ja

vi
er
@
dg
for
en
si
ks
.m
x9
/2
8/
20
20
 Copyright © 2019 Magnet Forensics
Magnet AXIOM AXIOM Examinations (AX200) Training
1908

No part of this document may be copied or reproduced

without the written permission of Magnet Forensics

Magnet Forensics
156 Columbia St W., Unit 2
Waterloo, ON, Canada
519-342-0195

magnetforensics.com
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

© 2019
Magnet AXIOM®, and related trademarks, names and logos are the property of Magnet Forensics and are registered and/or used in the U.S.
and countries around the world. All other marks and brands may be claimed as the property of their respective owners.

ii MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
TABLE OF CONTENTS
PREFACE ..................................................................................................................................................... XIII

Module 1 Course Introduction and Magnet AXIOM Installation ......................................... 1

AX200 COURSE INTRODUCTION ................................................................................................................... 4
WELCOME AND PERSONAL INTRODUCTIONS ............................................................................................ 4
COURSE OUTLINE .......................................................................................................................................... 4
SYSTEM REQUIREMENTS ............................................................................................................................ 6
ABOUT MAGNET AXIOM ................................................................................................................................. 7
MAGNET AXIOM PROCESS ............................................................................................................................ 9
MAGNET AXIOM EXAMINE .......................................................................................................................... 10
................................................................................................................................................ 10
PRODUCT INSTALLATION AND CLASSROOM COMPUTER SETUP .......................................................... 12
RUNNING EXERCISES ................................................................................................................................. 12
INSTALLATION OF MAGNET AXIOM ........................................................................................................ 12
ACTIVATION OF THE SOFTWARE LICENSE KEY ..................................................................................... 13
REVIEW OF THE INSTALLATION FILES AND FOLDERS ......................................................................... 13
CLASSROOM COMPUTER SETUP ............................................................................................................. 13

Module 2 Evidence Processing and Case Creation ........................................................... 17

AXIOM OVERVIEW ........................................................................................................................................ 20
PROCESSING OVERVIEW ............................................................................................................................. 21
CASE DETAILS .............................................................................................................................................. 22
EVIDENCE SOURCES.................................................................................................................................... 23
PROCESSING DETAILS ................................................................................................................................ 30
ARTIFACT DETAILS ...................................................................................................................................... 35
ANALYZE EVIDENCE .................................................................................................................................... 37
20

DASHNER CASE SCENARIO ........................................................................................................................ 38

20

RUNNING EXERCISES .................................................................................................................................. 39

8/

CREATING A NEW CASE ........................................................................................................................... 39

/2
x9

ADDING EVIDENCE TO THE CASE ............................................................................................................ 39

.m

SETTING THE PROCESS OPTIONS ........................................................................................................... 40

ks

SELECTING ARTIFACTS TO PROCESS AND SETTING ARTIFACT OPTIONS .......................................... 42

si
en

POST-PROCESSING ..................................................................................................................................... 44
or

ENCRYPTED DRIVES .................................................................................................................................... 47

f
dg

RUNNING EXERCISE ................................................................................................................................... 49

@
er

POST-PROCESSING AND ENCRYPTED DRIVES ...................................................................................... 49

vi

AXIOM EXAMINE SETTINGS ........................................................................................................................ 51

ja

CASE DASHBOARD ...................................................................................................................................... 54

RUNNING EXERCISE ................................................................................................................................... 60
CASE DASHBOARD ................................................................................................................................... 60
ARTIFACT EXPLORER .................................................................................................................................. 61

MAGNET AXIOM EXAMINATIONS (AX200) iii

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results ...................................... 69
REFINED RESULTS ................................................................................................................................... 72
HELP/DOCUMENTATION ............................................................................................................................. 73
GOOGLE SEARCHES .................................................................................................................................... 74
SOURCE LINKING ......................................................................................................................................... 75
RUNNING EXERCISE ................................................................................................................................... 78
GOOGLE SEARCHES ................................................................................................................................. 78
PARSED SEARCH QUERIES ......................................................................................................................... 79
RUNNING EXERCISE ................................................................................................................................... 80
PARSED SEARCH QUERIES ...................................................................................................................... 80
CLASSIFIEDS URLS ..................................................................................................................................... 81
RUNNING EXERCISE ................................................................................................................................... 83
CLASSIFIEDS URLS .................................................................................................................................. 83
CLOUD SERVICES URLS .............................................................................................................................. 83
RUNNING EXERCISE ................................................................................................................................... 84
CLOUD SERVICES URLS ........................................................................................................................... 84
FACEBOOK URLS ......................................................................................................................................... 85
RUNNING EXERCISE ................................................................................................................................... 86
FACEBOOK URLS ...................................................................................................................................... 86
SOCIAL MEDIA URLS ................................................................................................................................... 87
RUNNING EXERCISE ................................................................................................................................... 88
SOCIAL MEDIA URLS ................................................................................................................................ 88
GOOGLE MAP QUERIES ............................................................................................................................... 89
IDENTIFIERS ................................................................................................................................................. 90
PROFILES ..................................................................................................................................................... 91
RUNNING EXERCISE ................................................................................................................................. 93
CREATING A PROFILE ............................................................................................................................. 93
EDITING A PROFILE ................................................................................................................................. 93
MANAGING PROFILES .............................................................................................................................. 93
MODULE REVIEW ......................................................................................................................................... 95
REVIEW QUESTIONS .................................................................................................................................... 96
20

RUNNING EXERCISE .................................................................................................................................... 97

20
8/

RESEARCH OF A CONTROLLED SUBSTANCE ..................................................................................... 97

/2

ADVANCED SEARCHING AND FILTERING .............................................................................................. 98

x9
.m

CREATING AND USING PROFILES ........................................................................................................... 99

ks
si
en

Module 3 Computer Artifact Analysis Part 2 Chat ....................................................... 103

f or
dg

MAGNETAXIOMPROCESSCHATARTIFACTS ............................................................................................. 106

@

CUSTOM ARTIFACTS .................................................................................................................................. 108

er

YAHOO MESSENGER ................................................................................................................................. 109

vi
ja

RUNNING EXERCISE ................................................................................................................................. 110

AXIOM PROCESS CHAT SETTINGS ......................................................................................................... 110
CHAT ARTIFACTS ....................................................................................................................................... 110
ARTIFACTS ROW VIEW ........................................................................................................................... 112
ARTIFACTS CONVERSATION VIEW ........................................................................................................ 113
ARTIFACTS MAGNET ARTIFICIAL INTELLEGENCE CATEGORIZE CHATS ........................................ 114

iv MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 RUNNING EXERCISE ................................................................................................................................. 115
ENABLING MAGNET.AI ........................................................................................................................... 115
ARTIFACTS SOURCE LINKING ............................................................................................................... 115
SKYPE ........................................................................................................................................................ 117
RUNNING EXERCISE ................................................................................................................................. 119
SKYPE ACCOUNTS .................................................................................................................................. 119
SKYPE AVATAR ................................................................................................................................... 120
SKYPE CHAT MESSAGES .......................................................................................................................... 120
RUNNING EXERCISE ............................................................................................................................... 121
SKYPE CHAT MESSAGES........................................................................................................................ 121
SKYPE CONTACTS ...................................................................................................................................... 123
RUNNING EXERCISE ................................................................................................................................. 124
SKYPE CONTACTS ................................................................................................................................... 124
SKYPE IP ADDRESSES ........................................................................................................................... 124
RUNNING EXERCISE ................................................................................................................................. 126
SKYPE IP ADDRESSES............................................................................................................................ 126
APPLICATION OPTIONS FOR MOBILE CHAT ARTIFACTS .............................................................. 127
REVIEW QUESTIONS .................................................................................................................................. 129
STUDENT EXERCISE .................................................................................................................................. 130

Module 3 Computer Artifact Analysis Part 3 Documents ........................................... 133

DOCUMENTS ARTIFACTS .......................................................................................................................... 136
DOCUMENT CONTENT ............................................................................................................................... 137
EXPORTING DOCUMENTS TO A LOCAL DRIVE ........................................................................................ 139
RUNNING EXERCISE ................................................................................................................................. 140
VIEWING AND SEARCHING DOCUMENT CONTENT ............................................................................. 140
EXPORTING DOCUMENT ARTIFACTS..................................................................................................... 141
DOCUMENT METADATA ............................................................................................................................ 141
CREATING AN ARTIFACT REPORT ............................................................................................................ 142
RUNNING EXERCISE ................................................................................................................................. 145
VIEWING AND SEARCHING DOCUMENT METADATA ........................................................................... 145
20
20

CONNECTIONS ........................................................................................................................................... 146

8/

RUNNING EXERCISE ................................................................................................................................. 150

/2
x9

CONNECTIONS ........................................................................................................................................ 150

.m

TIMELINE ................................................................................................................................................... 151

ks

RUNNING EXERCISE................................................................................................................................ 152

si
en

CONNECTIONS ....................................................................................................................................... 152

or

MODULE REVIEW ....................................................................................................................................... 153

f
dg

REVIEW QUESTIONS .................................................................................................................................. 154

@
er

STUDENT EXERCISE .................................................................................................................................. 155

vi
ja

Module 3 Computer Artifact Analysis Part 4 Email ..................................................... 159

EMAIL ARTIFACTS ..................................................................................................................................... 162
EMAIL CONTENT ....................................................................................................................................... 163
EMAIL SOURCE LINKING........................................................................................................................... 164
RUNNING EXERCISE ................................................................................................................................. 165

MAGNET AXIOM EXAMINATIONS (AX200) v

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 VIEWING EMAIL CONTENT ..................................................................................................................... 165
EMAIL SOURCE LINKING........................................................................................................................ 165
EMAIL MESSAGE HEADERS...................................................................................................................... 165
EMAIL ATTACHMENTS ............................................................................................................................. 166
CREATING AN EMAIL REPORT.................................................................................................................. 167
RUNNING EXERCISE ................................................................................................................................. 167
CREATING AN EMAIL REPORT............................................................................................................... 167
VIEWING EMAIL ATTACHMENTS ........................................................................................................... 168
EXPORTING EMAILS TO A PST FILE ...................................................................................................... 168
SEARCHING EMAIL .................................................................................................................................... 169
RUNNING EXERCISE ................................................................................................................................. 169
SEARCHING EMAILS ............................................................................................................................... 169
MODULE REVIEW ....................................................................................................................................... 170
REVIEW QUESTIONS .................................................................................................................................. 171
STUDENT EXERCISE .................................................................................................................................. 172

Module 3 Computer Artifact Analysis Part 5 Media .................................................... 175

MEDIA ARTIFACTS .................................................................................................................................... 178
PICTURES.................................................................................................................................................... 178
VIDEOS ........................................................................................................................................................ 181
CATEGORIZING PICTURES USING MAGNET.AI ........................................................................................ 183
MODULE REVIEW ....................................................................................................................................... 186
REVIEW QUESTIONS................................................................................................................................. 187
STUDENT EXERCISE .................................................................................................................................. 188

Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools ...... 193
ENCRYPTION & ANTI-FORENSICS TOOLS ............................................................................................... 196
MODULE REVIEW ....................................................................................................................................... 200
REVIEW QUESTIONS................................................................................................................................. 201
STUDENT EXERCISE .................................................................................................................................. 202
20
20
8/
/2

Module 3 Computer Artifact Analysis Part 7 Web Related ......................................... 205

x9
.m

WEB RELATED ARTIFACTS ....................................................................................................................... 208

ks

BROWSER ARTIFACTS AND REFINED RESULTS .................................................................................... 209

si
en

HISTORY GOOGLE CHROME ................................................................................................................... 210

or

RUNNING EXERCISE ................................................................................................................................. 213

f
dg

CHROME HISTORY................................................................................................................................... 213

@

HISTORY MOZILLA FIREFOX .................................................................................................................. 214

er
vi

RUNNING EXERCISE ................................................................................................................................. 216

ja

FIREFOX HISTORY ................................................................................................................................... 216

HISTORY MICROSOFT INTERNET EXPLORER & EDGE ......................................................................... 217
RUNNING EXERCISE ................................................................................................................................. 220
INTERNET EXPLORER AND EDGE HISTORY .................................................................................. 220
SESSION RECOVERY .................................................................................................................................. 223
CHROME................................................................................................................................................... 223

vi MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 FIREFOX ................................................................................................................................................... 224
INTERNET EXPLORER AND EDGE ......................................................................................................... 225
RUNNING EXERCISES ............................................................................................................................... 226
CHROME SESSION RECOVERY ............................................................................................................... 226
FIREFOX SESSION RECOVERY ............................................................................................................... 226
EDGE SESSION RECOVERY .................................................................................................................. 226
DOWNLOADS ............................................................................................................................................. 227
CHROME................................................................................................................................................... 227
FIREFOX ................................................................................................................................................... 228
INTERNET EXPLORER AND EDGE ......................................................................................................... 228
RUNNING EXERCISES ............................................................................................................................... 229
CHROME DOWNLOADS .......................................................................................................................... 229
FIREFOX DOWNLOADS ........................................................................................................................... 230
EDGE DOWNLOADS ................................................................................................................................ 230
BOOKMARKS .............................................................................................................................................. 231
CHROME................................................................................................................................................... 232
FIREFOX ................................................................................................................................................... 232
INTERNET EXPLORER AND EDGE ......................................................................................................... 233
RUNNING EXERCISE ................................................................................................................................. 234
CHROME BOOKMARKS ....................................................................................................................... 234
FIREFOX BOOKMARKS ........................................................................................................................... 235
COOKIES ..................................................................................................................................................... 236
CHROME................................................................................................................................................... 236
FIREFOX ................................................................................................................................................... 237
INTERNET EXPLORER ............................................................................................................................ 238
EDGE ........................................................................................................................................................ 239
GOOGLE ANALYTICS ................................................................................................................................ 240
FIRST VISIT COOKIES .............................................................................................................................. 241
SESSION COOKIES .................................................................................................................................. 241
REFERRAL COOKIES ........................................................................................................................... 242
RUNNING EXERCISE ................................................................................................................................. 243
20

CHROME COOKIES .................................................................................................................................. 243

20

FIREFOX COOKIES ................................................................................................................................... 243

8/

INTERNET EXPLORER COOKIES ............................................................................................................ 243

/2
x9

INTERNET BROWSER CACHE ................................................................................................................... 244

.m

CACHE CHROME ...................................................................................................................................... 244

ks

RUNNING EXERCISE ................................................................................................................................. 247

si
en

CHROME CACHE ...................................................................................................................................... 247

or

CACHE FIREFOX ...................................................................................................................................... 248

f
dg

RUNNING EXERCISE ................................................................................................................................. 250

@
er

FIREFOX CACHE ...................................................................................................................................... 250

vi

CACHE EDGE ........................................................................................................................................... 251

ja

RUNNING EXERCISE ................................................................................................................................. 253

EDGE CACHE ......................................................................................................................................... 253
TYPED URLS ............................................................................................................................................. 253
CHROME AND FIREFOX .......................................................................................................................... 253
INTERNET EXPLORER AND EDGE ......................................................................................................... 255
RUNNING EXERCISE ................................................................................................................................. 256

MAGNET AXIOM EXAMINATIONS (AX200) vii

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 CHROME TYPED URLS ............................................................................................................................ 256
FIREFOX TYPED URLS ............................................................................................................................ 256
INTERNET EXPLORER TYPED URLS...................................................................................................... 257
EDGE TYPED URLS ................................................................................................................................. 257
FORM FILL INFORMATION AND SEARCH DATA ..................................................................................... 258
CHROME................................................................................................................................................... 258
FIREFOX ................................................................................................................................................... 260
INTERNET EXPLORER AND EDGE ......................................................................................................... 261
RUNNING EXERCISE ................................................................................................................................. 261
CHROME AUTOFILL ................................................................................................................................ 261
FIREFOX FORMHISTORY ......................................................................................................................... 261
MODULE REVIEW ....................................................................................................................................... 262
REVIEW QUESTIONS................................................................................................................................. 263
STUDENT EXERCISE .................................................................................................................................. 264

Module 3 Computer Artifact Analysis Part 8 Operating System ................................ 269

OS ARTIFACTS PERSONAL COMPUTERS (PCS) ................................................................................... 272
WINDOWS REGISTRY ................................................................................................................................. 274
FILE SYSTEM INFORMATION .................................................................................................................... 276
DRIVE IDS AND MOUNTED DEVICES ........................................................................................................ 276
PARTITIONING SCHEME ............................................................................................................................ 278
RUNNING EXERCISE ................................................................................................................................. 279
FILE SYSTEM INFORMATION ................................................................................................................. 279
OPERATING SYSTEM INFORMATION........................................................................................................ 280
TIMEZONE INFORMATION ......................................................................................................................... 283
USER ACCOUNTS ....................................................................................................................................... 284
SAM FILE - F KEY ....................................................................................................................................... 287
SAM FILE V KEY ...................................................................................................................................... 288
SOFTWARE HIVE ........................................................................................................................................ 289
RUNNING EXERCISE ................................................................................................................................. 289
OPERATING SYSTEM INFORMATION..................................................................................................... 289
20
20

TIMEZONE INFORMATION ...................................................................................................................... 290

8/

USER ACCOUNTS .................................................................................................................................... 291

/2
x9

USB DEVICES .............................................................................................................................................. 292

.m

MOUNTED DEVICES ................................................................................................................................... 293

ks

MOUNTPOINTS2 ......................................................................................................................................... 296

si
en

USERASSIST ............................................................................................................................................... 296

or

LNK FILES .................................................................................................................................................. 299

f
dg

RECENT DOCS ............................................................................................................................................ 300

@
er

JUMP LISTS ................................................................................................................................................ 301

vi

SHELLBAGS ............................................................................................................................................... 304

ja

RUNNING EXERCISE ................................................................................................................................. 305

LNK FILES ............................................................................................................................................... 305
USB DEVICES ........................................................................................................................................... 306
JUMP LISTS ............................................................................................................................................. 307
SHELLBAGS ............................................................................................................................................ 308
PREFETCH .................................................................................................................................................. 309

viii MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 PREFETCH SETTING IN THE REGISTRY .................................................................................................... 311
WINDOWS EVENT LOGS ............................................................................................................................ 312
WINDOWS EVENT LOG FILTERING ........................................................................................................... 314
RUNNING EXERCISE ................................................................................................................................. 315
WINDOWS PREFETCH FILES ................................................................................................................. 315
WINDOWS EVENT LOGS ......................................................................................................................... 317
MODULE REVIEW ....................................................................................................................................... 317
REVIEW QUESTIONS .................................................................................................................................. 318

Module 4 Mobile Artifact Analysis ................................................................................... 323

SMARTPHONE OPERATING SYSTEMS .................................................................................................... 326
IOS ............................................................................................................................................................... 326
INSTRUCTOR DEMONSTRATION............................................................................................................... 328
UDID IDENTIFICATION ............................................................................................................................ 328
REGISTRY ENTRIES.................................................................................................................................... 329
ITUNES BACKUP ........................................................................................................................................ 330
LOADING FORENSIC IMAGES/DATA INTO AXIOM ................................................................................... 334
RUNNING EXERCISE ................................................................................................................................. 335
ADDING IMAGES TO AXIOM USING AN EXISTING CASE ...................................................................... 335
IMAGING IN AXIOM ...................................................................................................................................... 336
MOBILE IMAGE TYPES ............................................................................................................................... 340
IOS FULL IMAGES AND JAILBREAKING .................................................................................................. 341
IMAGE FILES............................................................................................................................................... 343
INSTRUCTOR DEMONSTRATION............................................................................................................... 344
ACQUIRING AN IOS DEVICE .................................................................................................................... 344
ACQUIRING AN ANDROID DEVICE ......................................................................................................... 344
MOBILE ARTIFACTS ................................................................................................................................... 345
SQLITE AND PLIST FILES .......................................................................................................................... 346
VIEWING ARTIFACTS ................................................................................................................................. 347
CONVERSATION VIEW ............................................................................................................................... 348
CUSTOM ARTIFACTS .................................................................................................................................. 350
20
20

ANDROID OS ............................................................................................................................................... 351

8/

ACQUIRING ANDROID DEVICES ................................................................................................................ 352

/2
x9

WHAT IS ADB.............................................................................................................................................. 353

.m

DEVELOPER OPTIONS ............................................................................................................................... 354

ks

USB DEBUGGING ....................................................................................................................................... 354

si
en

ANDROID IMAGE TYPES ............................................................................................................................ 355

or

ROOTING ..................................................................................................................................................... 357

f
dg

ARTIFACTS IN A FULL IMAGE .................................................................................................................... 358

@
er

DATA FROM OTHER SOURCES .................................................................................................................. 359

vi

RUNNING EXERCISE ................................................................................................................................. 359

ja

ADDING DATA FROM OTHER SOURCES .............................................................................................. 359

Module 5 Cloud ................................................................................................................. 363

WHAT IS THE CLOUD? ............................................................................................................................... 366
ACQUIRING DATA WITH AXIOM CLOUD ................................................................................................... 367

MAGNET AXIOM EXAMINATIONS (AX200) ix

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 WHAT IS A TOKEN? ................................................................................................................................... 369
APPLE ......................................................................................................................................................... 369
FACEBOOK.................................................................................................................................................. 371
DROPBOX .................................................................................................................................................... 372
GOOGLE ...................................................................................................................................................... 373
CLOUD ARTIFACTS .................................................................................................................................... 375
RUNNING EXERCISE ................................................................................................................................. 376
ADDING CLOUD DATA ............................................................................................................................ 376
REVIEWING CLOUD DATA ......................................................................................................................... 376
CLOUD ACCOUNTS INFORMATION AND CLOUD PASSWORDS AND TOKENS ..................................... 377
ICLOUD PHOTOS ........................................................................................................................................ 378
DROPBOX .................................................................................................................................................... 379
FACEBOOK.................................................................................................................................................. 381
GOOGLE ...................................................................................................................................................... 384
RUNNING EXERCISE ................................................................................................................................. 388
REVIEWING CLOUD ARTIFACTS............................................................................................................. 388
MODULE REVIEW ....................................................................................................................................... 390
REVIEW QUESTIONS................................................................................................................................. 391
STUDENT EXERCISE .................................................................................................................................. 392

Module 6 Reporting .......................................................................................................... 395

EXPORTING ARTIFACTS VIEW .............................................................................................................. 398
EXPORTING PORTABLECASE ................................................................................................................ 399
MERGING PORTABLE CASES .................................................................................................................... 401
MERGING PORTABLE CASES TAGS....................................................................................................... 401
MANAGING PORTABLE CASES COMMENTS......................................................................................... 402
RUNNING EXERCISE ................................................................................................................................. 403
EXPORTING FROM THE FILE MENU ...................................................................................................... 403
EXPORTING FROM THE EVIDENCE PANE ............................................................................................. 403
EXPORTING FROM THE FILE SYSTEM EXPLORER ............................................................................... 404
SAVING FILES FROM THE ARTIFACTS EXPLORER ............................................................................... 404
20
20

SAVING FILES FROM THE FILE SYSTEM EXPLORER ........................................................................... 404

8/

CREATING A PORTABLE CASE............................................................................................................... 405

/2
x9

MERGING A PORTABLE CASE ................................................................................................................ 405

.m

SPECIAL EXPORTS PROJECT VIC........................................................................................................... 406

ks

SPECIAL EXPORTS IDENTIFIERS ........................................................................................................... 407

si
en

EXPORTING FILE SYSTEM EXPLORER .................................................................................................. 408

or

SAVING FILES ARTIFACT AND FILE SYSTEM EXPLORERS ................................................................. 408

f
dg

CASE REPORTING ...................................................................................................................................... 409

@
er

CASE REPORTING FINAL REPORT ........................................................................................................ 410

vi

RUNNING EXERCISE ................................................................................................................................. 411

ja

CREATING A CASE REPORT ARTIFACT CATEGORIES ....................................................................... 411

CREATING A CASE REPORT TAGGED ITEMS ..................................................................................... 411
REVIEW QUESTIONS .................................................................................................................................. 413
STUDENT EXERCISE .................................................................................................................................. 415

x MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 7 Cumulative Review Exercise ........................................................................... 419
JACK WATERS CASE SCENARIO .............................................................................................................. 421
CUMULATIVE EXERCISE ......................................................................................................................... 422

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) xi

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

xii MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
PREFACE
Welcome to the Magnet Forensics® AXIOM Examinations (AX200) training course. forensic
investigators are navigating through an ever-changing technology landscape. The volume, velocity, and
variety of Internet evidence entering the marketplace all pose unique challenges. For digital forensics
professionals to meet these challenges, accomplish their mission, and uncover the truth, they must be
equipped with the right combination of analytic tools, and practical training.
Magnet AXIOM, from Magnet Forensics Inc. allows investigators to explore the evidence in great depth,
while simplifying analysis activities by intuitively linking facts and data in a way that helps investigators
draw insightful conclusions. Training from Magnet Forensics is designed and delivered by experts with
decades of real world experience in the field of digital forensics. The combination of AXIOM and AXIOM-
based training, from Magnet Forensics, provides the perfect solution for students whose working
environments demand they have the right tools and knowledge to accomplish their mission.

