course prerequisites
Because AX220 is an intermediate-level course, it is strongly recommended that students first complete Magnet Axiom Examinations (AX200). AX200 will provide a thorough understanding of Axiom that will help students focus on the cloud aspect of investigations in AX220.
Course modules
Module 1: Course introduction and Magnet Axiom installation
In this introductory module, the learning objectives will be presented along with the expected outcomes for the two-day training event and all related course materials. The module will conclude with a hands-on exercise during which students will install Magnet Axiom and learn about its associated components: Axiom Process and Axiom Examine.
Module 2: Evidence processing and case creation
This module of instruction will focus on the many features available in Axiom Process. Students will be shown how to successfully acquire forensic images from various evidence sources, configure case-specific and global settings in Axiom Process for the recovery of key artifacts, and create a case for analysis in Axiom Examine. After the creation of the case, the Axiom Examine interface will be introduced. This module includes an instructor-led exercise to reinforce the learning objectives.
Module 3: Mobile device security, devices states, and acquisition types
This module will focus on the current state of mobile device security with a focus on best practices for handling, preserving, and acquiring the data contained within. Students will be given an overview of mobile device security, acquisition types available for specific device states and scenarios, and a basic understanding of mobile device file systems for both iOS and Android devices.
Module 4: User attribution
Students will learn about the core artifacts for determining user attribution in this module. These artifacts enable the examiner to determine identifying information about the device, its software (including operating system and installed applications), and user accounts associated with the device.
Module 5: Communications
In this module, students will learn about the Communications category of Magnet Axiom for mobile devices including how to use the Conversation View, threaded chats, and filtering of data in order to understand and parse conversation data. Artifacts for this section include iOS iMessage/SMS/MMS, Android SMS/MMS and RCS messages for third party applications.
Module 6: Web related
Students will explore web-related categories including iOS Safari and the Chrome, Samsung, Brave, and DuckDuckGo browsers on Android. From there, they will learn how these browsers store their data and how Axiom parses URL and other information for review.
Module 7: Refined results
Designed to instruct students on how to use Refined Results in Magnet Axiom in mobile examinations, this module will also help them to understand Magnet Axiom Examine’s basic functionalities including filtering and searching. Students will break down what Refined Results are within Axiom and how to properly utilize them.
Module 8: Media
In this module, students will explore the Media category for artifacts including pictures, videos, and audio files. Students will learn how to visualize the data using the built-in Preview cards, how to filter on data within the Artifact Explorer and how to direct a filter from the File System Explorer. Students will develop a workflow for dealing with media data in mobile devices.
Module 9: Pattern-of-life artifacts
In this final module, students will explore the pattern-of-life artifacts which contain data about the device’s power, network, and application usage, as well as location information. For iOS devices, students will learn about artifacts from Biomes and KnowledgeC, Significant Locations, Apple Maps and FindMy. For Android devices, students will learn about artifacts from Samsung Digital Wellbeing and Android Usage History.
Additional information
Who should attend: Participants who are unfamiliar with the principles of digital forensics
Advanced preparation: None
Program level: Intermediate-level
Field of study: Computer software & applications
Delivery method: Group internet based
Refunds and cancellations: Training Course(s) can be rescheduled to a later date or cancelled by either Magnet Forensics or you without charge or penalty if written notice is received twenty-one (21) days or more prior to the date of the Training Course. No rescheduling shall be permitted on less than twenty-one (21) days written notice, which shall constitute a cancellation without a refund. Your written rescheduling or cancellation notice must be emailed to training@magnetforensics.com or contact 226-499-8962. If Magnet Forensics cancels a Training Course due to insufficient attendance, you will have the option to register in a different scheduled Training Course or receive a full refund. Please do not book travel until you have confirmed that the Training Course will be running.
Magnet Forensics is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website:www.nasbaregistry.org.