VK200 Verakey Examinations
Magnet Verakey Examinations (VK200) is an intermediate-level four-day training course, designed for participants who are familiar with the principles of digital forensics and who are seeking to improve their mobile device investigations.
Description
This course details the mobile device extraction capabilities of Magnet Verakey combined with the mobile analysis capabilities of Magnet Axiom Cyber. Students will learn relevant skills and training on how to extract data from iOS and Android devices and learn to leverage the data outputs in relation to a wide range of enterprise style investigations.
These modules of instruction will build the participants’ ability to understand how to access data effectively and efficiently from mobile devices using Magnet Verakey. Modules will also build upon the core concepts of iOS and Android analysis, including log analysis and operating system artifacts for the purposes of enterprise style investigations such as insider threats, data exfiltration and compromised devices.
Course modules
MODULE 1: Course introduction
- Meet the instructor and other students while seeing what’s expected for the week.
- Install Magnet Axiom Cyber and other open-source tools and files that are needed for the course completion.
- A discussion of mobile evidence handling considerations within investigations, including the current state of mobile forensics and how that impacts enterprise devices.
MODULE 2: Ios device security within enterprise environments
- Understand the encryption methodologies used by Apple within their mobile operating systems and how they impact the collection of data from devices.
- Gain insight into Apple’s File Data Protection system, including hardware such as the Secure Enclave.
- Learn how iOS/iPadOS devices with an MDM (Mobile Device Management) profile can be configured and how this forensically impacts the data available from managed devices.
MODULE 3: Android device security within enterprise environments
- Gain an understanding of the encryption methodologies used by Android devices and how this impacts the collection of data from devices.
- Understand the fragmentation of Android devices and the implementation of an open-source operating system amongst a wide variety of different hardware.
- Learn how Android devices with an MDM (Mobile Device Management) profile can be configured and how this forensically impacts the data available from managed devices.
MODULE 4: Verakey introduction and settings
- Learn how to set up and configure the Verakey.
- Understand the settings of the Verakey and how they can be configured for different types of investigations.
- Gain an understanding of how the Verakey software and hardware is managed.
MODULE 5: Verakey acquisitions, outputs, & stored results
- Understand the different types of consent-based extractions available with Verakey.
- Gain an understanding of the different workflow options with Verakey.
- Learn and understand about Verakey support and how to interpret the support matrices.
- Learn how to access and extract data from iOS and Android devices, including those enrolled with an MDM (Mobile Device Management) profile.
- Understand the results that Verakey outputs, including progress reports and stored results.
MODULE 6: Processing Verakey outputs with Magnet Axiom Cyber
- Understand best practices for transporting data from the Verakey
- Learn how to correctly process data extracted by Verakey in Axiom Cyber.
- Students will learn how to connect a Verakey unit into the Magnet Forensics suite of products.
- Students will gain an understanding of the different settings with Axiom Cyber Process and how they impact the processing of data.
- Learn how to process file types that are not natively supported by Axiom Cyber.
MODULE 7: Axiom Cyber—operating system analysis
- Understand core operating system artifacts from both iOS and Android devices.
- Learn how to make use of tools such as the Mobile View and Timeline explorer within Axiom Cyber.
- Students will learn how specific artifacts relating to iOS and Android devices can be applied to investigations such as theft, data exfiltration, and extortion.
MODULE 8: Axiom Cyber—pattern of life and log analysis
- Understand the different types of logs that are available from iOS devices, such as Unified Logs and File System Events.
- Understand the different types of logs that are available from Android devices.
- Learn about pattern of life analysis when examining mobile devices and how they can be interpreted and interrogated by Axiom Cyber.
- Students will gain an understanding of how different tools within Axiom Cyber including Route View and Connections, can be used to investigate a wide range of case types including compromised devices and asset misuse.
MODULE 9: Axiom Cyber—communications & email analysis
- This module will focus on communications and email data available from iOS and Android devices.
- Students will gain an understanding of tools such as Conversation View and the Email Explorer within Axiom Cyber.
- Understand the different types of web analysis artifacts available within Axiom Cyber, and how they can be applied to a range of investigation types including phishing and insider trading.
MODULE 10: Axiom Cyber—reporting
- This module will focus on best practices to enable users to report on findings within Axiom Cyber.
- Students will gain an understanding of the different types of exports available within Axiom Cyber, including Portable Case management.
- Learn how to enable better reporting from Axiom Cyber using Magnet Exhibit Builder.
Additional information
Who Should Attend: Participants who are unfamiliar with the principles of digital forensics
Advanced Preparation: None
Program Level: Advanced-level
Field of Study: Computer Software & Applications
Delivery Method: Group Live
Refunds and Cancellations: Training Course(s) can be rescheduled to a later date or cancelled by either Magnet Forensics or you without charge or penalty if written notice is received twenty-one (21) days or more prior to the date of the Training Course. No rescheduling shall be permitted on less than twenty-one (21) days written notice, which shall constitute a cancellation without a refund. Your written rescheduling or cancellation notice must be emailed to training@magnetforensics.com or contact 226-499-8962. If Magnet Forensics cancels a Training Course due to insufficient attendance, you will have the option to register in a different scheduled Training Course or receive a full refund. Please do not book travel until you have confirmed that the Training Course will be running.
Magnet Forensics is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website:www.nasbaregistry.org.