COURSE OVERVIEW
This four-day instructor-led course provides students with the knowledge and skill sets necessary to
install, configure, and use Magnet Forensics, Inc. software tools, in support of their investigative efforts. The
Magnet Forensics, Inc. forensic tools covered during this course include:

• Magnet AXIOM Process

• Magnet AXIOM Examine

AUDIENCE
This course is intended for users who are responsible for collecting and analyzing digital evidence
artifacts stored on various media platforms, including PCs and mobile devices. Although designed for
20

users who are new to Magnet AXIOM, experienced practitioners who have not attended formalized AXIOM
20
8/

training will also benefit greatly from the course materials.

/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) xiii

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

xiv MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 1 Course Introduction and Magnet AXIOM
Installation
1

MODULE 1:
Course Introduction and Magnet AXIOM Installation
20
20
8/
/2
x9
.m
ks
si
en
or
f
dg
@
er
vi
ja
Module 1 Course Introduction and Magnet AXIOM Installation

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

2 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 1 Course Introduction and Magnet AXIOM Installation

LEARNING OBJECTIVES
In this module, students will review the course outline and introduce themselves to other participants of
the course. Students will learn how to install the Magnet AXIOM platform, and its core components
AXIOM Process and AXIOM Examine.

GOALS
At the conclusion of this module, students will be able to demonstrate the proper installation of Magnet
AXIOM and will be able to identify the core files and folders that can be shared between installations of
Magnet AXIOM.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 3

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 1 Course Introduction and Magnet AXIOM Installation

AX200 COURSE INTRODUCTION

Welcome to the Magnet AXIOM Examinations Course (AX200). This is an intermediate level course,
designed for students who are familiar with the principles of digital forensics, and seeking to use AXIOM
for their investigations. At the conclusion of the 4-day training event students will have the knowledge
and skills they need to: acquire forensic images from computer and smartphone evidence, configure
AXIOM Process to recover the most-relevant artifacts for their investigations, use AXIOM Examine to
explore the evidence in greater depth, simplify analysis activities by intuitively linking facts and data, and
prepare key artifacts for collaboration with other stakeholders. Each module of instruction employs
extensive scenario-based hands-on exercises to reinforce the learning objectives, and further enhance

WELCOME AND PERSONAL INTRODUCTIONS

• Who are you and where do you work?

• your primary role? Investigations? Forensics?

• What previous forensic training have you received?

• Which forensic software tools are you currently using?

• Look at the index in the beginning of this book and find one or two items that are most important to
you and share this with your instructor.
• What would you like to take away from this course?

COURSE OUTLINE
20
20

MODULE 1: COURSE INTRODUCTION AND MAGNET AXIOM INSTALLATION

8/
/2
x9

In this introductory module, students will be presented with the learning objectives and expected
.m

outcomes for the 4-day training event, and all related course materials. The module will conclude with a
ks
si

hands-on exercise during which students will install Magnet AXIOM and learn about its associated
en

components AXIOM Process and AXIOM Examine.

f or
dg
@
er
vi

MODULE 2: EVIDENCE PROCESSING AND CASE CREATION

ja

This module of instruction will focus on the many features available in AXIOM Process. The students will
be shown how to: successfully acquire forensic images from various evidence sources, configure case-
specific and global settings in AXIOM Process for the recovery of key artifacts, and create a case for
analysis in AXIOM Examine. After the creation of the case, students will be introduced to the AXIOM
Examine interface. This module includes an instructor-led exercise to reinforce the learning objectives.

4 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 1 Course Introduction and Magnet AXIOM Installation

MODULE 3: COMPUTER ARTIFACT ANALYSIS

This module of the course is composed of several sections, each of which focuses on a specific set of key
artifacts most commonly encountered during the analysis of computer evidence. The sections within this
module cover Refined Results, Chat clients, Documents, Email, Media, Social Networking, Internet
browsers, and Operating System artifact analysis. For each of the sections, scenario-based instructor-
led and student practical exercises will be used to demonstrate the navigation, searching, filtering, and
tagging features in AXIOM; and reinforce the learning objectives.

MODULE 4: MOBILE ARTIFACT ANALYSIS

In this module students will explore smartphone evidence parsed by Magnet AXIOM from iPhone and
Android devices. Additionally, this module will explore the device file systems and file structures to
recover additional information, including: device owner information, third party application data, core
operating system data, Internet browser data, and more. Scenario-based instructor-led and student
practical exercises will be used to demonstrate the navigation, searching, filtering, and tagging features
in AXIOM, and reinforce the learning objectives.

MODULE 5: CLOUD
In this module, students will learn about the Cloud component of AXIOM Process and Examine. The Cloud
component of AXIOM allows examiners to extract valuable evidence from cloud sources such as Google,
iCloud, Dropbox, Microsoft 0365 and others. Students will use hands-on exercises to learn how the
information collected from these sources can integrate with other data recovered from live evidence
sources and how it can play into their examinations.
20
20

MODULE 6: REPORTING
8/
/2

In this final instructional module of the course, students will explore the various exporting and reporting
x9
.m

features available within AXIOM that can be used to present of case evidence, and/or collaborate with
ks

other investigative stakeholders. Through the scenario-based instructor-led and student practical
si
en

exercises, participants will learn how to manage the exporting of artifacts, produce and merge portable
or

cases, and create a final investigative case report which is easily interpreted by both technical and non-
f
dg

technical recipients.
@
er
vi
ja

MODULE 7: CUMULATIVE REVIEW EXERCISE

Throughout the 4-day training event, instructor-led and student practical exercises are used to reinforce
the learning objectives and provide the participants with the knowledge and skills necessary to
successfully use Magnet AXIOM in their investigative workflow. To further reinforce the instructional

MAGNET AXIOM EXAMINATIONS (AX200) 5

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 1 Course Introduction and Magnet AXIOM Installation

goals of the course, students are presented with a final scenario-based practical exercise which
represents a cumulative review of the exercises conducted in each of the individual modules.

Each module of instruction during the course will have a similar structure. At the beginning of the module,
the learning objectives will be identified and explained by the instructor. The content of the module will
be presented, through a combination of demonstrations, open discussions, and instructor-led exercises.
A series of module review questions are provided to ensure students have understood the key concepts.
At the conclusion of the module, the students will participate in a scenario-based practical exercise
designed to test their understanding and application of the learning concepts.

SYSTEM REQUIREMENTS
Table 1.1 below details the minimum and recommended hardware requirements for running AXIOM on a
Microsoft Windows-based computer:
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Table 1.1 Hardware system requirements

6 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 1 Course Introduction and Magnet AXIOM Installation

OPERATING SYSTEM: Windows Vista (64-bit), Windows 7, Windows 8, Windows 10

SOFTWARE FRAMEWORK: Microsoft .NET 4.5.2, or newer
STORAGE DEVICE: The storage device should have enough space to store images and cases from devices
with large amounts of data (in some cases, these might be TBs in size). You can also help prevent thread
starvation by storing case data on a high-performance drive such as a Solid State Drive (SSD). SSDs have
input/output operations per second (IOPs) that are much faster than HDDs. Faster IOPs are helpful when
the system needs to read many small files.
MEMORY: As a general recommendation, you should allocate at least 2GB of RAM for every processing
core in your system. Without enough memory to keep each core working constantly, your system might
experience thread starvation. Thread starvation occurs when a processing core is sitting idle for an

CLOCK SPEED AND CORES: The easiest way to decrease scan times and increase performance in is to
add more CPU cores to your system. Magnet AXIOM is designed to create a separate thread for every
t is 32 cores). Increasing the clock speed of
your CPU is another way that you can improve performance. However, due to the multi-threaded

clock speeds. I o note that adding additional cores does not necessarily improve
performance in a linear way. The more cores that your system has, the more work it is for RAM to keep
each core busy with new instructions to process.

You can manually set the number of cores that you want AXIOM Process to use via the Search Speed
option accessed from the Tools → Settings menu. Select the number of cores AXIOM Process can use
from the Search Speed drop-down list.
VIRTUALIZATION: The only part of Magnet AXIOM that cannot be used in a virtual machine is image
acquisition. All other parts of Magnet AXIOM functions as normal.
ANTI-VIRUS: Some anti-virus software can interfere with the installation and operation of Magnet AXIOM.
20

If errors are encountered, disable the anti-virus software. This is especially true when adding the Project
20
8/

VIC/CAID or similar large data sets. During the import process, changes are being made to the local
/2
x9

SQLite database files associated with Magnet AXIOM and its installation. The anti-virus software can
.m

make this process very slow, because they are monitoring the safety of the local system.
ks
si
en
or

ABOUT MAGNET AXIOM

f
dg
@
er

AXIOM allows the examiner to explore evidence in greater depth and integrate digital data from multiple
vi
ja

devices in one case. With AXIOM, you can acquire, process, analyze and report using just one tool. Intuitive
linking will help you validate location data and find related artifact data quickly.
In the past, examiners used Magnet IEF to recover artifacts, and perform initial analysis. Now, AXIOM
recovers more, displays the file system and registry hives, delves deeper with more analysis tools and
features.

MAGNET AXIOM EXAMINATIONS (AX200) 7

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 1 Course Introduction and Magnet AXIOM Installation

With AXIOM, your examinations will be faster and more thorough. You will uncover facts quickly, validate
your findings with ease, and share the meaning of your results clearly. With advanced integration
features, AXIOM allows you to examine data recovered through other tools as well.
The AXIOM platform is comprised of two applications - AXIOM Process and AXIOM Examine.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

8 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 1 Course Introduction and Magnet AXIOM Installation

MAGNET AXIOM PROCESS

Figure 1.1 Magnet AXIOM core components AXIOM Process

With AXIOM Process, users can search images, drives, files and folders, and other sources to find
Users can customize and search for case-specific, or global
needs, by selecting specific artifacts or groups of artifacts. Keywords, regular expressions, and hash
values can also be used to further refine the scope of the evidence included in the resulting case. AXIOM
Process has the capability to create forensic images of iOS and Android devices, plus a variety of different
types of drives including HDD, SSD, USB and SD flash, and more. Users can customize the type of image
they want to acquire, depending on the evidence they are looking for, and time restraints. To streamline
the forensic workflow, AXIOM Process provides users with a single stage evidence processing capability,
in which forensic images can be automatically acquired, and processed.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 9

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 1 Course Introduction and Magnet AXIOM Installation

MAGNET AXIOM EXAMINE

Figure 1.2 Magnet AXIOM core components AXIOM Examine

After the analysis of the evidence with AXIOM Process is complete, AXIOM Examine presents the evidence
in a consumable and user-friendly manner. In addition to the Artifact explorer, users can now drill down
to the source of an artifact using the File system, or Registry explorer. An enhanced search and filters
bar also allows users to quickly narrow their focus to relevant artifacts, which can then be tagged. After
the examination of the evidence is finished, the next step is to share the findings. Using the enhanced
export functionality of AXIOM Examine, users can create intuitive exports, portable cases, and final case
reports for collaboration with other stakeholders.
20
20

When a new version of Magnet AXIOM is installed, a User Guide accompanies the installation. The User
8/
/2

Guide includes a section explaining the newly added features and/or artifacts. The User Guide can be
x9

accessed by either selecting the F1 key on the keyboard or selecting Help → Documentation → User
.m
ks

Guide from the menu bar.

si
en
f or
dg
@
er
vi
ja

10 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 1 Course Introduction and Magnet AXIOM Installation

Figure 1.3 Accessing the User Guide

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 11

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 1 Course Introduction and Magnet AXIOM Installation

The User Guide itself contains many useful information items, however it is recommended every time
AXIOM is updated, the examiner use this file to review the newly added features.

Figure 1.4 NEW IN MAGNET AXIOM listing

PRODUCT INSTALLATION AND CLASSROOM COMPUTER SETUP

The following instructor-led exercises are designed to familiarize students with the installation of Magnet
AXIOM and its associated files, folders, and applications. The following steps will also prepare the
classroom computers for all subsequent hands-on exercises.
NOTE: Depending on the classroom environment, the following installation steps may be performed
during the introductory module using a USB device, or a software application installer (*.exe)
for Magnet AXIOM from a location specified by the instructor.

RUNNING EXERCISES
20
20

INSTALLATION OF MAGNET AXIOM

8/
/2

•
x9

Open Windows Explorer and navigate to the location of the Magnet AXIOM installer. This will
.m

either be on the on the classroom computer, or a USB device provided by your instructor.
ks
si

•
en

Double-click the Magnet AXIOM installation file.

f or
dg

• Follow the installation wizard steps, accepting the license agreement and default installation
@

settings.
er
vi
ja

• Once the installation has completed, uncheck the option to Launch AXIOM Process, and click
Finish.

• After the installation there will be two new desktop icons AXIOM Process and AXIOM Examine.

• The temporary license key is located in the same folder as the AXIOM installation file.

12 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 1 Course Introduction and Magnet AXIOM Installation

ACTIVATION OF THE SOFTWARE LICENSE KEY

• After successfully installing Magnet AXIOM, launch AXIOM Process from the desktop icon.

• Select the Help menu.

• From the Help menu, select Licensing.

• Browse to the location specified by your instructor and locate the AXIOM training license key.

• The licence key is a plain text file. Open the file, copy the entire content to the clipboard and
return to the Licensing window.

• Paste the key from the clipboard into the LICENSE KEY field and click OKAY to apply the
temporary license.

• Confirmation of the license details should be listed at the top of the Licensing window under
LICENSE INFORMATION.
REVIEW OF THE INSTALLATION FILES AND FOLDERS
• Open Windows Explorer and navigate to the folder
C:\Program Files\Magnet Forensics\Magnet AXIOM\

• Note the folders for AXIOM Process and AXIOM Examine.

CLASSROOM COMPUTER SETUP
• If they have not already been copied by the instructor, copy the following classroom folders to
the desktop:

a. Cases
20

b. Evidence
20
8/
/2

• Create the following folders on the desktop:

x9
.m

•
ks

AX200 Reports
si
en

• AX200 Exports
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 13

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 1 Course Introduction and Magnet AXIOM Installation

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

14 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 1 Course Introduction and Magnet AXIOM Installation

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 15

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 1 Course Introduction and Magnet AXIOM Installation

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20
20

____________________________________________________________________________________
8/
/2

____________________________________________________________________________________
x9
.m

____________________________________________________________________________________
ks
si

____________________________________________________________________________________
en
f or

____________________________________________________________________________________
dg
@

____________________________________________________________________________________
er
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________

16 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

Module 2 Evidence Processing and Case Creation

2

MODULE 2:
Evidence Processing and Case Creation
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 17

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

18 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

LEARNING OBJECTIVES
In this lesson, students will take part in lecture, instructor-led exercises, and student practical exercises
to learn: the function of the AXIOM Process component of Magnet AXIOM; the steps of imaging devices
using AXIOM Process; the steps of adding pre-imaged data to AXIOM Process; how to build a case using
AXIOM Process; and how to configure AXIOM Examine. This lesson will also provide an overview of the
AXIOM Examine interface and discuss the Case Dashboard content within AXIOM Examine.

GOALS
At the end of this lesson, students will be able to: identify the steps required to set up the processing
functionality of AXIOM Process; add evidence images to AXIOM Process; set up the imaging of devices if
necessary; and, be able to build a case within AXIOM Process. 20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 19

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

AXIOM OVERVIEW
Magnet AXIOM is designed to help investigators by combining several steps of the case flow process into
a single platform from imaging, to searching and processing data, to analyzing the data, to reporting
the findings.
AXIOM Process smooths the process of imaging and then parsing and carving for data. Instead of using
separate tools to image the data then conduct the processing, AXIOM Process combines these steps.
Using AXIOM Process, both computer and mobile device evidence can be imaged and processed in a
single step and reviewed within a single case file.
Evidence can either be imaged directly or added from other sources, then directly processed with specific
items that the user requests. AXIOM Examine then allows the user to view the processed data in multiple
views and add tags, generate reports, and create portable cases based on the processed data. In addition
to displaying the parsed artifacts, AXIOM Examine also includes a registry explorer, file system explorer,
and connections explorer that allow investigators to find and review even more data than ever before.
20
20
8/
/2
x9
.m
ks

Figure 2.1 AXIOM overview

si
en
f or
dg
@
er
vi
ja

20 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

PROCESSING OVERVIEW
AXIOM Process allows the user to create a new case or add evidence to an existing case, as shown in
Figure 2.2.

Figure 2.2 CREATE NEW CASE or ADD EVIDENCE TO EXISTING CASE

Once a case has either been created or an existing case opened, AXIOM Process guides the user through
each of the necessary steps until finally reaching the ANALYZE EVIDENCE stage. Users can also jump
between each of the processing options by clicking the relevant option in the left-hand pane. The artifact
details step will remain greyed out until at least one Evidence source has been added and the method of
processing has been selected. If the mandatory information for any step has not been provided, an orange
exclamation point will appear in the window alerting the user that information is missing.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 21

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

CASE DETAILS

Figure 2.3 CASE DETAILS

In the CASE INFORMATION section of the CASE DETAILS, the user can specify where the case files
20

will be saved as they are generated. Both the case files and the generated image files can be saved within
20

the same folder structure, or they can be saved in separate locations. The File path location for either of
8/
/2

these can be changed by selecting the BROWSE option beside the path listing.
x9
.m

By default, both the case files and acquired evidence files will be saved into the same folder. This folder
ks
si

will have the default name AXIOM – DATE TIME detailing when the case setup began for the case.
en
or

The DATE TIME is in the format: month day year followed by a 24-hour time hhmmss. The folder name
f
dg

can be changed to match the u

@
er

Users can also set case information, including examiner name and any detailed notes, within the
vi
ja

Scanned by and Description fields of the SCAN INFORMATION section. Because multiple scans can
be performed to add additional evidence to a case, each scan will allow new examiner and description
information to be included. Anything populated into these fields will appear in both the logs and the final
case report. In addition, a date created timestamp will be added to this information noting when the scan
was conducted.

22 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

In the REPORT OPTIONS section, the user can specify a custom cover logo in place of the Magnet
Forensics icon. To change the image, select the BROWSE option and navigate to a graphic file. Any
selected file will be automatically resized to 150x150 pixels.

Figure 2.4 Case Type

Axiom Process allows the user to select the case type.

EVIDENCE SOURCES
20
20
8/

In EVIDENCE SOURCES, users must first SELECT SOURCE PLATFORM for the evidence they are
/2
x9

adding; the choices are COMPUTER, MOBILE, or CLOUD-based evidence. Figure 2.4 depicts the flow
.m
ks

of adding evidence.
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 23

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

Figure 2.4 EVIDENCE SOURCE options

When either computer, or cloud-based evidence is chosen, the next option presented to the user is to
either LOAD OR ACQUIRE evidence. When mobile based evidence is chosen, the next option presented
to the user is to select the specific mobile platform, followed by the choice of either load or acquire the
evidence (mobile acquisition and processing will be covered in more detail in Module 4).

For computer-based evidence, the LOAD EVIDENCE option allows processing of locally connected
drives (DRIVE), forensic image files (IMAGE), individual files and folders from a local drive (FILES &
FOLDERS), Volume Shadow Copies from an image or a local drive (VOLUME SHADOW COPY) and
RAM images (MEMORY).
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 2.5 EVIDENCE SOURCE options for PC based evidence

24 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

As seen in Figure 2.5, if the option to ACQUIRE EVIDENCE is selected AXIOM Process will present drive
identification information such as the Name, Type, Size, and Serial Number of the attached drives that
can be acquired. Both removable and fixed drives are listed with an icon resembling a hard drive. USB
devices connected hard drives, and media cards are also displayed.
The type and format of the acquired image can then be selected. The type of image and the formats
available are:
Full Entire contents of the drive in E01 format
Full Entire contents of the drive in RAW format
Full All files and folders
Quick targeted acquisition
NOTE: AXIOM Process does not display the drive that it is installed on in the list of available media.

On smartphone devices, both iOS and Android devices will display for acquisition. Android devices will be
marked with an icon representing the Android logo (Andy the Android), and iOS devices will be marked
with an icon containing the Apple logo. Both device types will display the Make, Model, Operating System
version, and whether or not they have privileged access.
Android devices can be acquired with both the Full and Quick options. Each of these options require the
Android device to have USB Debugging options enabled, and the security prompt allowed. The Quick
option will perform a standard Android logical acquisition which includes an APK injection type as well
as the ADB backup command. The Full option preforms a full memory image but requires root access.
AXIOM Process will attempt to perform a shell or temporary root of the device if it is running Android
version 4.4.2 (KitKat) or lower.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Table 2.1 Android version with friendly names and release dates

iOS devices can also be acquired using both the Full and Quick options. Both require the iOS device to be
connected to the PC and have the Trust this Computer dialog accepted on the device. Once the pairing

MAGNET AXIOM EXAMINATIONS (AX200) 25

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

between the two has been established, the iOS device will display for acquisition within AXIOM Process.
The Quick option is the default for iOS devices and will attempt an iTunes backup along with obtaining
information from the unprotected part of the filesystem (Camera Roll/Media/etc.).
The Full option can only be selected if the iOS device has already been jailbroken. This will allow the user
to acquire a full file system extraction from the iOS device.

If, after selecting computer-based evidence, the option LOAD EVIDENCE is selected, the next screen
presents the five options shown in Figure 2.5:
DRIVE
IMAGE
FILES & FOLDERS
VOLUME SHADOW COPY
MEMORY

The DRIVE option allows the user to process any locally connected media such as hard drives and USB
devices without first imaging them. The entire physical device can be selected, or just individual partitions
on the device. Once the device or partition has been selected, clicking NEXT then displays the SELECT
SEARCH TYPE options.
20
20
8/
/2
x9
.m
ks

Figure 2.6 DRIVE Physical Drives and Partition options

si
en

The IMAGE option allows the user to load a previously acquired forensic image. This option opens a
f or
dg

Windows Browser dialog box for the user to locate and select the image file. Selecting the drop-down
@

menu displays the image formats currently supported by AXIOM.

er
vi
ja

26 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

Figure 2.7 Supported image formats

NOTE: Other unlisted image types may also be supported. Select the All Files (*.*) option to locate
and load the image file.

The FILES & FOLDERS option allows the user to scan individual files or folders stored on any connected
disk or device. Selecting files and folders from the main ADD FILES AND FOLDERS window uses the
AXIOM application programming interface (API) which accesses files directly from the disk/device. It
reads the file system information directly from the disk and bypasses any Windows security, therefore
protected system files, such as the Windows registry hives and the $MFT etc., can be processed by AXIOM
Process. Alternatively, the FOLDER BROWSER or FILE BROWSER buttons at the bottom of the dialog
window access the files and folders via the Windows API, therefore Windows Security will prevent access
to system or protected files. However, anything that can be seen from Windows Explorer is visible to
AXIOM Process via these options. Selecting one of these options and entering a UNC path in the address
bar will allow access to the content of the remote location, provided the user has sufficient security access
to view the content.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 2.8 ADD FILES & FOLDERS

MAGNET AXIOM EXAMINATIONS (AX200) 27

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

The MOBILE option allows the user to add smart phone data acquired from a separate source. There are
then five options available as seen in Figure 2.9. The five options are the four mobile OS types: Android,
iOS, Windows Phone, and Kindle Fire, followed by the Media Transfer Protocol (MTP).

Figure 2.9 Supported mobile devices

Specifying the operating system indicates to AXIOM Process which set of artifacts should be scanned for
and where they are located on the device/file system. Data resides in different locations depending on the
OS. Although some artifacts e.g. Facebook, Twitter, WhatsApp, etc. can be parsed from different mobile
OS types, the location and layout of the data may be different. Therefore, it is important to ensure the
correct OS is selected at the time the evidence is added.

After selecting the operating system type, the user can specify whether to LOAD EVIDENCE or
ACQUIRE EVIDENCE. Selecting LOAD EVIDENCE presents the choice of processing a previously
acquired image or just a selection of files & folders. Just as for the computer-based evidence, AXIOM
supports images from mobile devices in many different formats and will process both physical and logical
based images (full vs. quick). Mobile images generated using other tools can be added by selecting the
raw data files (typically .bin files), or their proprietary files (.ufd, .xry, .lantern, etc.). If the proprietary files
cannot be seen, ensure the filetype for the image is set as All Files (*.*). Images acquired with advanced
procedures such as JTAG, Chip-Off, or ISP techniques can also be loaded directly into AXIOM Process.

The FILES & FOLDERS option can be used to analyze artifacts directly from the file system of a device,
or from a collection of files such as an iTunes backup found on a PC. When using the FILES & FOLDERS
20
20

option, AXIOM Process will scan each file individually to parse for the artifacts selected. Although this
8/
/2

option is likely to be used less frequently than the image option, it can be used to obtain information when
x9

only certain files are provided or recoverable due to restrictions within the case.
.m
ks
si

When an image file is added to the case, whether it be computer or mobile, the next option presented is
en

SELECT SEARCH TYPE.

f or
dg
@
er
vi
ja

28 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

Figure 2.10 SEARCH TYPE options

If a computer-based image is added there are four possible search types: Full, Quick, Sector level, and
Custom. If mobile-based evidence is added the search type will default to the OS.

The Full search type scans all areas of a drive or image for artifacts. This includes: unallocated space,
uninitialized space, and file slack space.
If the user does not wish to search all areas of the drive or image, the scan can be limited by selecting the
Quick option. This searches the most common areas of your computer where AXIOM expects to find the
evidence. Common areas include: default application data directories (regardless of which language pack
is installed), the Windows registry, user profiles, and My Documents. The list of common areas searched
by AXIOM Process can be obtained from your instructor.

Alternatively, the search type can be set as Custom which allows the user to select which areas of the
disk/image to search. E.g. Only search the common areas, but also search unallocated space.

The Sector Level scan is the slowest of all the search types but can help rebuild information from
systems that are unsupported, or images that may be corrupted. This can also be very helpful in a chip-
off or JTAG acquisition of a mobile device where the imaging process was not able to pull the entire
memory of the chip.
20

If you want to delete evidence from your case, you can do so by removing an evidence source and all
20

associated evidence.
8/
/2
x9

Warning: Removing an evidence source is a permanent action that cannot be undone.

.m
ks

•
si

In AXIOM Examine, click Process > Remove evidence from case.

en

• Select the checkbox beside the evidence source you want to remove.
f or

•
dg

Click Remove evidence source.

@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 29

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

PROCESSING DETAILS
The PROCESSING DETAILS section is where the user can add any keywords to be searched for as part
of the processing, and add any hash sets for identification/elimination of files.

Figure 2.11 PROCESSING DETAILS

Any keywords to be searched for as part of the evidence processing are added using the ADD
KEYWORDS TO SEARCH option.
20
20

Keywords can either be added as individual words, or as Keyword Lists. The keyword list should be a
8/
/2

text document with a single word/phrase-per-line. These keyword lists can include both standard words
x9
.m

and/or Regex/GREP expressions. If an individual list is not needed for a case, de-select it by removing the
ks

check in the Enabled column for that word list and AXIOM Process will not search for those keywords.
si
en

This allows the user to add keyword lists for specific types of examination e.g. CSAM, fraud, or theft, and
or

only select the keyword list(s) relevant to the individual case. Once a keyword list is enabled the content
f
dg

is displayed in the KEYWORDS window underneath.

@
er
vi

If the keyword list contains any Regex/GREP expressions, ensure the Regex/GREP check-box
ja

NOTE:
is selected for that keyword in the KEYWORDS window.

30 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

Figure 2.12 ADD KEYWORD LIST and ADD KEYWORD

The KEYWORD SEARCH TYPE, as displayed in Figure 2.13, is very important as it controls what areas
of the evidence are searched for keywords. AXIOM Process can search for keywords during processing
in one of two ways at an Artifacts level, and across All content. By default, AXIOM Process will only
search for the keywords at an artifact level as this is the faster method. The second option in the drop-
down menu instructs AXIOM Process to conduct a more in-depth search across the entire disk/image.
This includes all files within the file system, regardless of whether or not an artifact was extracted from
the file, and unallocated and slack space. Any keyword hit results that are not associated with artifacts in
the case, such as those found in unallocated space are displayed in the Artifacts explorer under the
KEYWORD SNIPPETS category. Searching for keywords across all content will significantly increase
processing time.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@

Figure 2.13 KEYWORD SEARCH TYPES

er
vi

The keywords that were searched for during processing are included in the Keyword List filter of AXIOM
ja

Examine. This allows the examiner to quickly identify the artifacts containing these keywords.
NOTE: Keyword searches can be conducted within AXIOM Examine, however these searches are only
conducted across the artifacts within the case. Keyword searching in AXIOM Examine will be
covered in Module 3.

MAGNET AXIOM EXAMINATIONS (AX200) 31

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

Within CALCULATE HASH VALUES is an option to CALCULATE HASH VALUES FOR ALL FILES. This
option instructs AXIOM Process to generate a hash value (MD5, SHA1, or both) for all files within the case,
regardless of Artifact status. This option is off by default as it increases processing time.

Figure 2.14 CALCULATE HASH VALUES FOR ALL FILES

To mitigate this increase in processing time, if the user selects to calculate hashes for all files a size limit
can be set. By default, if this option is enabled, the size limit is set to 500MB. Therefore, any file larger
than 500MB will not be hashed. The size limit applied can be changed or removed completely by selecting
EDIT. If the option to CALCULATE HASH VALUES FOR ALL FILES is enabled, the hashes generated will
be displayed in the File system explorer of AXIOM Examine.

NOTE: The option to CALCULATE HASH VALUES FOR ALL FILES cannot be disabled if one of the
hash lists in the TAG FILES WITH MATCHING HASH VALUES or IGNORE NON-
RELEVANT FILES sections is enabled.

The second option, TAG FILES WITH MATCHING HASH VALUES, instructs AXIOM Process to tag files
based on their hash and display the tags in the File system explorer of AXIOM Examine. The hash list
must be a plain text file with one hash (MD5 or SHA1) per line. Once the hash list has been added, the
user can set the name of the Tag that will be applied to any matching files. If a list has been previously
added for another case it can be Enabled for inclusion in the current case or disabled or deleted as
necessary.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 2.15 TAG FILES WITH MATCHING HASH VALUES

32 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

The third option, IGNORE NON-RELEVANT FILES, instructs AXIOM Process to disregard any file with
a hash value that matches one listed in an enabled hash list. This option is most commonly used to identify
known system files, e.g. files associated with the Windows OS, and instructs AXIOM Process to undertake
no further processing of the file. The file itself will still be displayed in the File system explorer of AXIOM
Examine, but AXIOM Process will not search it for any artifacts. These hash lists are also plain text files
with one hash (MD5 or SHA1) per line. This provides the ability for the user to generate their own hash
Gold build, to eliminate the content of the standard build
from the review, thus focusing on just user activity.

Figure 2.16 IGNORE NON-RELEVANT FILES

The National Software Reference Library (NSRL), generated by the National Institute for Standards and
Technology (NIST), is a set of hash lists of known software. These hash lists can be downloaded from the
Magnet Forensics website and added to AXIOM Process by selecting ADD FILE. If a list has been
previously added for another case it can be enabled for inclusion in the current case or disabled or deleted
as necessary.

The CATEGORIZE PICTURES AND VIDEOS section of PROCESSING DETAILS provides the user with
20

two methods to categorize pictures and videos as part of the processing stage.
20
8/

If the Project VIC or CAID hash sets for pictures and videos are being used, these can be loaded by
/2
x9

selecting ADD JSON FILE under LOAD PROJECT VIC / CAID FILES as shown in Figure 2.17.
.m
ks

The PhotoDNA option is also located within this section and can be enabled by selecting EDIT and
si
en

entering the passcode provided by Magnet Forensics.

f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 33

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

Figure 2.17 LOAD PROJECT VIC / CAID FILES

The CATEGORIZE PICTURES AND VIDEOS option allows importing of MD5 or SHA1 hash values in a
plain text file. Once again, this must be a plain text file with one hash per line.

Figure 2.18 CATEGORIZE PICTURES AND VIDEOS

NOTE: Artifacts within the Media category will be hashed even when the option CALCULATE HASH
VALUES FOR ALL FILES is disabled.

Within FIND MORE ARTIFACTS is the option to USE THE DYNAMIC APP FINDER. Enabling the
20

Dynamic app finder instructs AXIOM Process to search the evidence for any SQLite databases that are not
20

associated with a known application, thereby identifying applications that are not currently supported.
8/
/2

Even though the application may not be currently supported, AXIOM Process can still read the content of
x9

the SQL tables. The Dynamic App Finder provides the examiner with the ability to map selected database
.m
ks

fields to artifact columns and display the content in AXIOM Examine. Dynamic App Finder will be covered
si

in Module 4 Mobile Artifact Analysis.

en
f or
dg
@
er
vi
ja

Figure 2.19 USE THE DYNAMIC APP FINDER option

34 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

ARTIFACT DETAILS
The ARTIFACT DETAILS contains subcategories for each of the evidence types that can added to AXIOM
Process. AXIOM Process allows the user to set which artifacts will be scanned for. There are three
subcategories, Computer, Mobile and Cloud artifacts.

Figure 2.20 ARTIFACT DETAILS

Individual artifacts can be selected or deselected as required, or entire categories can be selected by
placing a check in the box beside the category name.
20
20
8/
/2
x9
.m
ks
si
en
or

Figure 2.21 Individual Computer artifacts

f
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 35

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

Figure 2.22 COMPUTER, MOBILE and CLOUD ARTIFACTS

Any artifacts that require or offer additional options will have a blue OPTIONS beneath them. Selecting
OPTIONS opens a dialog window allowing additional information to be added or settings to be changed.
20
20
8/
/2

Figure 2.23 Artifact processing OPTIONS

x9
.m

In the Videos artifact OPTIONS, as shown in Figure 2.24, the examiners can elect to Detect skin tone,
ks
si

Create a preview using still frames which generates a filmstrip of the video content by taking a still
en
or

frame from the video every 10%, and save a copy of the video files into the case. Selecting Save videos
f
dg

up to stores the full video content into the case rather than just a thumbnail or filmstrip. This allows the
@
er

videos to be previewed within AXIOM Examine without having to extract them to the local machine first.
vi
ja

If this option is selected, examiners can also set a maximum file size limit. The default setting for this
option is 500MB so only videos smaller than 500MB will be extracted from the evidence file and stored in
the case. This setting can be changed by the examiner at processing time if required.
AXIOM Process can carve, as well as Parse, Video files and the examiner can also set a maximum size
for these carved videos. By default, AXIOM Process will only carve the first 20MB of video files.

36 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

Figure 2.24 OPTIONS for Video artifacts

ANALYZE EVIDENCE
The Analyze Evidence section provides a summary of the imaging and processing that will be undertaken.
The examiner has one last chance to review the devices and/or evidence added to the case for imaging
and processing. Evidence items added to the case for processing display Ready or Ready to Search
within the Status field, and items to be acquired display Ready to image.
20
20
8/
/2

Figure 2.25 Final review prior to analysing evidence

x9
.m

Once the examiner has clicked the ANALYZE EVIDENCE button, AXIOM Process starts by acquiring any
ks

evidence items added via the ACQUIRE EVIDENCE option. Once all the images have been acquired, the
si
en

processing phase begins. During processing the CURRENT SEARCH LOCATION screen, as shown in
f or
dg

Figure 2.26, details which evidence item is currently being processed. AXIOM Process uses all the cores
@

allocated to it in Tools → Settings → SEARCH SPEED to parse and carve the information as quickly as
er
vi

possible. The Thread Details section details the item being processed by each individual core at that
ja

moment.

MAGNET AXIOM EXAMINATIONS (AX200) 37

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

Figure 2.26 Search progress and percentage complete

Figure 2.7 Thread Details

DASHNER CASE SCENARIO

20
20

The instructor-led and student exercises throughout this course are based on evidence relating to the
8/

following case scenario:

/2
x9
.m

The scenario is based on a narcotics and ID theft investigation. The Primary suspect
ks

and dealer is Isaiah Dashner, and the secondary suspect is Monica Neff who is a low-
si
en

end drug user/dealer. An undercover officer named George Riddle, using the
or

screenname Griddle the Riddle , befriended Neff and was introduced to her dealer
f
dg

Dashner. Dashner has been communicating with undercover officer Riddle for the
@
er

purchase of narcotics. Officer Riddle has also been communicating with Neff on
vi

identity theft activities. Dashner uses a PC to search for drug-related and ID theft-
ja

related items, as well as chat and email with Neff and Officer Riddle.
You have possession of the following items that were all acquired at the of arrest:
• Nexus 5 mobile phone;

38 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

•
• Dashne
•
SanDisk Ultra, the other a generic USB device shaped like a piece of Lego that
was BitLocker encrypted.
The exercises throughout this course will focus on locating evidence of: narcotics activities such as
possession, manufacturing, and distribution; the creation and/or use of fraudulent documents; and the
creation and/or use of credit cards. This activity could include: chat conversations, internet searches and
browsing activity, and the possession of documents. Using the devices from both suspects, by the end of
the course examiners should be able to map their connected activities and prove a link between the two
suspects and undercover officer Riddle.

RUNNING EXERCISES
CREATING A NEW CASE
• Start AXIOM Process from the icon on the Desktop,

• Click the Create New Case button.

• The new case opens at the CASE DETAILS.

• In the CASE INFORMATION section, enter a Case number of your choosing.

• Under LOCATION FOR CASE FILES, change the Folder name to Dashner Case .

• Click BROWSE next to the File path and set the case folder location to be the \Cases\ folder on
20

the Desktop.
20
8/

• Under LOCATION FOR ACQUIRED EVIDENCE, also change the Folder name to Dashner
/2
x9

Case and set the File path as the \Evidence\ folder on the Desktop.
.m
ks

• In the SCAN INFORMATION section, enter your name into the Scanned by field, and a short
si
en

Description.
f or
dg

ADDING EVIDENCE TO THE CASE

@
er
vi

• Click the GO TO EVIDENCE SOURCES button.

ja

• This steps the user to the EVIDENCE SOURCES.

• Under SELECT EVIDENCE SOURCE, click the COMPUTER icon.

• In the LOAD OR ACQUIRE window, click the LOAD EVIDENCE icon.

MAGNET AXIOM EXAMINATIONS (AX200) 39

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

• Under SELECT EVIDENCE SOURCE, click the IMAGE icon.

• This opens a folder browser window to locate the evidence image.

• Navigate to the Desktop and locate the folder \Evidence\. Open the folder
\DashnerWin10PC\, select the DashnerWin10PC.E01 file and click Open .

• Ensure all the partitions are selected, then click NEXT .

• On Partition 1, ensure the Search type is set to Full.

• Notice all the areas that will be searched.

• On Partition 2 change the Search type to Quick from the drop-down menu and compare it to
Partition 1. What areas are no longer searched?
___________________________________________________________________________
___________________________________________________________________________

• Change the Search type for Partition 2 to Custom.

• This option allows the user to select just the areas they wish to search.

• Change the Search type back to Full and click NEXT .

• Each of the partitions in the image file are now listed under EVIDENCE SOURCES ADDED TO
CASE, along with their Search type and Status.

• If required, the Evidence number can be changed by clicking into the field, changing the name
and clicking SAVE.

• Under SELECT EVIDENCE SOURCE, click the COMPUTER icon again.

20

• In the LOAD OR ACQUIRE window, click the LOAD EVIDENCE icon.

20
8/
/2

• Under SELECT EVIDENCE SOURCE, click the IMAGE icon.

x9
.m

• Navigate to the Desktop and locate the folder \Evidence\ again. Open the folder \Dashner
ks
si

USB\, select the SanDisk Ultra USB Device 29.47 GB quick image file and click
en
or

Open.
f
dg
@

• Ensure all files are selected and click NEXT .

er
vi
ja

• The Search type of a logical image is automatically set as Custom.

SETTING THE PROCESS OPTIONS
• Click GO TO PROCESSING DETAILS .

• This steps the user to the PROCESSING DETAILS.

40 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

• Click the ADD KEYWORDS TO SEARCH button.

• In the KEYWORD SEARCH TYPES section, the default is set as Artifacts.

• In the KEYWORD LISTS section, click ADD KEYWORD LIST.

• Navigate to the \Evidence\ folder on the desktop, select the file Dashner Search
Terms.txt and click Open .

• The keyword list is automatically Enabled.

• All the keywords/phrases are added to the KEYWORDS and will be searched for.

• Deselect the keyword list just added.

• All the keywords are removed from the KEYWORDS to be searched for.

• Ensure the keyword list is re-enabled, then ensure Regex/GREP is selected for the GREP
keywords for credit card numbers.

• Click GO TO CALCULATE HASH VALUES .

• This steps the user to the Calculate hash values section of the PROCESSING DETAILS.

• Under CALCULATE HASH VALUES FOR ALL FILES, select the EDIT link.
Scroll down in the Settings window that opens and locate HASH FORMATS. What
algorithms are available for hashing?
___________________________________________________________________________

• Click CANCEL to exit the Settings window.

• Under TAG FILES WITH MATCHING HASH VALUES click ADD FILE.
20
20

• Navigate to the \Evidence\ folder on the desktop, select the file File Hashes to Match.txt
8/
/2
x9

and click Open .

.m
ks

• The file containing the hashes is added to the list and details how many hashes the file contains.
si
en

• A Tag Hash Match is automatically applied, this can be changed if required.

f or
dg
@

• Click GO TO CATEGORIZE PICTURES AND VIDEOS .

er
vi
ja

• This steps the user to the Categorize pictures and videos section of the PROCESSING
DETAILS.

• Under LOAD PROJECT VIC / CAID FILES click ADD JSON FILE.

• Navigate to the \Evidence\ folder on the desktop, select the file sample.json and click Open.

MAGNET AXIOM EXAMINATIONS (AX200) 41

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

• The file is added to the list and details the number or records and their categories.

• If a record has no pre-assigned category, AXIOM Process assigns it a category of -1.

• Under CATEGORIZE PICTURES AND VIDEOS click the ADD FILE.

• Navigate to the \Evidence\ folder on the desktop, select the file sample picture
hashes.txt and click Open.

• The file is added to the list and details how many records are in the file and the examiner can set
a category as required.

• Click GO TO FIND MORE ARTIFACTS .

• This steps the user to the Find more artifacts section of the PROCESSING DETAILS.

• The dynamic app finder can be activated from here. Do not enable dynamic app finder, it will be
covered in module 4.
SELECTING ARTIFACTS TO PROCESS AND SETTING ARTIFACT OPTIONS
• Click GO TO ARTIFACT DETAILS .

• This steps the user to the ARTIFACT DETAILS.

• Only Computer artifacts are enabled as the EVIDENCE SOURCE selected for each image file
when it was added was COMPUTER.

• Click the CUSTOMIZE COMPUTER ARTIFACTS button.

• This steps the user to the Computer artifacts section of the ARTIFACT DETAILS.

•
20

Ensure all the artifacts are selected.

20
8/

• A parent category that does not have a tick in the check box indicates one or more of the
/2
x9

artifacts within that category are not selected.

.m
ks

• The Memory artifacts are greyed-out. These artifacts are only enabled if the evidence source
si

MEMORY, as shown in Figure 2.5, is added to the case.

en
f or
dg

• Select the parent category MEDIA and click OPTIONS beneath the Videos artifact.
@
er

Under SAVED VIDEO SIZE, enable the option Save videos up to.
vi

•
ja

• This will save all videos of 500MB or less into the case.

• Select the parent category CLOUD STORAGE and click OPTIONS beneath the Dropbox
artifact.

42 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

• password vikingsfan123

• Click GO TO ANALYZE EVIDENCE .

• This steps the user to ANALYZE EVIDENCE where the examiner can review the evidence to be
imaged and/or searched.

• Due to the time required to process this case, it has already been pre-processed. Therefore,
close AXIOM Process WITHOUT starting the processing.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 43

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

POST-PROCESSING
Post-processing was introduced in AXIOM 1.1 and provides the examiner the ability to add additional
evidence to the case without having to re-process the work that has already been completed. The
additional evidence does not have to be added to a new separate case, as it did in the past, the new
evidence can now be added into an existing case and processed as part of the normal workflow of an
investigation.
New evidence can be added to a case from both AXIOM Process and Examine. In AXIOM Process, open
the case by either clicking the BROWSE TO A CASE button under ADD EVIDENCE TO EXISTING
CASE, or select the case to add evidence to under Open a recent case, as shown in Figure 2.27.

20

Figure 2.27 Adding new evidence to a case in AXIOM Process

20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

44 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

Figure 2.x

When Axiom Examine first opens, the user is presented with a Quick Tips screen (see Figure 2.xx). This
can be turned off if the user does not want to see it again.

The first sections of the CASE DETAILS are pre-populated and cannot be changed, as shown in Figure
2.28. Any previous scans are displayed in the SCAN INFORMATION below the current one. In Figure
2.28 the current scan is SCAN 2, and the information added for SCAN 1 is displayed below it. The
20
20

Scanned By field will automatically pre-populate with the information from the previous scan but can be
8/
/2

changed if required.
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 45

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

Figure 2.28 CASE DETAILS - SCAN 2

To add additional evidence to a case using AXIOM Examine, with the case already open, select the menu
option Process → Add new evidence to case, as shown in Figure 2.29.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@

Figure 2.29 Adding new evidence to a case in AXIOM Examine

er
vi
ja

This automatically opens the case in AXIOM Process and presents the screen shown in Figure 2.28.

46 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

ENCRYPTED DRIVES
Support for encrypted drives was also introduced with AXIOM 1.1. Often encrypted drives or volumes are
only identified after the investigation has started. The ability to post-process data enables the examiner
to search for and identify potential passwords within the current evidence, then add the encrypted drive
or volume to the case once potential passwords have been determined.
Microsoft BitLocker is covered in the AX100 Forensic Fundamentals course so will not be covered in
detail in this course. However, it is a high level of encryption using AES to encrypt the full drive/volume.
To acquire a USB device encrypted using BitLocker, using a write blocker, plug the USB device into the
imaging computer. As can be seen in Figure 2.30 BitLocker encrypted USB device in Windows Explorer,
Windows automatically recognizes a BitLocker encrypted drive based on information found in the volume
boot record (VBR) of the encrypted drive and Windows Explorer displays the drive with a padlock.
20
20
8/
/2
x9
.m
ks
si
en

Figure 2.30 BitLocker encrypted USB device in Windows Explorer

f or
dg

The device can now be acquired and if the password or recovery key is available it can be processed using
@

AXIOM Process.
er
vi
ja

If an image is added to AXIOM Process and the image is of a drive that was encrypted using one of the
supported encryption types, AXIOM Process automatically recognises the drive as encrypted and
presents the examiner with DECRYPTION OPTIONS as shown in Figure 2.31.

MAGNET AXIOM EXAMINATIONS (AX200) 47

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

Figure 2.31 DECRYPTION OPTIONS

AXIOM Process identifies the encryption type, which in this instance is BitLocker, and asks for the
password or recovery key. When a password is entered, AXIOM Process displays CHECK as shown in
Figure 2.32. The NEXT button will not activate until the correct password or recovery key is entered.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@

Figure 2.32 Incorrect password

er
vi
ja

If you do not have the correct password, review the computer evidence for the presence of a BitLocker
Recovery Key (.BEK). During the creation of a BitLocker encrypted drive the encryption will not proceed
until the user has saved a copy of the .BEK file and many users save this to their Documents folder or
their Desktop. The BEK file contains a 48-digit recovery key that can be copied and pasted into the
Password / Recovery key field and used instead of the password.

48 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

Once ANALYZE EVIDENCE is selected, AXIOM Process will first decrypt the drive the process the
decrypted content.

Figure 2.33 DECRYPTION IN PROGRESS prior to processing

A full list of supported encryption types can be found in the AXIOM User Guide.
20

RUNNING EXERCISE
20
8/
/2
x9
.m

adding encrypted devices and post-processing in AXIOM Process.

ks
si
en

POST-PROCESSING AND ENCRYPTED DRIVES

f or
dg

• Open AXIOM Process and under ADD EVIDENCE TO AN EXISTING CASE click the BROWSE
@
er

TO A CASE button.
vi
ja

• Navigate to the \Cases\ folder on the Desktop, highlight the Dashner case folder and click
Select Folder (if you are unsure which case folder to select ask your instructor).

• Change the Scanned By information to your own name and add a Description.

• Click the GO TO EVIDENCE SOURCES button.

MAGNET AXIOM EXAMINATIONS (AX200) 49

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

• Select the options COMPUTER, LOAD EVIDENCE, IMAGE.

• Browse to the folder \Evidence\Lego Thumbdrive\ on the Desktop and open the file
Generic Flash Disk USB Device 3.76 GB Full E01 Image.E01.

• The padlock icon identifies it is an encrypted drive.

• Ensure the entire drive is selected and click NEXT .

• The Encryption Type has now been identified as BitLocker.

• The NEXT button is currently greyed-out.

• Enter the password password123 without the quotes and click CHECK.

• The NEXT button is now enabled.

• Click NEXT , then confirm the Search type for Partition 1 is set as Full, the search type of the
Unpartitioned space is set as Unpartitioned space, and click NEXT .

• Click GO TO PROCESSING DETAILS .

• There is no need to run keyword searches across this evidence or calculate the hash values so
click GO TO ARTIFACT DETAILS .

• Leave the previously selected artifacts as they are and click GO TO ANALYZE EVIDENCE

• Confirm both Partition 1 and the Unpartitioned space for the Generic Flash Disk USB
Device 3.76 GB Full E01 Image.E01 evidence are present and the Status is Ready, then
click ANALYZE EVIDENCE .

• Once the decryption phase has completed AXIOM Examine automatically starts and displays
20

Processing evidence in the bottom left corner with a % progress.

20
8/
/2

• Once the message Processing complete appears in AXIOM Examine, click OKAY to reload the
x9

case.
.m
ks
si
en
f or
dg
@
er
vi
ja

50 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

AXIOM EXAMINE SETTINGS

There are several configurable settings available from the Tools → Settings menu within AXIOM
Examine which the examiner can change to customise how AXIOM Examine looks and behaves. By
default, AXIOM Examine opens a case with the Case dashboard explorer open, however the DEFAULT
EXPLORER to display when a case is first opened can be changed from the Tools → Settings menu.
There are five explorers in which to view the data:

• the Artifacts explorer displays the artifacts identified during the processing stage and displays
them in a tabular form.

• the File system explorer displays a tree structure of the file system or files stored on the evidence
image.

• the Registry explorer displays a hierarchical view of all the registry hives within the case.

• the Connections explorer displays connections between artifacts and files.

• the Case dashboard explorer is the command centre of the case and displays an overview of
the evidence, artifacts and tagged items.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@

Figure 2.34 AXIOM Examine Explorers

er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 51

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

Figure 2.35 DEFAULT EXPLORER option in AXIOM Examine Settings

As can be seen in Figure 2.35, the Settings menu also includes the option to Automatically build
connections that exist between artifacts within the case connections will be covered in more detail in
a later lesson. By default, the option to Automatically build connections is disabled and the Build
connections process must be started manually from the menu option Tools → Build connections, as
shown in Figure 2.36.
20
20
8/

Figure 2.36 Manually building connections

/2
x9

If the option to Automatically build connections is enabled, AXIOM Examine will automatically start
.m
ks

building connections between the artifacts once processing has completed. If new evidence is added post-
si
en

processing AXIOM Examine will again automatically build connections as soon as processing is complete.
or

AXIOM Examine searches for connections between all artifacts within the case, not just connections
f
dg

between artifacts extracted from the same evidence item. If the option to automatically build connections
@
er

is not enabled the examiner must remember to rebuild the connections each time new evidence is added
vi
ja

to the case, and every time the examiner adds a user-defined artifact. User-defined artifacts will be
covered in a later lesson. Connections are rebuilt from the menu option Tools → Build connections in
AXIOM Examine.

52 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

The DEFAULT VIEW option controls how the artifacts are initially displayed in the EVIDENCE pane of
the Artifact explorer. By default, the artifacts are displayed in Column view, but the view can be changed
to either Classic view or Row view.

Figure 2.37 DEFAULT VIEW option in AXIOM Examine Settings.

The DIAGNOSTIC INFORMATION within Settings contains the option to Automatically gather and
send diagnostics information to help improve Magnet Forensics software. If AXIOM is being used
on a computer that is connected to the internet, leaving this option enabled helps Magnet Forensics
improve the user experience, and also identify bugs in the software more quickly.

Figure 2.38 DIAGNOSTIC INFORMATION option in AXIOM Examine Settings

AXIOM also includes support for eleven other languages, as shown in Figure 2.39.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 2.39 LANGUAGE option in AXIOM Examine Settings

MAGNET AXIOM EXAMINATIONS (AX200) 53

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

CASE DASHBOARD
The Case dashboard was introduced to AXIOM Examine in version 2.0. It is a central location where,
once processing has completed, the examination and analysis process can begin. Unless the settings
have been changed, upon completion of processing, AXIOM Examine displays the Case dashboard
explorer, which contains a CASE OVERVIEW, EVIDENCE OVERVIEW, and PLACES TO START. The

The CASE OVERVIEW includes a CASE SUMMARY NOTES section where the examiner can add a case
summary and any relevant case information. It can also be used to record case notes as the need arises,
such as recording any relevant comments made by the suspect or recording any significant artifacts
located during the examination. The case summary could also be used to record what investigations have
been completed and what is left to review, or record if any investigators collaborating on the case have
been provided with a portable case.

Figure 2.40 CASE SUMMARY NOTES within CASE OVERVIEW

The CASE PROCESSING DETAILS section details the CASE NUMBER and Scanned by, Scan
description and Scan date of each AXIOM Process SCAN.
20

The CASE INFORMATION section contains two links to OPEN CASE INFORMATION FILE and OPEN LOG
20
8/

FILE. The case information file includes information about how the case was processed such as the
/2

AXIOM Process settings and which artifacts were searched for. The log file includes information such as
x9
.m

any errors encountered.

ks
si
en
f or
dg
@
er
vi
ja

54 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

Figure 2.41 CASE INFORMATION within CASE OVERVIEW

The EVIDENCE OVERVIEW lists each of the evidence items added to the case. The LOCATION details
the name of the evidence item added to the case, and the Evidence number also displays the name of
the evidence item unless it was changed by the examiner at the time of processing. The examiner has the
option to add a Description and upload a picture for each individual item if desired. Within each entry is
a link VIEW EVIDENCE FOR THIS SOURCE ONLY. Selecting this link will cause AXIOM Examine to switch
to the Artifact explorer and automatically apply a filter to display only artifacts sourced from that
evidence item.
20
20
8/
/2
x9
.m
ks
si
en
or

Figure 2.42 Evidence item listed in EVIDENCE OVERVIEW of Case dashboard

f
dg
@

The PLACES TO START displays a summary of key aspects of the case that could be of importance to
er
vi

the examiner. By default, any sections of the PLACES TO START that contain information will be
ja

expanded and any sections containing no information will be collapsed.

MAGNET AXIOM EXAMINATIONS (AX200) 55

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

20
20
8/
/2
x9
.m
ks
si

Figure 2.43 PLACES TO START in Case dashboard

en
or

The first section of PLACES TO START is the ARTIFACT CATEGORIES. This displays a histogram view
f
dg
@

of the recovered artifacts in the case. It displays each of the parent categories and details how many
er

artifacts were recovered. Clicking any of the histogram bars automatically switches AXIOM Examine to
vi
ja

the Artifact explorer with that category selected in the NAVIGATION pane. The Evidence Source drop-
down within the ARTIFACT CATEGORIES section can be used to filter the results displayed in this
window to just the artifacts from a specific evidence item.

56 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

Figure 2.44 ARTIFACT CATEGORIES section of PLACES TO START

The next section of PLACES TO START is the TAGS AND COMMENTS. Unless AXIOM Process
identified any files with hashes matching those added in the TAG FILES WITH MATCHING HASH
VALUES section, this window will be blank when a case is first opened. Once the examiner starts added
tags to items in the case, the content of this window displays how many total items have been tagged in
both the artifact and file system explorers. Clicking the link automatically switches AXIOM Examine to the
Artifact or File system explorer and applies the Tags and comments filter to display the files/items
with that tag applied.
20
20
8/
/2
x9
.m

Figure 2.45 TAGS AND COMMENTS section of PLACES TO START

ks
si

The TAGS AND COMMENTS section also contains a link to start the chat and picture categorization
en
or

utilizing Magnet.AI. Any chats and pictures detected that match

f
dg

the built-in models will have the appropriate tags applied and the tag displayed in this section. In addition
@

to the tags applied to items in the case, this section details how many items have comments, and again,
er
vi

the clicking the link automatically switches AXIOM Examine to the Artifact or File system explorer with
ja

the Tags and comments filter applied.

NOTE: Selecting to categorize pictures takes time. Each selected picture must be individually
examined using Magnet.AI to determine if it contains any of the markers described in the
categories.

MAGNET AXIOM EXAMINATIONS (AX200) 57

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

KEYWORD MATCHES are only populated if there were hits for keywords added in the ADD
KEYWORDS TO SEARCH section during processing. Clicking the link next to a KEYWORD
automatically switches AXIOM Examine to the Artifact explorer with the Keyword lists filter applied.

Figure 2.46 KEYWORD MATCHES section of PLACES TO START

The PASSWORDS AND TOKENS section is populated with any passwords or tokens identified within
the evidence. If one of these links is clicked, it automatically switches AXIOM Examine to the Artifact
explorer with the Cloud Passwords and Tokens category highlighted and a filter for the USER NAME
applied.
20
20

Figure 2.47 PASSWORDS AND TOKENS section of PLACES TO START

8/
/2

In the Artifact explorer the examiner can right-click the entry and the option to Add new cloud
x9
.m

evidence using passwords / tokens is available, as shown in Figure 2.48 Right-click option from
ks

Cloud Passwords and Tokens artifact Selecting this option starts AXIOM Process with the current case
si
en

open and the CLOUD evidence selected as a Source.

f or
dg
@
er
vi
ja

58 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

Figure 2.48 Right-click option from Cloud Passwords and Tokens artifact

If during processing the hash of any media files matched one listed in the CATEGORIZE PICTURES AND
VIDEOS section, it is automatically categorized, and the categories are listed in the MEDIA
CATEGORIES section. Selecting the link for a media category automatically switches AXIOM Examine to
the Artifact explorer with the Media categories filter applied. Alternatively, the option to VIEW ALL
MEDIA CATEGORY MATCHES can be selected.
20
20
8/
/2
x9
.m
ks
si
en
or

Figure 2.49 MEDIA CATEGORIES section of PLACES TO START

f
dg

The PROFILES section displays any Identifier profiles created within the case (profiles will be covered
@
er

in a later lesson). Selecting the profile automatically switches AXIOM Examine to the Artifact explorer
vi
ja

with the Profiles filter applied.

MAGNET AXIOM EXAMINATIONS (AX200) 59

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

Figure 2.50 PROFILES section of PLACES TO START

The content of these sections will evolve and reflect the case as it is worked and analyzed. The Case
dashboard is meant to be a command center for the case and should be used throughout the entire case
process from beginning to reporting.

RUNNING EXERCISE
CASE DASHBOARD
• In the EVIDENCE OVERVIEW of the Case dashboard, click the VIEW EVIDENCE FOR THIS
SOURCE ONLY link under the newly added Generic Flash Disk USB Device. Ensure you
select the one with NO NAME_decrypted at the end or you will not see any results.

• There should be 17 Pictures in the MEDIA category and 1 File System Information in the
OPERATING SYSTEM category.

• Switch back to the Case dashboard explorer.

• In the PLACES TO START under the ARTIFACT CATEGORIES, change the Evidence source
20

to the Generic Flash Disk USB Device again.

20
8/

• The results should again be 17 Media and 1 Operating System artifact.

/2
x9
.m

• Click the Media histogram bar.

ks
si
en

• AXIOM Examine switches to the Artifact explorer and the Pictures category is highlighted.
f or
dg

• Only the results from the Generic Flash Disk USB Device are displayed.
@
er
vi
ja

60 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

ARTIFACT EXPLORER
The Artifacts explorer provides a tabular view of the artifacts identified during processing.

Figure 2.51 Artifacts explorer

On the left of the Artifacts explorer is the NAVIGATION pane, as shown in Figure 2.52. It lists the
categories of artifacts found within the case, along with a count of the number of artifacts within that
category. Axiom Examine does not display an artifact category if no artifacts of that type were found
within the case. Therefore, you will never see a category with a zero count.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 2.52 NAVIGATION pane

MAGNET AXIOM EXAMINATIONS (AX200) 61

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

In the centre of the Artifacts explorer is the EVIDENCE pane, as shown in Figure 2.53. It displays the
artifacts contained within the category highlighted in the NAVIGATION pane. How the data contained
within the EVIDENCE pane is displayed is dictated by the View selected (the different views will be
covered in later lessons). By default, the EVIDENCE pane displays artifacts in Column view which
displays the data in a tabular list. The columns within the table display the fields of information extracted
for each artifact. To widen a column, simply drag the bar between the columns in the title row. To sort
the content of a column, click the column title. Click the column title again to reverse sort the content. To
hide a column, right-click the column title and select Hide column. To display the hidden columns again,
right-click on any column title and select Show all columns.

20

Figure 2.53 EVIDENCE pane

20
8/

To the right of the Artifacts explorer is the DETAILS pane, as shown in Figure 2.54. It displays the details
/2
x9

of the artifact currently highlighted in the EVIDENCE pane. This makes it easier to view the information
.m

relating to the artifact if the content of a field is extensive e.g. the Source path. Each section of the
ks
si
en

DETAILS pane is a Card, and in Figure 2.54 the DETAILS pane includes a PREVIEW card displaying a
or

preview of the artifact or file, and a DETAILS card displaying the artifact information.
f
dg
@
er
vi
ja

62 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

Figure 2.54 DETAILS pane

To the far right of the Artifacts explorer is a further pane, the TAGS, COMMENTS & PROFILES pane.
20

By default, it is collapsed against the side bar out of view. To display this pane, click the words TAGS,
20

COMMENTS & PROFILES.

8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 2.55 TAGS, COMMENTS & PROFILES pane

MAGNET AXIOM EXAMINATIONS (AX200) 63

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

With the exception of the EVIDENCE pane, each of the panes has a double arrow icon in the top corner,
as highlighted in Figure 2.56.

Figure 2.56 Collapse pane icon

Clicking the icon collapses the pane against the side bar allowing more space within the user interface
for the EVIDENCE pane.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er

Figure 2.57 NAVIGATION, DETAILS and TAGS, COMMENTS & PROFILES panes collapsed against the
vi
ja

side bars

64 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

At the top of the Artifacts explorer is the FILTERS bar. It is used to restrict the artifacts being displayed.

Figure 2.58 FILTERS bar

Applying any filter within AXIOM Examine turns the FILTERS bar yellow, as shown in Figure 3.1.1, to alert
the examiner that not all artifacts are in view. The filter criteria are displayed in bold.

Figure 2.59 FILTERS bar with active filter in place

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 65

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

66 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 2 Evidence Processing and Case Creation

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 67

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 2 Evidence Processing and Case Creation

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

68 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

Module 3 Computer Artifact Analysis Part 1 Refined

Results
3.1

MODULE 3:
Computer Artifact Analysis Part 1 Refined Results
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 69

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

70 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

LEARNING OBJECTIVES
In this lesson, students will take part in lecture, instructor-led exercises, and student practical exercises
to learn the way in which Magnet AXIOM Examine organizes artifacts within the Refined Results category;
such as Cloud Service URLs, Classifieds URLs, Identifiers, Social Media URLs and more. Students will
also be educated how to: create a profile using artifacts gathered in the identifiers category, use source
, and examine sources of searches such as Google
Searches and Parsed Search Queries. Students will be shown the Artifact Reference to ensure if future
changes occur in the artifacts supported by AXIOM the students will have a reference to update their
knowledge.

GOALS
At the conclusion of this lesson, students will be able to identify, discuss, and use artifacts found within
the Refined Results category of AXIOM Examine to further a forensic examination. Students will also be
able to create a Profile and use that profile to filter views of specific artifacts. Student will be able to show
a depth of knowledge in artifacts relating to browser artifacts.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 71

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

REFINED RESULTS
In the NAVIGATION pane of the Artifacts explorer, REFINED RESULTS is the first artifact category.
Figure 3.1.1 shows some of the categories included within REFINED RESULTS.

The REFINED RESULTS organizes artifacts from other categories into useful, more meaningful, groups.
This helps the examiner to more quickly identify artifacts of importance to the investigation, and thereby
saves time and effort. Much of the content of REFINED RESULTS is sourced from browser activity.
Although many artifacts listed can also be found within the WEB RELATED parent category, they are
organized within REFINED RESULTS under more meaningful categories to save the Examiner time and
effort.
20
20
8/
/2

Figure 3.1.1 REFINED RESULTS

x9
.m

Figure 3.1.2 demonstrates three WEB RELATED artifacts that have also been compiled into one of the
ks
si

REFINED RESULTS categories. AXIOM Process reviews the URL content of the browser artifacts,
en
or

regardless of the browser, and compiles them into their respective REFINED RESULTS. When reviewing
f
dg
@

the artifacts in AXIOM Examine, this eliminates the need to search through individual browser results for
er

Chrome, Firefox, and Edge etc. for the desired URLs.

vi
ja

NOTE: Because the source of much of the REFINED RESULTS originate from browser activity, many
results will appear in both the compiled REFINED RESULTS as well as their individual browser
artifact category under WEB RELATED. Also, some artifacts could appear in more than one
REFINED RESULTS category.

72 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

Figure 3.1.2 Relationship of a REFINED RESULTS originating from a WEB RELATED artifact

HELP/DOCUMENTATION
The Help → Documentation menu option in AXIOM Examine contains links to built-in documentation
for Magnet AXIOM. The documentation includes the User Guide and the Artifact Reference a guide
to all the artifacts searched for and identified by AXIOM Process.
20
20
8/
/2
x9
.m
ks
si
en

Figure 3.1.3 Help documentation available in AXIOM Examine

f or
dg

The Artifact Reference contains a listing of the REFINED RESULTS categories and a description of the
@
er

columns displayed within each one, as shown in Figure 3.1.4. Where appropriate, the Artifact
vi
ja

Reference also provides a link to documentation located on the Magnet Forensics website that details
which URLS are included in the REFINED RESULT.

MAGNET AXIOM EXAMINATIONS (AX200) 73

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

Figure 3.1.4 Artifact Reference showing link to view which URLs are included in the CLASSIFIEDS
URLs category

GOOGLE SEARCHES
Any searches conducted via the Google webpage using any supported browser are compiled into the
REFINED RESULTS → Google Searches category.

The DETAILS card on the DETAILS pane includes the following information:
20
20

ARTIFACT INFORMATION
8/
/2
x9

Search Term This information is imbedded in the URL itself; this is common to most search
.m

engine websites.
ks
si

URL The full URL from Google.

en

Date/Time
or

The date and time the search was executed. Whether the date and time information
f
dg

is recorded as UTC or Local Time is dependant on the browser that generated the
@

artifact.
er

Webpage Title
vi

/tab.
ja

Original Artifact The artifact category from which this refined result was compiled.

74 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

EVIDENCE INFORMATION

Source The directory path (including file name) where the artifact was found.

Location The location of the data within the source file or object. The example shown in Figure
3.1.5 is a History SQLite database from the Chrome browser and details the specific
database tables and records the artifact was extracted from. If the artifact is not
sourced from a database, the offset from the beginning of the file or object is listed.

Figure 3.1.5 DETAILS card for Google Search artifact

SOURCE LINKING
20
20
8/

Where possible, AXIOM Examine provides links to the file or object from which the artifact was parsed or
/2

carved. In Figure 3.1.5 the full path to the database this artifact was parsed from is listed in the Source
x9
.m

field within the EVIDENCE INFORMATION, and the Table and record id are listed in the Location field.
ks
si

Clicking the link automatically switches AXIOM Examine to the File system explorer with the source
en
or

file/item highlighted, as shown in Figure 3.1.6. AXIOM Examine has a built-in SQLite database viewer, so
f
dg

for an SQLite database file as in Figure 3.1.6, the tables in the database can be viewed by double-clicking
@

the database file. As can be seen in Figure 3.1.7, the database file is now highlighted in the NAVIGATION
er
vi

pane, the database tables are displayed in the EVIDENCE pane, and the table records are listed in the
ja

DETAILS pane.

MAGNET AXIOM EXAMINATIONS (AX200) 75

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

Figure 3.1.6 Link from Source in DETAILS card to SQLite database in File system explorer
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.1.7 Content of SQLite database file viewed in Filesystem explorer

76 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

In Figure 3.1.5 the Source of the artifact was a database and the table and record number are listed in
the Location field. However, if the source of an artifact is not a database, the exact File Offset of the
artifact within the Source file is listed in Location, as shown in Figure 3.1.8

Figure 3.1.8 File Offset location of artifact within Source file

Clicking the Source link for this artifact automatically switches AXIOM Examine to the File system
explorer with the source file highlighted. But in the TEXT AND HEX card of the DETAILS pane the curser
will be at File Offset 0. Clicking the Location link instead automatically switches AXIOM Examine to the
File system explorer with the source file highlighted, but this time in the TEXT AND HEX card the cursor
is automatically placed at the exact File Offset of the artifact.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.1.9 Exact File Offset of artifact within Source file

MAGNET AXIOM EXAMINATIONS (AX200) 77

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

If the artifact was carved from unallocated space, the Physical Sector will be listed in the Location field
rather than a File Offset.

NOTE: Select the Artifacts explorer from the drop-down menu to return to the Artifact explorer
without losing focus. If the Home button is selected, focus on the previously viewed artifact is
lost and the interface is reset to the initial default view.

RUNNING EXERCISE
GOOGLE SEARCHES
• Select the REFINED RESULTS → Google Searches category.

• Review the content of the URL column.

• All the search queries were performed on the Google webpage

• Click twice on the Search Term column to invoke a reverse sort.

• The arrow is now pointing down.

• In the search box on the FILTERS b v Go .

• The FILTERS

• The filtered results are still reverse sorted by the Search Term.

• Scroll down in the Search Term column and locate the entries for the search vikings
20
20

.
8/
/2

• Notice the difference in the Search Term and the Original Search Query columns.
x9
.m
ks

• In the DETAILS card of the DETAILS pane, view the URL field.
si
en

•
or

The data following the is the actual search that was executed.
f
dg
@

• The data following the is the original query that was executed.
er
vi
ja

• A Google Search with an Original Search Query indicates the user clicked one of the auto-
suggested searches provided by Google rather than typed the Search Term into the search box.

• Click CLEAR FILTERS to clear all the filters.

78 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

PARSED SEARCH QUERIES

Searches conducted on sites other than Google are compiled into the REFINED RESULTS → Parsed
Search Queries category. This includes searches performed on popular sites such as Yahoo, Facebook,
Bing, and YouTube.

Figure 3.1.10 DETAILS card of Parsed Search Queries artifact

The DETAILS card on the DETAILS pane includes the following information:
20
20

ARTIFACT INFORMATION
8/
/2

Search Term
x9

The information embedded in the URL itself; this is common to most search engine
.m

websites.
ks

URL
si

The full URL.

en

Date/Time The date and time the search was executed. Whether the date and time information
f or
dg

is recorded as UTC or Local Time is dependant on the browser that generated the
@

artifact.
er

Search Engine The search engine used to search for the keyword(s)
vi
ja

Webpage Title The title of the webpage that appears in the browser itle bar/tab.
Original Artifact The artifact category from which this refined result was compiled.

MAGNET AXIOM EXAMINATIONS (AX200) 79

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

EVIDENCE INFORMATION

Source The directory path (including file name) where the artifact was found.

Location The Location of the data within the source file or object.

RUNNING EXERCISE
PARSED SEARCH QUERIES
• Select the REFINED RESULTS → Parsed Search Queries category.

• The Search Term column displays the search conducted by the user.

• The Search Engine column displays the different search engines used.

• The Artifact column details the WEB RELATED category this refined result has been sourced
from.

• In the search box on the FILTERS click Go .

• Select the Refined Results → Parsed Search Queries category

• All the results are from Facebook website searches.

• Locate the Artifact column and highlight the entry from the Chrome Web Visits category.

• Note the Table and record id information in the Location field of the DETAILS card.
__________________________________________________________________________

Expand the TAGS, COMMENTS & PROFILES pane.

20

•
20
8/

• Click ADD NEW TAG and apply a tag named Refined Result .
/2
x9
.m

• A tag icon has been added to the entry in the EVIDENCE pane.
ks
si
en

• On the DETAILS card, click the Original Artifact link Chrome Web Visits.
f or
dg

• AXIOM Examine automatically switches to the WEB RELATED → Chrome Web Visits
@
er

category and highlights the corresponding artifact.

vi
ja

• Review the Source and Location information in the DETAILS card and confirm this is the same
artifact.

• Although this is the same artifact it is not tagged. AXIOM Examine treats the artifacts within
each category as separate items and does not cross-tag them.

80 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

• Select the REFINED RESULTS → Facebook URLS category and locate the same artifact.

• AXIOM categorizes some artifacts into multiple REFINED RESULTS categories.

• Clear all filters.

CLASSIFIEDS URLS
URLs relating to websites that contain classified ad type content, such as items for sale, personal ads
and services offered, are compiled into the REFINED RESULTS → Classifieds URLs category. There are
currently 38 domains supported, some of which are shown in Figure 3.1.11. Refer to the Artifact
Reference for a full list of supported domains.

Figure 3.1.11 Classifieds URLs

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

Site Name The name of the classifieds website.

20

URL
20

The full URL.

8/
/2

Date/Time The date and time the webpage was visited. Whether the date and time information
x9
.m

is recorded as UTC or Local Time is dependant on the browser that generated the
ks

artifact.
si
en

Original Artifact
or

The artifact category from which this refined result was compiled.
f
dg
@
er
vi

EVIDENCE INFORMATION
ja

Source The directory path (including file name) where the artifact was found.

Location The Location of the data within the source file or object.

MAGNET AXIOM EXAMINATIONS (AX200) 81

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

82 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

RUNNING EXERCISE
CLASSIFIEDS URLS
• Select the REFINED RESULTS → Classifieds URLs category.

• Right-click the Site Name column and select Filter on column.

• Enter and click SEARCH .

• The Classifieds URLs now only contains eBay entries.

• The FILTERS bar has turned yellow and the filter criteria is in bold.

• Hover over the filter criteria.

• The full filter criteria is displayed.

• Using the same steps, filter the URL column using as the search term.

• The matching results are eBay activity Nickelback .

• Both filter criteria are in bold on the FILTERS bar.

• Clear all filters.

CLOUD SERVICES URLS

URLs relating to the use of cloud-based services are compiled into the REFINED RESULTS → Cloud
20

Services URLs category. There are currently 49 domains supported, some of which are shown in Figure
20
8/

3.1.12. Refer to the Artifact Reference for a full list of supported domains.
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.1.12 Cloud Services URLs

MAGNET AXIOM EXAMINATIONS (AX200) 83

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

Site Name The name of the cloud service website.

URL The full URL.

Date/Time The date and time the webpage was visited. Whether the date and time information
is recorded as UTC or Local Time is dependant on the browser that generated the
artifact.

Original Artifact The artifact category from which this refined result was compiled.

EVIDENCE INFORMATION

Source The directory path (including file name) where the artifact was found.

Location The Location of the data within the source file or object.

RUNNING EXERCISE
CLOUD SERVICES URLS
• Select the REFINED RESULTS → Cloud Services URLs category.

• Site Name column.

• Apply a sort to the URL column.

• Almost all the entries start denoting a secure connection.

20

• Use the keyboard shortcut CTRL+A to select all the entries.

20
8/

• Expand the TAGS, COMMENTS & PROFILES pane.

/2
x9
.m

• Click ADD NEW TAG and apply a tag named Dropbox Activity .
ks
si
en

• A tag icon has been added to all the entries in the EVIDENCE pane.
f or
dg

• Hover over the tag icon.

@
er
vi

• The name of the tag is displayed.

ja

• Using the search box in the FILTERS bar, conduct a search for .

• No artifacts match this filter criteria.

• On the FILTERS bar, click the X that part of the filter.

84 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

• The results are still filtered by Site Name contains “dropbox”.

• Clear all filters.

FACEBOOK URLS
The REFINED RESULTS → Facebook URLs category contains URLs relating to activity on the Facebook
website. In some instances, the structure of the URL is such that the possible activity occurring on the
website can also be identified, e.g. login attempts, viewing help pages, or looking at a Facebook profile.
If the activity cannot be determined from the URL, the Potential Activity column is populated with
.

Figure 3.1.13 Facebook URLs

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

URL The full URL.

Date/Time The date and time the webpage was visited. Whether the date and time information
is recorded as UTC or Local Time is dependant on the browser that generated the
20
20

artifact.
8/
/2

Potential Activity The potential activity occurring on the website.

x9
.m
ks

Original Artifact The artifact category from which this refined result was compiled.
si
en
f or
dg

EVIDENCE INFORMATION
@
er
vi

Source
ja

The directory path (including file name) where the artifact was found.

Location The Location of the data within the source file or object.

MAGNET AXIOM EXAMINATIONS (AX200) 85

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

RUNNING EXERCISE
FACEBOOK URLS
• Select the REFINED RESULTS → Facebook URLs category.

• Locate the Artifact column.

• These refined results have been combined from Firefox, Chrome, Edge and Internet Explorer
artifacts.

• Sort the Potential Activity column and locate the entries

.

• Locate the artifact dated 21 Sept 2016 at 20:23:42.

• In the DETAILS card of the DETAILS pane, locate the URL field and highlight the numerical
string (this is the Facebook ID number).

• Right-click and copy the highlighted data.

• Paste the copied number into the search window of the FILTERS bar and click Go .

• The filtered results each have the search term highlighted in the URL.

• Select the WEB RELATED → Firefox Cache Records category and highlight the artifact.

• From the Source information in the DETAILS card, note the file name.
__________________________________________________________________________

• Switch to the REFINED RESULTS → Facebook URLs category.

20
20

• This artifact was sourced from the same file.

8/
/2

•
x9

Clear all filters.

.m
ks
si
en
f or
dg
@
er
vi
ja

86 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

SOCIAL MEDIA URLS

URLs relating to activity on social media websites is compiled into the REFINED RESULTS → Social
Media URLs category. It includes activity on websites such as: Friends Reunited, LinkedIn, Reddit and
Twitter, some of which are shown in Figure 3.1.14. Refer to the Artifact Reference for a full list of
supported domains.
NOTE: This category does not include activity on the Facebook website as Facebook has its own
refined results category.

Figure 3.1.14 Social Media URLs

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

Site Name The name of the social media website.

URL The full URL.

Date/Time The date and time the webpage was visited. Whether the date and time information
is recorded as UTC or Local Time is dependant on the browser that generated the
20

artifact.
20
8/

Original Artifact The artifact category from which this refined result was compiled.
/2
x9
.m
ks
si

EVIDENCE INFORMATION
en
f or

Source
dg

The directory path (including file name) where the artifact was found.
@
er

Location The Location of the data within the source file or object.
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 87

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

RUNNING EXERCISE
SOCIAL MEDIA URLS
• Select the REFINED RESULTS → Social Media URLs category

• Filter the Site Name Twitter entries.

• The MATCHING RESULTS details how many of the SOCIAL Media URLs meet this criteria.

• Sort the Date/Time column.

• There are numerous entries on 05 Oct 2016.

• In the top right of the EVIDENCE pane use the drop-down menu to switch to the Timeline view.

• Not all the original MATCHING RESULTS are displayed in the Timeline view. This is because
not all the Twitter entries had date and time information.

• Click on the activity spike for 5 Oct 6 Oct, then click VIEW DETAILS.

• Select all the listed artifacts.

• Expand the TAGS, COMMENTS & PROFILES pane.

• Apply a tag to the selected entries.

• Switch back to the Column view.

• Clear all filters.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

88 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

GOOGLE MAP QUERIES

The REFINED RESULTS → Google Maps Queries artifacts are generated from browser activity on the
Google Maps website www.google.com/maps. Search data is compiled from activities such as:
searching for a specific street address, searching for restaurants near a specified location, clicking on a
search result for a business near a specific location, searching for a city name, and searching for
directions to a specific location.

Figure 3.1.15 Google Map Queries

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

Search Query The place that was searched for.

Date/Time The date and time the map was viewed. Whether the date and time
information is recorded as UTC or Local Time is dependant on the
browser that generated the artifact.
20

Starting Location
20

The starting location for navigation/directions.

8/
/2

Center of Map
x9

Latitude and Longitude where the map was centered.

.m
ks

Business Latitude and Longitude Latitude and Longitude of the business location.
si
en

Source Address
or

Starting point for directions.

f
dg
@

Destination Address Finishing point for directions.

er
vi

Route Type
ja

How the user selected to travel (car, bus, walk).

Additional Address Any point the user selected to navigate via.

Street View Latitude/Longitude The latitude and longitude displayed when in street view.

MAGNET AXIOM EXAMINATIONS (AX200) 89

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

EVIDENCE INFORMATION

Source The directory path (including file name) where the artifact was found.

Location The Location of the data within the source file or object.

IDENTIFIERS
The REFINED RESULTS → Identifiers category contains information that can be used to help identify
individuals. This information is extracted from several different artifacts and includes: email address, chat
accounts and screen names, Windows user accounts, data extracted from document metadata, and
information entered into web forms.

Figure 3.1.16 Identifiers

The DETAILS card on the DETAILS pane includes the following information:
20

ARTIFACT INFORMATION
20
8/

Identifier The ID of the person.

/2
x9
.m

Column Name The artifact field containing the identifying information.

ks
si

Original Artifact
en

The artifact the identifier was sourced from.

f or
dg
@
er

EVIDENCE INFORMATION
vi
ja

Source The directory path (including file name) where the artifact was found.

Location The Location of the data within the source file or object.

90 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

PROFILES
The data compiled into the REFINED RESULTS → Identifiers category can be used to create a filter
profile. A profile helps the examiner quickly identify all artifacts in the case associated with the Identifiers
linked to the profile.

Profiles can either be created by selecting CREATE NEW PROFILE in the TAGS, COMMENTS &
PROFILES pane as shown in Figure 3.1.18, or by selecting ADD PROFILE from the Manage profiles
dialog window, as shown in Figure 3.1.17. The Manage profiles window can be accessed from the Tools
menu or the Profiles drop-down on the FILTERS bar.

20
20
8/
/2
x9

Figure 3.1.17 Manage profiles dialog window

.m
ks

NOTE: The PROFILES card only appears on the TAGS, COMMENTS & PROFILES pane when the
si
en

REFINED RESULTS → Identifiers category is selected.

f or
dg
@
er

Once the profile has been created, Identifiers can be linked to it by highlighting the Identifier(s) and
vi
ja

selecting the profile in the PROFILES card of the TAGS, COMMENTS & PROFILES pane, as shown in
Figure 3.1.18.

MAGNET AXIOM EXAMINATIONS (AX200) 91

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

Figure 3.1.18 PROFILE card in TAGS, COMMENTS & PROFILES pane

Identifiers linked to a profile display a silhouette icon in the EVIDENCE pane.

Figure 3.1.19 Icon denoting Identifier is linked to a Profile

Once a profile has been created it can be used as a filter to display all artifacts associated with the
Identifiers linked to the Profile. To filter using a profile, select the profile name from the Profiles drop-
down menu on the FILTERS bar as shown Figure 3.1.20.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.1.20 Filtering by profile

92 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

RUNNING EXERCISE
CREATING A PROFILE
• Select the REFINED RESULTS → Identifiers category.

• The Artifact column details the various sources of identifiers.

• The Column Name details the artifact field the Identifier has been extracted from.

• Locate the Identifier column, right-click on the column title and select Filter on column.

• click SEARCH .

• Highlight all the results.

• Expand the TAGS, COMMENTS & PROFILES pane.

• In the PROFILES card, click CREATE NEW PROFILE.

• Name the p click OKAY .

• The selected items all now have a silhouette icon indicating they are linked to a profile.
EDITING A PROFILE
• In the EVIDENCE pane, highlight one of the Identifiers linked to the Monica Neff Profile.

• In the TAGS, COMMENTS & PROFILES pane, on the PROFILES card, mouse over the Monica
Neff Profile and click the X that appears to the right.

• The Identifier has been removed from the Profile.

20
20

• With the Identifier still highlighted, in the PROFILES card under Select an existing profile,
8/
/2

select the Monica Neff Profile again.

x9
.m
ks

• The Identifier is linked to the Monica Neff Profile again.

si
en

MANAGING PROFILES
f or
dg
@

• In the TAGS, COMMENTS & PROFILES pane on the PROFILES Card, click MANAGE
er

PROFILES.
vi
ja

• The number of Identifiers linked to the Profile is listed.

• Hover over the Profile name.

• A trash can appears to delete the Profile if required.

MAGNET AXIOM EXAMINATIONS (AX200) 93

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

• Click into the Profile name change and click UPDATE.

• The Profile name has been updated.

• Close the Manage profiles window

• From the Profiles drop-down on the FILTERS bar, select the Monica profile and click OKAY .

• All artifacts in the case that contain the Identifiers linked to the Monica profile are now
displayed.

• Clear all filters.

NOTE: The Manage profiles option is also available from the Tools menu and the Profiles drop-
down on the FILTERS bar.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

94 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

MODULE REVIEW
In this module the following topics were covered:

• The purpose of the REFINED RESULTS categories and where the information is compiled from.

• The content of some of the REFINED RESULTS, such as Google Searches, Parsed Search
Queries; Cloud Services URLS, Classifieds URLs, Social Media URLs and Identifiers.

• How to create a Profile using information contained in the Identifiers category.

• How to sort and filter artifacts.

• How to filter artifacts pertaining to only specific Identifiers using a Profile.

• How to use source linking to locate the source file of an artifact.

• Accessing the built-in help resources such as the User Guide and Artifact Reference.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 95

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

REVIEW QUESTIONS
To help reinforce the learning objectives for this module, the following review questions have been
provided.

1. What is the purpose of the REFINED RESULTS artifact categories?

2. Explain the difference between the Google Searches and Parsed Search Queries artifacts.

3. What REFINED RESULTS artifacts are used to create a Profile?

4. Name three sources of information for the Identifiers artifacts.

20
20
8/
/2
x9

5. What resource lists the various artifacts searched for by AXIOM and the meanings of the column
.m

values?
ks
si
en
f or
dg
@
er
vi
ja

96 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

RUNNING EXERCISE
This exercise is based on the Dashner case scenario detailed on page 38 of the manual.

RESEARCH OF A CONTROLLED SUBSTANCE

• In the Artifacts drop-down on the FILTERS bar, type the word into the Find… box at the
top.

• Select the Google Searches and Parsed Search Queries; then click OKAY .

• The MATCHING RESULTS only contains these two categories.

• In the FILTERS bar Search box click GO .

• Select the REFINED RESULTS → Google Searches category.

• Locate the Artifact column, right-click the column title and select Filter on column.

• E s|Main ensure the GREP / Regex checkbox is enabled.

This is a Regex expression that will apply a filter to display only the Artifact fields containing the
s or , which will display just the artifact categories containing the
internet history relating to Chrome, Firefox and Internet Explorer/Edge.

• After selecting the option for Grep and typing in the keyword to search for, click SEARCH , to
invoke the search immediately
appear to be relevant.

• Scroll across to the Previous Queries column.

• The Previous Queries these entries are relevant.

20
20

• Highlight one of the results.

8/
/2

Expand the TAGS, COMMENTS & PROFILES pane.

x9

•
.m
ks

• In the TAGS card, click ADD NEW TAG.

si
en
or

• Name the TAG Searches and click OKAY .

f
dg
@

•
er

Select the remaining results using the keyboard shortcut Ctrl+A.

vi
ja

• Right-click on the selected records, select Add / remove tag, and apply the newly created
tag to the results.

• Click the X beside the Artifact contains “visit… on the FILTERS bar.

• This removes just the column filter but leaves the remaining filter criteria in place.

MAGNET AXIOM EXAMINATIONS (AX200) 97

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

• Select the Parsed Search Queries category.

• Click the Search Engine column title twice to invoke a reverse sort.

• In the TAGS, COMMENTS & PROFILES pane, create a TAG

.

• Highlight the YouTube result, hold the shift key, then ult.

• This will block select results for faster tagging.

• Right-click the highlighted results, select Add / remove tag and apply the newly created tag to
the YouTube results.

• Select the first tagged YouTube result.

• On the TAGS, COMMENTS & PROFILES pane, in the COMMENTS card, click ADD COMMENT.

• make meth vi and click OKAY .

• Sort the Search Term column.

How many Parsed Search Queries ?

_____________________________________________________________________________

Which Search Engine was used to conduct these searches?

_____________________________________________________________________________

• Apply a TAG Searches Bing to these results.

• Clear all filters.

20

ADVANCED SEARCHING AND FILTERING

20
8/
/2

• In the Artifacts drop-down on the FILTERS bar, select Google Searches and click OKAY .
x9
.m
ks

• In the Keywords lists drop-down on the FILTERS

si
en

and click OKAY .

f or
dg

cannabis ________________________
@
er

How many Google Searches results are LSD ________________________

vi
ja

• Create appropriate TAGS and apply them to the results.

• Click the next to cannabis,lsd on the FILTERS bar and click Reset to clear the keyword
criteria of the filter.

98 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

• Search box of the FILTERS bar and click GO .

• Search box of the FILTERS bar and click GO .

When both keywords are applied at the same time, how many artifacts are found? _________

• Clear all filters.

NOTE: Multiple search terms selected from the Keyword lists drop-down of the FILTERS bar list use
OR logic.

Multiple search terms entered using the Search box on the FILTERS bar use AND logic.

To search for multiple keywords using the Search box on the FILTERS bar and use OR logic
the keywords must be entered at the same time using a GREP / Regex expression.

CREATING AND USING PROFILES

• From the Profiles drop-down on the FILTERS bar, click MANAGE PROFILES.

• Click ADD PROFILE, name the profile and click ADD.

• Click OKAY to close the Manage profiles window.

• Select the REFINED RESULTS → Identifiers category.

• Right-click on the column title of the Identifier column and select Filter on column.

• SEARCH .
How many Identifiers __________________

• Link these Identifiers to the Dashner Profile.

20

• Clear the filter and filter the Identifier column f

20
8/

How many Identifiers __________________

/2
x9
.m

• Link these Identifiers to the Dashner Profile.

ks
si

Clear the filter and filter the Identifier

en

•
or

__________________
f
dg
@

• Link these Identifiers to the Dashner Profile.

er
vi
ja

• Clear the filter and using the Profiles drop-down on the FILTERS bar, filter the case using the
Dashner profile.
How many matching results are displayed? __________________
Notes

MAGNET AXIOM EXAMINATIONS (AX200) 99

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20
8/

____________________________________________________________________________________
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

100 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 1 Refined Results

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 101

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 1 Refined Results

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

102 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

Module 3 Computer Artifact Analysis Part 2 Chat

3.2

MODULE 3:
Computer Artifact Analysis Part 2 Chat
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 103

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

104 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

LEARNING OBJECTIVES
In this lesson, students will take part in lecture, instructor-led exercises, and student practical exercises
to look at evidence associated with user and chat application activities. Students will use the searching
and filtering functionality of AXIOM Examine and the different evidence explorers, to identify key artifacts
from Skype file, folder, and database structures. Students will also use AXIOM Examine to add tags and
comments to key artifacts in preparation for case reporting. Students will learn how to enable Magnet.AI
to categorize chat content which will assist in their investigations.

GOALS
At the conclusion of this lesson, students will be able to identify and discuss artifacts from Skype, and be
able to filter, tag and comment on discovered artifacts. Students will also be able to navigate between
the various explorers.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 105

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

MAGNET AXIOM PROCESS CHAT ARTIFACTS

Magnet AXIOM can recover instant messenger (chat) data from a wide variety of evidence sources,
including PC, Mac, and mobile platforms. When possible, AXIOM will also recover data from deleted chat
client activities. The known categories of chat clients can be found in the CHAT options of AXIOM Process,
under the ARTIFACT DETAILS section for computer and mobile evidence. In addition, AXIOM Process
can also employ its DYNAMIC APP FINDER utility, in the Find more artifacts section of PROCESSING
DETAILS, to recover chat client data from mobile evidence, which is not natively-supported within the
list of known clients.

Figure 3.2.1 AXIOM Process CHAT options

AXIOM Process supports over 300 known types of Internet artifacts, many of which are instant
20

CHAT options, within the ARTIFACT DETAILS section in AXIOM

20
8/

Process, allow the user to configure AXIOM for the recovery of instant messenger client artifacts from
/2
x9

both PC (Windows and Mac) and mobile (Android, iOS, Windows, Kindle Fire) evidence. The user
.m

configures the CHAT options for either PC, or mobile evidence, by selecting the Computer artifacts or
ks

Mobile artifacts options in the ARTIFACT DETAILS section of AXIOM Process. By default, all the known
si
en
or

clients currently supported by AXIOM are checked. AXIOM natively supports the following chat artifacts
f
dg

displayed below.
@
er
vi
ja

106 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

Figure 3.2.2 Chat Artifacts PC

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.2.3 Chat Artifacts Mobile

MAGNET AXIOM EXAMINATIONS (AX200) 107

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

CUSTOM ARTIFACTS
For mobile evidence, potentially-unsupported instant messaging client artifacts can be recovered using
the Find more artifacts option, within the PROCESSING DETAILS section of AXIOM Process. In
addition, users can also create their own Custom Artifacts, based on known database structures, using
the Manage custom artifacts option in the Tools menu of AXIOM Process. The Custom Artifact feature
of AXIOM Process is applicable to both PC and mobile evidence.

20
20
8/
/2
x9
.m
ks
si
en

Figure 3.2.4 Manage custom artifacts

f or
dg
@

We will cover Custom Artifacts in depth when we get to mobile devices in Module 4.
er
vi
ja

108 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

YAHOO MESSENGER
Within the various categories of chat clients, AXIOM Process may provide the user with additional options.
For example, selecting the OPTIONS link for Yahoo! Messenger allows the user to manually-enter a
username, or have AXIOM attempt to locate the usernames, for the purposes of decrypting deleted chat
log entries. AXIOM can search through the supplied forensic image, an attached drive, or a virtually-
mounted drive, in its efforts to locate a Yahoo username. In addition, the user can define a date range to
which AXIOM will limit its recovery of Yahoo artifacts. This can be useful in helping to reduce false-positive
results, and/or when a specific date range of activity is known for a given investigation. Also, if the courts
issue a warrant you may only be allowed to search for specific usernames or dates and this will help you
stay within the scope of the warrant. Finally, the number of potential false-positive results can be further
reduced by selecting the level of strictness applied to the searches AXIOM will conduct for the Yahoo
artifacts. By default, the strictness level is set to Medium strictness, but can be configured by the user
from the False Hit Filtering drop-down menu.
20
20
8/
/2
x9
.m
ks
si
en
or

Figure 3.2.5 OPTIONS for Yahoo! Messenger

f
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 109

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

RUNNING EXERCISE
AXIOM PROCESS CHAT SETTINGS
• Launch AXIOM Process from the desktop icon.

• Load the DashnerWin10PC.E01 image file

• Select the Computer artifacts option in the ARTIFACTS DETAILS category of Process

• Select the CHAT artifact category

• Scroll down to the Yahoo! Messenger category, and select the OPTIONS menu

• In the Manage Yahoo! Messenger Usernames window, note the options for

• Manually-entering the screen name

• Automatically-locating the screen name Find Usernames.

• Creating a date range filter Date Range Filtering.

• Setting the false-hit filter level False Hit Filtering.

• Close the window when complete

• Close AXIOM Process

CHAT ARTIFACTS
20

When the Artifacts explorer is selected in AXIOM Examine, the CHAT category will display the total
20
8/

number of chat-
/2

configuration settings in AXIOM Process, and the presence of recoverable artifacts within the evidence.
x9
.m

Expanding the CHAT category will display all the sub categories, organized by client name, with
ks

application-specific artifacts, as seen in Figure 3.2.6. The artifact sub categories are based on what the
si
en

various chat clients will store on the local machine; the format in which they are stored; and, whether or
f or

not artifacts within the various categories are recoverable by AXIOM, from allocated and unallocated
dg
@

space. In general, the chat client artifact categories include: local user screen name, and profile
er

hreads; file
vi
ja

transfers; phone calls; video messages; and, Internet Protocol (IP) addresses.

110 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

Figure 3.2.6 CHAT artifacts

By default, the artifact listed within the various CHAT categories will be displayed from all evidence
sources simultaneously. So, if a case includes PC and mobile evidence, the CHAT category and sub
categories for each client will be a combination of PC and mobile results.

If the examiner wants to limit the view to CHAT artifacts from either the PC, or mobile evidence, then the
desired evidence type can be selected from the Evidence drop-down menu of the FILTERS bar. After
checking the desired evidence source in the drop-down menu, AXIOM Examine will only display the
20

artifacts associated with the checked evidence.

20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.2.7 Filtering the view vy Evidence

MAGNET AXIOM EXAMINATIONS (AX200) 111

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

If unsupported chat client artifacts were recovered using the Custom Artifacts or by importing a list of
custom artifacts, then these will be displayed in the CUSTOM category in AXIOM Examine.
NOTE: Custom Artifacts will be covered in depth in Module 4 of this course of instruction.

AXIOM Examine enables the user to explore the chat-related artifacts, using either the Artifacts or File
system explorers in the NAVIGATION pane. The Artifacts explorer is the default view providing a
breakdown of the chat clients and their associated categories. Selecting the category within the
NAVIGATION pane will display its contents in the EVIDENCE pane.

Figure 3.2.8 Column view option

The default view for the EVIDENCE pane is the Column view, but the user can configure the default view
in the Tools → Settings menus of AXIOM Examine to Column view, Classic view, or Row view. The
view within the EVIDENCE pane can also be changed, at any time, using the drop-down menu in the upper
right corner of the EVIDENCE pane. The viewing options available include Conversation view, Classic
view, Column view, Histogram view, Row view, Thumbnail view, Timeline view, and World map
view. Each of these viewing options offers its own unique way of allowing the user to interact with the
chat artifacts, within the EVIDENCE investigative needs.
20
20

ARTIFACTS ROW VIEW

8/
/2
x9

Another useful view for examining chat artifacts is the Row view, also available from the EVIDENCE pane
.m
ks

drop-down menu. In this view, the details of the selected artifact category are displayed in a format
si
en

more easily presented to a non-technical stakeholder in the investigation and can also provide the
or

investigator with a quick overview of the artifacts in a given category. When a user selects an individual, or
f
dg

multiple artifacts, from the Row view, the CREATE REPORT / EXPORT option allows the selected artifacts
@
er

to be exported from the case. The Export type drop-down menu lets the user identify the format for the
vi
ja

exported artifact(s) as seen in the Figure 3.2.9

112 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

Figure 3.2.9 CHAT artifacts Row view

Artifacts can also be tagged from within the EVIDENCE pane, in the Row view, by right-clicking on the
artifact and selecting Add / remove Tag. For chat client message artifacts, the Row view will display
20

basic information for each of the individual message thread, while the Conversation view reconstructs
20
8/

the entire conversation.

/2
x9
.m
ks

ARTIFACTS CONVERSATION VIEW

si
en
f or

The Conversation view in the EVIDENCE pane, is another extremely useful feature when examining
dg
@

chat messages and their relevance to an investigation. AXIOM reconstructs the chat conversations from
er
vi

specific clients, using individual message threads parsed from the chat client artifacts of both allocated
ja

and unallocated space. The rethreaded conversations are displayed in the EVIDENCE pane; each thread
can be expanded to view the individual posts within the thread. When an individual post is selected, it will
also be highlighted in the PREVIEW card of the DETAILS pane to provide context, as displayed in Figure
3.2.10.

MAGNET AXIOM EXAMINATIONS (AX200) 113

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

Figure 3.2.10 Conversation view

The entire conversation thread or individual posts can be exported using the right-click, Create report /
export to HTML or PDF file formats. In addition to exporting conversation content, a conversation can be
assigned to a pre-existing tag, or a new tag can be created from the TAGS, COMMENTS & PROFILES
pane of AXIOM Examine, and applied to the selected conversation. A tag applied to a thread or individual
post in Conversation view will also show in Column view.

Figure 3.2.11 Create report / export option

ARTIFACTS MAGNET ARTIFICIAL INTELLEGENCE CATEGORIZE

20

CHATS
20
8/
/2

AXIOM uses Magnet.AI capabilities when searching chat artifacts to analyze the content for possible
x9
.m

evidence of enticement or sex-related content. Magnet.AI technology attempts to identify chat content
ks

where activities such as grooming, luring, sex-related conversations, enticement, etc., may be occurring.
si
en

gr
or

-
f
dg

Tags and comments

@

gro -
er

drop-down of the FILTERS bar. Magnet.AI is activated after process is completed and is activated by the
vi
ja

examiner. This allows for an examiner to decide if this is relevant in their investigation or if it meets their
scope of search.

114 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

Figure 3.2.12 MAGNET.AI CHAT CATEGORIZATION

RUNNING EXERCISE
ENABLING MAGNET.AI
• In AXIOM Examine, select the menu option Process → Categorize chats.

• Select which chats you want to categorize.

• Click NEXT .

• Select which categories of content you want Magnet.AI to search for. To change the name of a
tag, click the default label, type a new name, and then click UPDATE.

• Click CATEGORIZE CHATS .

20
20
8/
/2

ARTIFACTS SOURCE LINKING

x9
.m
ks

As presented in earlier modules, the Source Linking feature of AXIOM Examine enables the user to quickly
si
en

locate the source of an artifact in either the File system or Registry Explorer of the NAVIGATION pane.
f or

For chat category artifacts, this feature can be particularly useful when examiners need to locate an artifact
dg
@

parsed from an SQLite database table. When a chat thread entry within the EVIDENCE pane is selected, the
er

contents are displayed in the DETAILS pane. Within the DETAILS card are two important fields for the
vi
ja

investigator, the Source and Location fields. Each helps the investigator identify the location from which
AXIOM has parsed the chat artifact, and the format in which the chat client has stored the artifact.

MAGNET AXIOM EXAMINATIONS (AX200) 115

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

Figure 3.2.13 DETAILS card Source linking

When available, AXIOM will show these locations as blue hyperlinks. Selecting the hyperlink in either the
Source or Location
the File system or Registry explorers in the NAVIGATION pane, depending on the artifact type. If the
selected artifact is from an SQLite database file, then the user can follow the source linking feature in
AXIOM Examine and view the individual tables and entries in the File system Explorer of the
NAVIGATION pane. In some instances, AXIOM may not parse all the SQLite files, or tables, from a given
chat client. When this occurs, the File system explorer and built-in SQLite parsing features of AXIOM
20

Examine allow the user to manually explore the table entries.

20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.2.14 Source linking to SQLite database tables

116 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

In Figure 3.2.14, the hyperlink for the main.db file was selected for a Skype chat message thread. In
response, AXIOM automatically changed from the Artifacts explorer to the File system explorer in the
NAVIGATION pane, expanded the evidence structure, and highlighted the main.db from the Skype
user profile sub folder. From the File system explorer, the user then has the option to explore the
evidence structure further, or expand folders and sub folders, and view their associated contents within
the EVIDENCE pane. Selecting the Messages table from the EVIDENCE pane displays the individual
message thread table entries in the DETAILS pane and enables the investigator to gain a deeper
understanding of where the Skype chat message artifacts were parsed from and the relationship between
the various tables within the main.db database. As previously-mentioned, AXIOM Examine also has a
built-in SQLite utility, which enables the user to explore the structure and entries of an SQLite database.
This is useful when additional supporting evidence may be available in a database table that does not
have a corresponding artifact category in Examine. In the example shown in Figure 3.2.13, if the student
follows the Source link and location to the Messages table and then scrolls down to message 789 you

SKYPE
Within the ever-expanding digital ecosystem, investigators must navigate, there are hundreds of instant
messaging (chat) clients. Each client offers its own unique set of features for the user and poses and
equally-unique set of challenges for the investigator attempting to recover evidence in support of their
case. Among the available chat clients, Skype is unquestionably one of the most popular. Available across
a wide variety of platforms, Skype, which was purchased by Microsoft in 2011 for around $8.5 billion,
claims a user base of over 600 million, with an estimated 300 million active monthly users (Global Social
Networks by Users, 2015). The remainder of this module will focus on the Skype instant messenger
client, and the artifacts which can be recovered by AXIOM.

The artifact categories which will be covered in this module for Skype include the: Skype Accounts;
20

Skype Calls; Skype Chat Messages; Skype Chatsync Messages; Skype Contacts; Skype IP
20
8/

addresses; Skype Media Cache; and user preferences and settings.

/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 117

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

Figure 3.2.15 DETAILS card of Skype Accounts artifact

AXIOM parses many of the Skype artifact categories from the main.db file, which is located within the
main.db file is an SQLite database, composed of tables which
one calls (calls); chat messages (messages);
contacts/buddies (contacts); and file transfers or media cache (mediadocuments).

The Skype Accounts artifacts are parsed from the Accounts table of the main.db file. Essentially,
the table stores the minimum information required by Skype to create a user profile, as well as any
optional information the user chooses to include in their profile. The column view of the EVIDENCE pane,
and the DETAILS card of the DETAILS pane will list all the available data from the table. Evidentiary items

the account, timestamps for the creation of the profile and avatar, and the last time the profile was
20

modified. If availabl PREVIEW

20
8/

card of the DETAILS pane. Selecting the blue hyperlink in the Source field of the DETAILS card will direct
/2
x9

AXIOM to switch to the File system explorer, expand the Skype user profile folder structure, and highlight
.m

the main.db file, and the tables for the main.db database will be displayed within the EVIDENCE pane.
ks
si

Selecting an individual table from the EVIDENCE pane will display its entries in the DETAILS card of the
en
or

DETAILS pane.
f
dg
@
er
vi
ja

118 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

RUNNING EXERCISE
SKYPE ACCOUNTS
• Launch AXIOM Examine from the desktop icon and open the Dashner case.

• In the NAVIGATION pane, expand the CHAT category and note the entries for the Skype client.

• Skype Accounts

• Skype Calls

• Skype Chat Messages

• Skype Chatsync Messages

• Skype Contacts

• Skype IP Addresses

• Skype Media Cache

• Select the Skype Accounts category.

• In the EVIDENCE pane, note the column values parsed from the main.db file.

• In the DETAILS pane, note the entries for the PREVIEW

avatar.

• In the DETAILS card, note the local user profile data in the ARTIFACT INFORMATION fields.

• Note the path for the main.db file in the EVIDENCE INFORMATION fields.
20
20

• Click the hyperlink for the Source and use the AXIOM Examine source-linking feature to
8/
/2

automatically navigate to the main.db file in the File system explorer.

x9
.m
ks

• The individual tables from the main.db file are displayed within the EVIDENCE pane, while the
si
en

data from the selected table is displayed in the DETAILS pane.

f or
dg

• Highlight the Accounts table and note the entries in the DETAILS pane.
@
er
vi

• Return to the Artifacts explorer in the NAVIGATION pane.

ja

• The artifact in the EVIDENCE pane should still be highlighted.

• Click the TAGS, COMMENTS & PROFILES tab to expand the pane.

• Click the option for ADD NEW TAG.

MAGNET AXIOM EXAMINATIONS (AX200) 119

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

• tag and click OKAY.

• Note the selected Skype Account artifact is automatically-added to the new tag.
SKYPE AVATAR
• Switch to the File system explorer in the NAVIGATION pane.

• EVIDENCE pane, select the

config.xml file.

• In the DETAILS pane, scroll down to the TEXT AND HEX card, and select the TEXT view.

• At the top of the TEXT view, select the FIND .

• picture of me 1.png.

• Return to the Artifacts explorer in the NAVIGATION pane.

• In the FILTERS bar, check Pictures from the Artifacts drop-down menu.

• In the search window, enter picture of me 1.png and click GO to search for the Skype
avatar.

• Right-click the artifact in the EVIDENCE pane and select Add / remove tag and add the
artifact to the Skype User Profile tag.

• AXIOM Examine.

SKYPE CHAT MESSAGES

20

The Skype Chat Messages artifacts are parsed from the Messages table of the main.db database.
20
8/

Using the source linking functionality of Examine, a user can follow the link to the main.db file and use
/2
x9

the File system explorer within the NAVIGATION pane to explore the table structure, and values within
.m
ks

the main.db database much like the previous example for the calls table in the same database.
si
en
f or
dg
@
er
vi
ja

120 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

Figure 3.2.16 Skype main.db database Messages table

Within the Messages table, Skype stores the local user and remote user names; the author (sender) of
the message; the recipient of the message; the timestamp the message was sent; and, the content of the
message threads in the body_xml field. If the chat conversation included file transfers, then details of
the transfer will also be stored in the body_xml field of the Messages table. Similar to the Calls and
CallMember tables, which use the id values to link data associated with phone calls in Skype, the
Messages table also uses a similar function. The convo_id value links the Messages table to the
Conversations table, to help identify the contact with whom the chat message occurred as seen in
Figure 3.2.17.
20
20
8/
/2
x9
.m
ks
si
en
or

Figure 3.2.17 Conversations table linking to the Messages table

f
dg
@
er

RUNNING EXERCISE
vi
ja

SKYPE CHAT MESSAGES

• Select the Skype Chat Messages category.

• Note the column values displayed within the EVIDENCE pane.

MAGNET AXIOM EXAMINATIONS (AX200) 121

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

• Sort by the Message Sent Date/Time column.

• Select the first chat thread between Isaiah Dashner and Luthor Felix. This is a message sent
from Felix to Dashner, requesting the Dashner add Felix as a contact in Skype.

• View the next thread. This the response, from Dashner, sent to Felix automatically by Skype,
indicating Dashner has added Felix as a contact.

• Select the first entry again, in the EVIDENCE pane, and click the hyperlink for the entry in the
main.db file, to view the artifacts in the File system explorer, and note the id value from the
Messages table (896).

• Select the Messages table from the EVIDENCE pane.

• Expand the DETAILS pane to show the table entries.

• Note the id column value of 896 for the message thread from the Artifacts explorer. This is a
transactional entry, based on the overall activity being tracked in Skype. It is parsed by AXIOM as
the Location id.

• Note the numeric value in the third column, convo_id (892). This is the ID value for the
conversation between Dashner and Felix. All message threads for this conversation will have
the same message threads. There are 5 threads in this example. These represent the 5 message
threads for 14 Oct 2016 parsed by AXIOM in the Artifacts Explorer.

• Expand the right margin of the body_xml column and view the entries for the 5 threads of the
conversation between Dashner and Felix. This is the data parsed in the Message column of the
Artifact explorer.

• Return to the Artifacts explorer.

20

• Select the first 2 message threads for 14 Oct 2016 between Dashner and Felix.
20
8/
/2

• Expand the TAGS, COMMENTS & PROFILES pane, and create a new tag for the two artifacts,
x9
.m

.
ks
si

• In the EVIDENCE pane, select the first tagged artifact. In the TAGS, COMMENTS & PROFILES
en
or

pane, select ADD COMMENT

f
dg

and click OKAY to add the comment to the tag.

@
er

• Switch to the Conversation view in the EVIDENCE pane.

vi
ja

• Select the conversation between Dashner and Felix on 14 Oct 2016 at 02:52:33 and note the way
AXIOM Examine displays the conversation in a Skype-like view in the PREVIEW card.

• From the Tools menu, select Manage tags

.

122 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

• Right-click the selected chat conversation and select Add / remove tag. Add the rethreaded
conversation to the Skype Chat Messages tag.

SKYPE CONTACTS
The Skype Contacts artifacts are parsed from the Contacts table of the main.db database. The
Contacts table stor
similar to what is found for the local user in the Accounts table of the main.db file. The table includes
minimum information required by Skype for the remote user to have created a profile, as well as any
optional information the remote user chose to include in their profile. In addition to the identifying
information, Skype also stores the status of the relationship status of the remote user to the local user,
such as whether the remote user has been added to the contact list or blocked by the local user.
20
20
8/

Figure 3.2.18 Skype Contacts and DETAILS card

/2
x9

Using Source Linking, the user can switch from the Artifacts explorer to the File system explorer and
.m
ks

explore the entries within the Contacts table. The table entries include the required, and optional,
si
en

profile information for the contact, from which the EVIDENCE and DETAILS pane views are derived in
f or

AXIOM Examine. In addition, the status of the contact is also stored in the Contacts table and interpreted
dg
@

by AXIOM Examine in the Is Blocked and Contact Added columns. The status of the contact is stored
er
vi

in a numeric value in the buddystatus and isauthorized fields of the Contacts table. A
ja

buddystatus value of 3 and an isauthorized value of 1 appear to indicate the remote user was added
as an authorized contact for the local user and was not blocked.

MAGNET AXIOM EXAMINATIONS (AX200) 123

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

RUNNING EXERCISE
SKYPE CONTACTS
• Select the Skype Contacts category from the ARTIFACTS pane.

• Select the first entry in the EVIDENCE contact and review the column
entries.

• Note the ARTIFACT and EVIDENCE INFORMATION displayed in the DETAILS pane for the
Source and Location.

• Click the Source link for the main.db file and select the Contacts table from the EVIDENCE
pane in the File system explorer.

• .

• Return to the Artifact explorer of the NAVIGATION pane.

• Right-click the entry for luthorfelix in the EVIDENCE pane and add it to the Skype Contacts tag.

SKYPE IP ADDRESSES
The Skype IP Addresses artifacts, similar to the Skype Chatsync Messages, are parsed from the
proprietary *.dat files, within the \chatsync\ folder structure. The File Offset value within the DETAILS
pane identifies the location of the IP address, stored as a hex value, within the *.dat file.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.2.19 Skype IP Addresses

124 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

By looking at the DETAILS Card we can see the Source and Location of the IP Addresses. The file offset
of the record in the .dat Examine is showing us as an IP Address
by clicking on the Source link to go to the .dat file in the File system explorer. On the right side of AXIOM
Examine under the DETAILS Card is located another card entitled TEXT AND HEX and we will be able
to see the hex code as it is stored in the .dat file and uninterpreted by AXIOM Examine.
AXIOM Examine converts the IP address, stored as a hexadecimal value at the specified offset of the
*.dat file. From the File system explorer, an investigator can use the TEXT AND HEX card, and the GO
TO option to navigate to the offset identified in the Location field of the DETAILS card. We will validate
the IP Address at offset 1120 within the specified .dat file. We will use the Windows Calculator in
programmer mode. Open calc.exe from Windows and use the menu in the upper left to choose
programmer mode. Highlight the option for hex and type in the hex values which translate as follows.

Hex Decimal
C0 192

A8 168

29 41

81 129
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.2.20 Translated IP address stored in HEX to DEC using CALC.EXE

As you can see in the chart above the translated IP address matches that interpreted by AXIOM Examine
in Figure 3.2.19.

MAGNET AXIOM EXAMINATIONS (AX200) 125

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

RUNNING EXERCISE
SKYPE IP ADDRESSES
• Select the Skype IP Addresses category.

• Sort by the Source column in the EVIDENCE pane.

• Expand the right margin of the Source column to view the complete entry string.

• Note the IP addresses are parsed from the *.dat files in the \chatsync\ folder structure.

• Highlight the first entry in the EVIDENCE pane for 192.168.41.129 and view the ARTIFACT and
EVIDENCE INFORMATION in the DETAILS pane.

• Note the offset within the *.dat file of 2331

• Click the Source link for the *.dat file to switch to the File system explorer.

• In the DETAILS pane, scroll down to the TEXT AND HEX card view, and select the HEX option.

• Use the GO TO option and enter the offset value of 2331.

• Note -bit value for the IP address of

192.168.41.129.

• If an Internet connection is available in class, open https://www.browserling.com/tools/hex-to-

ip.

• Enter the Hex from offset 2331 into the value to decode window of the Webpage, and click
the Hex as an IP address.
20
20

• Return to the Artifacts e the first

8/

entry from the EVIDENCE

/2
x9

.
.m
ks
si
en
f or
dg
@
er
vi
ja

126 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

APPLICATION OPTIONS FOR MOBILE CHAT ARTIFACTS

In the beginning of the chapter we showed you how to select options for Yahoo! in the CHAT artifacts
portion of AXIOM Process. AXIOM Process has additional chat artifacts for mobile with some artifacts
allowing you to provide information to allow for decryption.
WhatsApp options in AXIOM Process allow you to provide email addresses for a user. In order to decrypt
the database, you will need to put in the relevant email addresses line by line as shown in Figure 3.2.21.

20
20
8/

Figure 3.2.21 Adding email address for WhatsApp Decryption

/2
x9

Evidence recovered from WhatsApp can include messages, images, audio, and video.
.m
ks

Signal application is an encrypted communications application used primarily on Androids and iOS
si
en

products. Signal can be used with a desktop version available for Linux, Windows and MacOS. Users can
f or

send one-to-one and group messages, including voice, files, videos, and images. Signal can be utilized
dg
@

to make one-to-one voice and video calls. In order to decrypt the Signal database AXIOM Process
er

requires you to type one or more passwords, and ensure each password appears on a separate line as
vi
ja

shown in Figure 3.2.22.

MAGNET AXIOM EXAMINATIONS (AX200) 127

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

Figure 3.2.22 Adding passwords dor Signal Decryption

Use of the Magnet Forensics free program AXIOM Wordlist Generator and the IDENTIFIERS artifact
category in AXIOM can help you discover the email addresses needed for WhatsApp and the passwords
for Signal. If you process a device and discover the applications are encrypted
due to encryption, run the above program or identify emails in the IDENTIFIERS category and reprocess
the case only with the desired artifact selected.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

128 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

REVIEW QUESTIONS
To help reinforce the learning objectives for this module, the following review questions have been
provided:
1. AXIOM Process is capable of automatically-locating screen names within an evidence source for
which instant messenger (chat) client?

2. What is the name of the Skype database that provides most of the client artifacts in AXIOM?

3. How do you verify the IP address provided in the Artifacts view in AXIOM?

4. What application requires you to input an email address to decrypt the application in AXIOM
process?

5. What free Magnet Axiom tool can help you discover passwords to decrypt Signal?
20
20
8/

6. What two Magnet.AI features can be enabled for searching chat artifacts?
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 129

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

STUDENT EXERCISE
This exercise is based on the Dashner case scenario detailed on page 38 of the manual.

• Review the chats between Dashner and Neff using the filtering and searching functionality of
AXIOM. Identify the message which provides the phone number of George Riddle.
____________________________________
What is the convo_id from the database of the conversation containing this information?
(Hint use the right-click → filter on conversation option)
___________________________________________________________________________

• Using a regular expression for credit card numbers, who was the chat to which talks about
these numbers?
The Regex can be obtained from the Keyword Drop-down at the top of the filter bar
___________________________________________________________________________

• Tag the .
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

130 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 2 Chat

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 131

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 2 Chat

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

132 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

Module 3 Computer Artifact Analysis Part 3

Documents
3.3

MODULE 3:
Computer Artifact Analysis Part 3 Documents
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 133

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

134 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

LEARNING OBJECTIVES
In this lesson, students will take part in lecture, Running exercises, and student practical exercises to
gain an understanding of: the different views for documents, and the metadata of document file. Students
will use Magnet AXIOM to create artifact reports and save artifacts externally from AXIOM. Students will
explore the ability to search document content and metadata via the filters bar.

GOALS
At the conclusion of this lesson, students will be able to identify and discuss document artifacts, use
Magnet AXIOM to search the data and metadata of document files, and extract those recovered artifacts
from AXIOM. Students will also be able to search and filter document content.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 135

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

DOCUMENTS ARTIFACTS
AXIOM Process searches for and categorizes the following document formats into the DOCUMENTS
category:
• CSV (comma-separated value);
• Hangul Word Processor (Includes support for Korean language);
• Microsoft Office Excel, PowerPoint and Word;
• Corel Word Perfect Documents;
• OpenOffice Calc, Impress and Writer;
• PDF (Portable Document Format);
• RTF (Rich Text Format); and
• Text (Plain Text).
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@

Figure 3.3.1 Document formats supported by Magnet AXIOM

er
vi
ja

136 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

In AXIOM Examine, these artifacts are grouped into the DOCUMENTS category, as shown in Figure 3.3.2.

Figure 3.3.2 DOCUMENTS category

DOCUMENT CONTENT
When a document artifact is selected in the EVIDENCE pane, the DETAILS pane includes a PREVIEW
card that displays the basic content of the document. When Microsoft Office documents are displayed
each page/sheet/slide is separated by a grey broken line, as shown in Figure 3.3.3.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.3.3 PREVIEW card in the DETAILS pane

MAGNET AXIOM EXAMINATIONS (AX200) 137

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

The DETAILS pane of PDF documents contains two PREVIEW cards, one containing a near native
rendering of the document (including the ability to zoom in and out), the other containing just the basic
text content without the graphics as shown in Figure 3.3.4.

Figure 3.3.4 Two PREVIEW cards for PDF document

The DETAILS card on the DETAILS pane includes the following:

ARTIFACT INFORMATION

Filename The name of the document.

File System Created Date/Time The date and time the file was created on the file system.
20
20

File System Last Accessed Date/Time The date and time the file was last accessed on the file
8/
/2

system.
x9
.m

File System Last Modified Date/Time The date and time the file was last modified by the file
ks
si

system.
en
or

Size (Bytes)
f

The size of the file in bytes.

dg
@

Saved Size (Bytes)

er

The size of the recovered file in bytes.

vi
ja

MD5 Hash The MD5 hash of the document file.

SHA1 HASH The SHA1 hash of the document file.

NOTE: discussed in
the next section.

138 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

EXPORTING DOCUMENTS TO A LOCAL DRIVE

Document artifacts parsed and carved by AXIOM Process can be exported from the case and saved to the
local drive using AXIOM Examine.

To export a copy of the file, select the documents to be exported, right-click, and select Save artifact
to…, as shown in Figure 3.3.5. Select the folder location for the exported files, and once the Files saved.
message appears in the bottom left of the AXIOM Examine interface, as shown in Figure 3.3.6, click OPEN.
The files are exported to a folder named \Attachments\ within the destination folder.
NOTE: Files can also be saved from the File system explorer, which will be covered in a later lesson.

20
20
8/

Figure 3.3.5 Saving document artifacts to the local drive

/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.3.6 Artifacts exported successfully

MAGNET AXIOM EXAMINATIONS (AX200) 139

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

RUNNING EXERCISE
VIEWING AND SEARCHING DOCUMENT CONTENT
• From the Evidence drop-down on the FILTERS bar, select the DashnerWin10PC evidence
and click OKAY .

• From the Artifacts drop-down on the FILTERS bar, select the parent Documents category (the
one above the bar).

• Hover over the drop-down.

• Because the parent category was selected, it has automatically filtered on all document types
within the case.

• Only Documents from the DashnerWin10PC evidence are visible.

• Select the DOCUMENTS → PDF Documents category.

• Sort the Filename column

• Highlight the first file - 1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.

• On the DETAILS pane there are two PREVIEW Cards

• The first contains a near-native view of the file, including the text and imbedded graphics.

• The second contains just the text content.

• Using the Search box on the FILTERS bar, search for the word .

• The keyword hits are highlighted in the second preview pane.

20
20

• Searching from the FILTERS bar will locate keyword hits within the document content.
8/
/2
x9

• Click the X next to threshold on the FILTERS bar to remove just the keyword search part of the
.m
ks

filter.
si
en

• Switch to the DOCUMENTS → Excel Documents category.

f or
dg
@

• Sort the Filename column and highlight one of the files named Travel Budget
er
vi

Consumer.xlsx.
ja

• A rendered version of the file content is displayed in the PREVIEW card on the DETAILS pane.

• The file starts Mt. Rainier National Park . This is the sheet name that would be seen on
the tab in Excel.

140 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

• Scroll down in the PREVIEW card to the grey broken line.

• The text following the broken line is San Juan Islands. This is the next sheet in the
workbook.
EXPORTING DOCUMENT ARTIFACTS
• In the EVIDENCE pane, right-click on the file and select Save artifact to….

• Save the file to the \Export\ folder on the Desktop.

• Once the Files saved. message appears in the bottom left of the AXIOM Examine interface click
OPEN.

• Open the \Attachments\ folder and view the saved file in Excel.

• The worksheet tabs correspond to the information displayed in the PREVIEW card.

• Close the file and return to AXIOM Examine.

DOCUMENT METADATA
In addition to the ARTIFACT INFORMATION relating to the physical file, many document formats
contain internal metadata. This information travels with the file and is independent of the file system.
Metadata can therefore often provide more accurate information regarding when a document was first
created, as opposed to when the document was first written to the storage device. This can sometimes
result in inconsistencies between the date and time information contained within the ARTIFACT
INFORMATION. However, these inconsistencies should not be looked at as bad, but rather as a source
of additional information to include in a genesis timeline.
20

In addition to the ARTIFACT INFORMATION detailed in the previous section, The DETAILS card could
20
8/

also include the following information that has been extracted from the internal document metadata:
/2
x9

Title
.m

The title of the document.

ks
si

Subject The subject of the document.

en
or

Authors
f
dg

The document authors.

@
er

Last Author The last author of the document.

vi
ja

Company The Company the software is registered to.

Keywords Any keywords the user added to the document.

Comments Any comments the user added to the document.

MAGNET AXIOM EXAMINATIONS (AX200) 141

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

Created Date/Time The date the document was.

Last Modified Date/Time The date and time the document was last modified.

Last Printed Date/Time The date the document was created.

Figure 3.3.7 DETAILS card showing metadata extracted from document artifact

CSV, RTF and Text documents do not have metadata. OpenOffice and PDF files contain metadata similar
20

to Microsoft Office documents. Hangul Word Processor documents also have similar metadata to
20

Microsoft Office documents but also include a few unique fields. The Artifact Reference contains a full list
8/
/2

of metadata fields extracted for each document format.

x9
.m
ks
si

CREATING AN ARTIFACT REPORT

en
f or
dg

The artifact information contained within the EVIDENCE pane can be extracted to an artifact report. An
@
er

artifact report contains the information contained within the columns of the EVIDENCE pane, it does NOT
vi
ja

contain the content of the document itself.

To create the report, select the artifacts to be included in the report, right-click, and select Create report
/ export, as shown in Figure 3.3.8. This opens the Create / report export dialog window, as shown in
Figure 3.3.9.

142 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

Figure 3.3.8 Create report / export option

20
20
8/
/2
x9
.m
ks
si
en
or

Figure 3.3.9 Create report / export dialog window

f
dg
@

Select the folder location for the saved report using the File path option, then select the report format
er
vi

using the Export type drop-down, as shown in Figure 3.3.10. An artifact report can be saved in the
ja

following formats: CSV (Comma Separated Values), EXCEL, HTML, Identifiers, JSON (Project VIC / CAID
1.2), JSON (Project VIC / CAID1.3), PDF, Portable Case, XML, and XML with external files. However, some
of the formats are only available for specific artifact types, and if these are not available for the artifact
type currently selected the option will be greyed-out.

MAGNET AXIOM EXAMINATIONS (AX200) 143

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

Figure 3.3.10 Artifact reporrt Export types

Next, select what ITEMS TO INCLUDE in the report. As can be seen in Figure 3.3.9, This can be the
currently selected items, all items in the current view, all tagged items or items with a specific tag, or all
items in the case. Some report formats also allow the examiner to select the LEVEL OF DETAIL to include
in the report, as shown in Figure 3.3.11.
20

Figure 3.3.11 LEVEL OF DETAIL to include in artifact report

20
8/
/2

Once all the options have been set, click CREATE to generate the artifact report. A message appears in
x9

the bottom left of the AXIOM Examine interface when the report has been successfully created. The
.m
ks

message also details the format of the generated report, as shown in Figure 3.3.12.
si
en
f or
dg
@
er

Figure 3.3.12 Successful creation of report message

vi
ja

Click OPEN to view the artifact report.

144 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

RUNNING EXERCISE
VIEWING AND SEARCHING DOCUMENT METADATA
• Switch back to the DOCUMENTS → PDF Documents category.

• Sort by Filename and highlight the file 1494870C-9912-C184-4CC9-B401-

A53F4D8DE290.pdf again.

• In the DETAILS pane, scroll down to the DETAILS card.

• Compare the date and time information.

• The Last Modified Date/Time and Created Date/Time information is internal metadata that
has been extracted from the file.

• The File System Created Date/Time, and File System Last Modified Date/Time
information has been extracted from the file system. On an NTFS formatted volume this
information is stored in the $MFT file.

• Switch to the DOCUMENTS → PowerPoint Documents category.

• Sort the Filename column.

• Select one of the files named sports_car_campaign_brief.pptx.

• In the PREVIEW card on the DETAILS pane scroll down and locate the grey broken line.

• This is the next slide in the presentation.

• Using the Search box on the FILTERS

20
20

• The keyword hits are highlighted in yellow and Fontaine is the name of the Author
8/
/2
x9

• Searching from the FILTERS bar will locate keyword hits within the document metadata.
.m
ks

• Clear all filters

si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 145

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

CONNECTIONS
AXIOM Examine can identify connections between the artifacts within a case. By default, these
connections are not built automatically, and the process must be started manually using the Tools →
Build connections option. Alternatively, the connections can be set to automatically rebuild every time
new evidence is added to the case by enabling the Automatically build connections option in Tools
→ Settings → Connections.
Connection information is collected from all evidence items in the case regardless of whether it originates
from mobile devices, computer-based devices, or even cloud-based evidence. AXIOM Examine then
builds the connections, and links between the artifacts are identified.

The Connections explorer displays these connections visually, making it faster and easier to identify and
understand how various pieces of the investigative puzzle fit together. With the ever-growing mountain
of evidence examiners must deal with on a day-to-day basis, CONNECTIONS provide a way of
connecting the dots and identifying key related information in a more expedient manner. The
Connections explorer will help examiners establish the who, what, when, where, why and how of the
investigation, and it is expected that the examiner will return to the Connections explorer many times
throughout the life of the case.
WHO Who was involved? Understanding who owns a suspect file; who put it in that location; who, if
anyone, has looked at or executed the file (depending on the filetype); who deleted it; who
emailed/ transferred it; who did they email/transfer it to; and who was using the machine at
the time the offence occurred, who else has been using the machine are all questions that could
help answer the key question Who was involved?
WHAT What happened? Understanding what other files is this file related to; what other files have the
same hash regardless of filename; what applications have been used; what additional
information does the metadata provide (Word docs - when was it last printed, Pictures What
20

camera was used); what other files were stored in the same folder/on the same device; what
20

was the sequence of events, are all questions that could help answer the key question What
8/
/2

happened?
x9
.m

WHEN When did it occur? Understanding when a picture was taken (EXIF data); when was this file
ks
si

viewed, emailed/shared/transferred, when was this file deleted, when was this file executed or
en

last accessed are all questions that could help answer the key question When did it occur?
f or
dg

WHERE Where did it take place? Understanding where else a file is located, was it saved locally, to
@
er

other devices, to the cloud; where was it downloaded from; where was it distributed to; are
vi
ja

there logs to show where a device been used, are all questions that could help answer the key
question Where did it take place?
WHY Why did it happen? The content of correspondence in the form of chat, email, instant messaging
communications etc.; or the content of machine activity logs could help answer the key
question Why did it happen?

146 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

HOW How did it happen? How did this file get onto this device; how was the file shared with other
people; how did this person communicate with other key people; the content of
correspondence in the form of chat, email, instant messaging communications etc. could all
help answer the key question How did it happen?

Once the connections have been built, AXIOM Examine displays a CONNECTIONS icon beside any
artifact attribute that has been connected in some way, as shown in Figure 3.3.13. This could be the
filename, hash value, metadata field etc. Clicking the CONNECTIONS icon automatically switches
AXIOM Examine to the Connections explorer with the selected artifact attribute as the PRIMARY
NODE, as shown in Figure 3.3.14.

20
20
8/
/2
x9
.m
ks

Figure 3.3.13 CONNECTIONS icon

si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 147

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

Figure 3.3.14 PRIMARY and DIRECT NODES in Connections explorer

There are four types of node within the Connections explorer:

PRIMARY NODES are displayed in H O T P IN K . This is the anchor point from which the connections
are being made. In the Artifacts or File system explorers, selecting a CONNECTIONS icon for a specific
artifact attribute switches AXIOM Examine to the Connections explorer with that artifact attribute set as
the primary node. Within the Connections explorer double-clicking any node sets it as the primary node.
20

DIRECT NODES are displayed in B LU E . These are artifact attributes with a direct connection to the
20
8/
/2

primary node. To view only connections between a primary node and a direct node, click the direct node.
x9
.m

SELECTED NODES are displayed in T E A L . When a direct node is selected it becomes a selected node.
ks

The matching results displayed in the Connections explorer refresh to display only artifacts that contain
si
en

both attributes of the primary and selected node e.g. filename and application name. When a direct node
f or
dg

becomes a selected node, indirect connections come into focus.

@
er

INDIRECT NODES are displayed in G R EY . When a direct node becomes a selected node all other
vi
ja

direct connections to the primary node become indirect nodes and turn grey. All direct connections to the
selected node are also now displayed as indirect nodes.

CONNECTORS are the lines representing connections between two nodes. Types of connection include:
shares partial path, accessed with, transferred to, source, etc.

148 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

The MATCHING RESULTS pane displays the artifacts relating to the primary node. If a direct node is
selected, the MATCHING RESULTS updates to display just the artifacts in common between the primary
node and the selected node. Selecting one of the MATCHING RESULTS displays the artifact information
in the DETAILS pane and the artifact can be tagged or a comment added in the usual way.
To navigate the connections map, individual nodes can be selected to view where connections exist. In
the example shown in Figure 3.3.14, the file name CustomerData.xlsx is the primary node and has
several linked attributes identified by the direct nodes. The file has been accessed using the application
Excel, shares a partial path with the E:\ drive, and also shares a partial path with the SanDisk Ultra
USB Device.zip evidence file. Selecting the File path attribute E:\CustomerData.xlsx makes that direct
node a selected node and the indirect connections are now displayed.

20
20
8/
/2

Figure 3.3.15 Primary, Selected and Indirect nodes displayed in the Connections explorer
x9
.m
ks

By selecting this node, as shown in Figure 3.3.15, it immediately becomes apparent that an external
si

storage device with a volume name MyUSB and a volume serial number of 9C43B600 was inserted
en
or

into the computer and assigned the drive letter E:\. This graphical representation makes it is easier to see
f
dg

that the file CustomerData.xlsx was accessed from a USB drive with these two properties.
@
er
vi

The content displayed in the Connections explorer can be refined by filtering by Evidence source,
ja

Connectors type, or Attributes. The layout of the CONNECTIONS map can also be customised simply
by dragging nodes around on the screen. This is sometimes necessary if the map contains a large number
of artifacts, such as the one shown in Figure 3.3.16.

To print a copy of the CONNECTIONS map, simply right-click anywhere in the map and select Print…

MAGNET AXIOM EXAMINATIONS (AX200) 149

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

Figure 3.3.16 Complex CONNECTIONS map

RUNNING EXERCISE
CONNECTIONS
20
20

• In the Artifacts explorer, select the DOCUMENTS → PDF Documents category.

8/
/2
x9

• Filter the Filename column for the word

.m
ks

• Select the file Newcannabisgrowbible.pdf.

si
en
or

• There are CONNECTIONS icons next to the Filename, Authors and Source attributes.
f
dg
@

• Click on the CONNECTIONS icon next to the Filename.

er
vi

Who was this file transferred to?

ja

________________________________________________________________________
By what platform?
________________________________________________________________________

• Select the node referencing the URL.

150 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

• What applications are associated with this URL?

________________________________________________________________________

• Return to the Artifacts explorer and select the DOCUMENTS → Word Documents category.

• Sort by the Filename and locate the document DrugsList.docx.

• Click the CONNECTIONS icon next to the Filename.

Does this file appear to exist in multiple locations on the same device?
________________________________________________________________________

• Select the node for the File path

C:\Users\dashner\Documents\Work\Chemistry\Drugs List.docx.

• What application was this file opened with?

• ________________________________________________________________________

• Clear all filters

TIMELINE
The Timeline explorer provides a visualization of events in an interactive graph making it easy to conduct
specific timeline examination, identify spikes in activity, focus on specific dates, and establish patterns in
behavior, see Figure 3.3.17. Timeline can be very helpful in showing the sequence of events that occurred
prior to and after a particular event.

The Timeline must first be built using the option Tools → Build timeline. Alternatively, the Timeline
can be set to automatically rebuild every time new evidence is added to the case by enabling the
Automatically build timeline on case open option in Tools → Settings → POST-PROCESSING .
20
20

The graph shown in Figure 3.3.17 is a chronological representation of timestamped artifacts. The
8/
/2

Timeline category column includes high-level categorization such as browser usage, file/folder
x9
.m

opening, user event and more, and can be used to filter the information displayed. Other filter options
ks

are available in the FILTERS bar.

si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 151

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

Figure 3.3.17 Timeline explorer

The date range displayed can be modified by selecting GO TO DATE at the top of the graphic. Once
selected the calendars, as shown inFigure 3.3.18 Timeline Date SelectionThe ZOOM option narrows or
expands the dates displayed in the graph, and the dropdown modifiesy the axis points to years, months,
days, hours, or minutes.
20
20
8/
/2
x9
.m
ks
si

Figure 3.3.18 Timeline Date Selection

en
or

If an artifact is selected it is displayed in the DETAILS pane allowing the examiner to review the content
f
dg

preview and artifact details, or Source link to the artifact in File system explorer for further analysis.
@
er
vi
ja

RUNNING EXERCISE
TIMELINE
• In the Timeline explorer, select GO TO DATE, selectthe date range 2016-09-01 to 2016-10-

152 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

01.

• Filter the Timeline Category column for the phrase Browser usage.

• Filter the Type column for Google Searches.

• Find the listed artifacts for 2016-09-16.

What was searched?

________________________________________________________________________

Where is the source of the artifact?

________________________________________________________________________

What browser was used?

_______________________________________________________________________

• Clear all filters

MODULE REVIEW
In this module, the following topics were covered:

• Viewing DOCUMENT details and previewing their content.

• Viewing DOCUMENT metadata.

• Exporting DOCUMENTS to the local machine using the Save artifact to… option.

• Creating artifact reports using the Create report / export option.

20
20
8/

• Searching DOCUMENTS.
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 153

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

REVIEW QUESTIONS
To help reinforce the learning objectives for this module, the following review questions have been
provided:
1. Where is the content of a document displayed in AXIOM Examine?

2. DETAILS, what is the difference between the Created Date/Time and

the File System Created Date/Time?

3. Name three document formats searched for and categorized by AXIOM.

20
20

4. What is the difference between the Create report / export and the Save artifact to… functions?
8/
/2
x9
.m
ks
si
en
f or
dg
@
er

Will a keyword search conducted across the DOCUMENTS artifact category find a word within a
vi

5.
ja

PDF document?

154 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

STUDENT EXERCISE
This exercise is based on the Dashner case scenario detailed on page 38 of the manual.

• Using the Artifacts drop-down on the FILTERS bar, filter only the DOCUMENTS category.

• From the Keyword lists drop-down on the FILTERS bar, select the GREP / Regex expression
for Visa credit cards 4[0-9]{12}(?:[0-9]{3})? and click OKAY .

• Locate any Excel Documents containing credit card information and apply a tag .

• Click the next to the keyword criteria on the FILTERS bar and click RESET to clear the
keyword part of the filter.

• From the Keyword lists drop-down on the FILTERS bar, select the GREP / Regex expression
for MasterCard credit cards 5[1-5][0-9]{14} and click OKAY .

• Locate any Excel Documents containin Mastercard

• Click the next to the keyword criteria on the FILTERS bar and click RESET to clear the
keyword part of the filter.

• From the Keyword lists drop-down on the FILTERS bar, select at least two drug terms from
the imported keyword list.

• Apply a tag to any relevant results.

• Click the next to the keyword criteria on the FILTERS bar and click RESET to clear the
keyword part of the filter.

•
20

Search for the existence of the evidence hiding program Tor (try adding a space after the search
20

term to reduce the number of false hits). Review the Text Document results and locate any
8/

Filename.
/2
x9

How many items are in the directory? ____________________________

.m
ks

Return to the Artifacts explorer and clear all filters.

si

•
en
or

Using the Tags and comments drop-down on the FILTERS bar locate the Excel Document
f

•
dg
@

tagged in the previous step.

er

Who is the Author of the document sourced from the USB device?
vi

_________________
ja

What are possible explanations for the time stamp inconsistencies for this file?
___________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 155

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

156 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 3 Documents

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 157

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 3 Documents

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

158 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 4 Email

Module 3 Computer Artifact Analysis Part 4 Email

3.4

MODULE 3:
Computer Artifact Analysis Part 4 Email
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 159

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 4 Email

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

160 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 4 Email

LEARNING OBJECTIVES
In this lesson, students will take part in lecture, instructor led exercises, and student practical exercises to
recover emails and email attachments from mail clients supported by Magnet AXIOM. Students will also
gain an understanding of Source Linking as it relates to emails and understand the results found in the
PREVIEW card as well as the DETAILS card.

GOALS
At the conclusion of this lesson, students will be able to identify and discuss different email artifacts, and
use Magnet AXIOM to review, sort and filter, tag, and report on email and email attachments in
furtherance of a successful investigation.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 161

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 4 Email

EMAIL ARTIFACTS
AXIOM Process searches for and categorizes a variety of types of email into the EMAIL artifact category.
Figure 3.4.1, details some of the supported email artifacts for OS X / Windows, Android and iOS. For a
full list of the supported email clients and formats refer to the Artifact Reference.
AXIOM Process supports parsing of both traditional email client artifacts (POP, IMAP protocols, etc.) and
those from web-based email. This can be useful as individuals might access the same email account
differently on different computers and/or devices.
NOTE: The content of compound mail structures such as Microsoft Outlook PST and OST files is also
parsed. Appointments, Contacts, Journals, Notes and Tasks have their own artifact categories.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.4.1 Supported EMAIL artifact

162 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 4 Email

EMAIL CONTENT
When viewing the content of the EMAIL categories, the columns of the EVIDENCE pane include email
specific information, such as: To, From, Sender, Recipient, Subject, Carbon Copy, etc. as shown in Figure
3.4.2. The exact columns displayed will differ depending on the email client being displayed.

The PREVIEW card on the DETAILS pane provides a rendered view of the email content if available.
Figure 3.4.2 shows the HTML content of the email in the DETAILS card, and the rendered copy of the
same email in the PREVIEW card.
NOTE: Not all HTML content can be rendered into an easily readable format in the PREVIEW Card.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.4.2 EMAIL information displayed in the EVIDENCE pane, and DETAILS and PREVIEW cards
from the DETIALS pane

MAGNET AXIOM EXAMINATIONS (AX200) 163

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 4 Email

EMAIL SOURCE LINKING

The Source Linking feature within AXIOM Examine can also be used for EMAIL artifacts. For EMAIL
artifacts sourced from a flat database file such as MBOX Emails, the Source field details the filename
and directory location of the file the email was extracted from, and the Location field details the exact
location within the source file, as shown in Figure 3.4.3. To view the source of the artifact, select either
the Source or Location link. AXIOM Examine automatically switches to the File system explorer with
the source file highlighted. If the Location link was selected, the cursor in the TEXT AND HEX card will
be at the exact location within the file that the EMAIL artifact was found.

20
20

Figure 3.4.3 Source linking from DETAILS card

8/
/2
x9

If the source of an EMAIL artifact is a compressed compound file, such as Microsoft Outlook PST and
.m

OST files, the exact location within the file cannot be directly mapped. Therefore, the Location link will
ks
si

simply display n/a, as shown in Figure 3.4.4

en
f or
dg
@
er
vi
ja

Figure 3.4.4 Source linking for compound file

164 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 4 Email

RUNNING EXERCISE
VIEWING EMAIL CONTENT
• In the Artifacts drop-down on the FILTERS bar, select EMAIL.

• Select the EMAIL → EML(X) Files category.

• Sort the From column.

• Select the first .

• The DETAILS pane includes a rendered view of the email in the PREVIEW card.

• Expand the Headers field to view the full content.

EMAIL SOURCE LINKING
• Scroll down in the DETAILS pane to the EVIDENCE INFORMATION.

• Note the Source and Location of this email.

__________________________________________________________________________

• Click the Location link.

• In the File system explorer, confirm the Source file is highlighted.

• Scroll down to the TEXT AND HEX card and confirm the cursor is at the correct offset within
the Source file.

• In the TEXT AND HEX card, switch to TEXT view.

20
20

• The content of the email can be easily read.

8/
/2

• Switch back to the Artifacts explorer.

x9
.m
ks
si
en

EMAIL MESSAGE HEADERS

f or
dg
@

The DETAILS card on the DETAILS pane also includes any email Headers. Email headers can be
er

extensive, therefore only the first part of the header is displayed in the DETAILS card followed by a VIEW
vi
ja

MORE link. Selecting the link displays the Headers in full for the examiner to review.

Email Headers can be an excellent source of information as they often include: the source of an email,
the email servers the message has passed through, IP addresses of the sender and the email servers,
the email client used to send the message, and the true email address of the sender e.g. if a message is

MAGNET AXIOM EXAMINATIONS (AX200) 165

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 4 Email

sent from a group mailbox the header will also include the email address of the person actually sending
the message. In addition to detailing each email server the message has passed through, each email
server timestamps the header during transit. As these timestamps are placed in the header after
departing the originating computer, these timestamps can be trusted more than the sent date and time
detailed on the email itself. If an individual is attempting to manipulate a timeline, reviewing email
Headers could help ascertain the true date and time a message was sent.

20
20
8/

Figure 3.4.5 DETAILS card showing email message Header

/2
x9
.m

EMAIL ATTACHMENTS
ks
si
en
or

If an EMAIL artifact contains a file attachment, the attachment name will be listed in the Attachments
f
dg

or Attachment Name(s) column in the EVIDENCE pane and listed on the DETAILS card in the DETIALS
@
er

pane the exact name of the field is dependent on the EMAIL category. An EMAIL ATTACHMENTS card
vi
ja

is also included on the DETIALS pane listing the attachment name, as shown in Figure 3.4.6. If the content
is viewable the attachment name will be a link and when selected the attachment will display in a
PREVIEW card embedded within the EMAIL ATTACHMENTS card.

166 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 4 Email

Figure 3.4.6 PREVIEW card embedded within the EMAIL ATTACHMENTS card on the DETAILS pane

CREATING AN EMAIL REPORT

The content of email messages can be extracted into an artifact report, along with the other email
attributes such as to, from, subject date and time etc. The most commonly used format for extracting an
EMAIL report is HTML. However, if the emails originated from a PST or OST file, they can be exported to
a new PST container.

To create an EMAIL artifact report, select the emails to be included, right-click, and select Create report
20

/ export.
20
8/
/2
x9
.m

RUNNING EXERCISE
ks
si
en

CREATING AN EMAIL REPORT

f or
dg

• In the Artifact explorer, select the EMAILS → MBOX Emails category.

@
er
vi

Right-click in the EVIDENCE pane and select Create report / export.

ja

• Click BROWSE next to the File path and save the report to a folder \Email Report\ on the
Desktop.

• In the Export type drop-down select HTML.

MAGNET AXIOM EXAMINATIONS (AX200) 167

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 4 Email

• Select Items in the current view under ITEMS TO INCLUDE.

• Ensure the LEVEL OF DETAIL is set to Detailed information with individual reports per
artifact type and click CREATE .

• Once the Export to HTML complete message appears, click OPEN.

• Double click the Report.html file to open the report.

• Select MBOX Emails from the left-hand frame.

• The information from the EVIDENCE pane is included in the report.

• The Body and Headers fields contain links.

• Click the link for one of the email bodies.

• It opens a new tab and displays the email message.

• Close the report and return to AXIOM Examine

VIEWING EMAIL ATTACHMENTS
• Select the EMAILS → Outlook Emails category.

• Sort the Attachments column.

• Highlight the first entry.

• An addition EMAIL ATTACHMENTS card has appeared in the DETAILS pane.

• The EMAIL ATTACHMENTS card lists the names of the attached files.
20
20

• Click the link for The Great Big Narcotics Cookbook.pdf.

8/
/2

• A PREVIEW card opens within the EMAIL ATTACHMENTS card and displays the rendered
x9
.m

content of the attached file.

ks
si

EXPORTING EMAILS TO A PST FILE

en
f or

• Right-click in the EVIDENCE pane and select Create report / export.

dg
@
er

• Click BROWSE next to the File path and save the report to a folder \Outlook Emails\ on the
vi
ja

Desktop.

• In the Export type drop-down select PST.

• This option is enabled as the artifacts contained with the Outlook Emails category are sourced
from a PST or OST file.

168 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 4 Email

• Select Outlook messages in the current view for the ITEMS TO INCLUDE.

• There is no option to select the LEVEL OF DETAIL.

• Click CREATE , and when the message Export to PST complete appears, click OPEN.

• If Microsoft Outlook is installed on your workstation, open the exported PST file and view the
content.

• Return to AXIOM Examine.

SEARCHING EMAIL
The content and artifact attributes of EMAIL artifacts can be searched in the same way as other artifact
types. In the example shown in Figure 3.4.7, the Artifacts drop-down on the FILTERS bar was used to
filter for MBOX Emails, then a keyword searc .
20
20
8/
/2
x9
.m

Figure 3.4.7 Searching and filtering email

ks
si
en
or

RUNNING EXERCISE
f
dg
@
er

SEARCHING EMAILS
vi
ja

• Using the Search box on the FILTERS

• The hits are contained within the email Subject and Body HTML

• The hits within the Body HTML are also highlighted in the rendered version of the email in the

MAGNET AXIOM EXAMINATIONS (AX200) 169

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 4 Email

PREVIEW card.

• Add another Search

• The search hits are in the email Headers.

MODULE REVIEW
In this module the following topics were covered:

• Viewing EMAIL information including the To, From, Subject, and date and times.

• Viewing EMAIL content and how AXIOM Examine renders the content in the DETAILS pane.

• EMAIL headers and the information contained within them.

• How to view EMAIL attachments.

• Source linking of EMAILS.

• Creating EMAIL artifact reports.

• Exporting Outlook Emails to a PST file.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

170 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 4 Email

REVIEW QUESTIONS
To help reinforce the learning objectives for this module, the following review questions have been
provided:

1. Where can EMAIL specific information such as Subject, To, From and Received Time be viewed in
AXIOM Examine?

2. What is the potential investigative value of EMAIL Headers?

3. How can EMAILS with attachments be quickly identified?

4. How do you view EMAIL ATTACHMENTS in AXIOM Examine?

5. An EMAIL item has been extracted from a Gmail Inbox (POP protocol). What is the easiest way to
view it in more detail within the File system explorer?

6. If a keyword Search is conducted from the FILTERS bar, what parts of an EMAIL are searched?
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 171

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 4 Email

STUDENT EXERCISE
This exercise is based on the Dashner case scenario detailed on page 38 of the manual.

• Using the Artifacts drop-down on the FILTERS bar, filter only the EMAIL category.

• Using the searching and filtering capabilities of AXIOM Examine answer the following questions.
Who has Dashner been communicating with? (ignore any marketing/spam)
__________________________________________________________________________
__________________________________________________________________________
__________________________________________________________________________
What were they discussing in the emails?
__________________________________________________________________________

• Create an appropriate TAG and apply it to the EMAILS identified in the previous step.

• Locate the Outlook Emails with an ATTACHMENT

What is depicted in the attachment?
__________________________________________________________________________

• Use the original EMAIL Subject as a keyword and locate any other EMAILS in the conversation
chain.
How many EMAILS are there in this conversation chain? ______________________
Which folders are they in within the mailbox?
_________________________________________________________________________
What is their Priority and Importance? _______________________________________

• Apply the TAG created in the previous step to these emails.

• Run a keyword search across just the EMAILS to identify if Dashner was interested in using
encryption software.
20
20

• Create an appropriate TAG and apply it to the EMAILS identified in the previous step.
8/
/2
x9

• Create an HTML formatted artifact report containing the EMAILS tagged in this exercise.
.m
ks
si
en
f or
dg
@
er
vi
ja

172 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 4 Email

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20
8/

____________________________________________________________________________________
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en
or

____________________________________________________________________________________
f
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 173

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 4 Email

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

174 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 5 Media

Module 3 Computer Artifact Analysis Part 5 Media

3.5

MODULE 3:
Computer Artifact Analysis Part 5 Media
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 175

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 5 Media

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

176 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 5 Media

LEARNING OBJECTIVES
In this lesson, students will take part in lecture, instructor-led exercises, and student practical exercises
to gain an understanding of what types of media files are parsed and carved by AXIOM Process and how
the content of media files can be viewed in AXIOM Examine. They will also learn about the Magnet artificial
intelligence module Magnet.AI.

GOALS
At the conclusion of this lesson, students will be able to use AXIOM Examine to efficiently review media
artifacts and determine the best view for the different artifact types. Students will be able to activate and
process media artifacts using the Magnet.AI picture categorization modules.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 177

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 5 Media

MEDIA ARTIFACTS
AXIOM Process has the ability to both parse and carve for multimedia files during the processing phase.
AXIOM Process first parses any MEDIA artifacts from the evidence file(s), then it searches for and carves
any MEDIA artifacts from within other files on the disk, as well as from the file slack, uninitialized file
areas and unallocated space etc. The supported picture formats include: JPG, GIF, PNG, BMP, and many
RAW image formats. The video formats include: MPEG, AVI, MOV, and additional RAW video formats. For
a full list of the supported formats refer to the Artifact Reference, accessed from the Help →
Documentation menu.

Figure 3.5.1 MEDIA artifacts and OPTIONS

Like the REFINED RESULTS, this category can contain artifacts that are also included in other artifact
categories, e.g. If a user has been viewing pictures from a Facebook profile and they have been
ant WEB RELATED
cache category, and it will also be contained within the MEDIA → Pictures category.

PICTURES
By default, AXIOM Examine displays all artifacts in the Column view (the default view can be changed
20

from the Tools → Settings → DEFAULT VIEW option). However, when reviewing Pictures, the
20
8/

artifacts can be better reviewed using the Thumbnail view. To change the view, select Thumbnail view
/2
x9

from the View drop-down in the EVIDENCE pane, as shown in Figure 3.5.2
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.5.2 View drop-down

178 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 5 Media

Changing to the Thumbnail View automatically applies a filter to display only artifacts that can be viewed
as thumbnails.

When Thumbnail view is selected, a second drop-down appears that allows the examiner to set the size
of the thumbnails being displayed as Small, Medium or Large.

Figure 3.5.3 Thumbnail view and thumbnail resizing

Displaying the Pictures in Thumbnail view makes it quicker and easier for examiners to review the
content. To sort the Pictures when in Thumbnail view, right-click on any item and select Sort by. Figure
3.5.4 shows the attributes the Pictures can be sorted by.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.5.4 Sorting artifacts in Thumbnail view

MAGNET AXIOM EXAMINATIONS (AX200) 179

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 5 Media

If, at the time of processing, Extract EXIF data was selected in the PICTURES options, as shown in
Figure 3.5.5, the DETAILS pane for each Picture artifact will include any EXIF data contained within the
file, as shown in Figure 3.5.6

Figure 3.5.5 PICTURES options in AXIOM Process

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.5.6 EXIF data in DETAILS card

180 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 5 Media

VIDEOS
If, at the time of processing, Create a preview using still frames was selected in the VIDEO options,
as shown in, Figure 3.5.7, the DETAILS pane for each VIDEO artifact will include a PREVIEW card that
is a filmstrip of the video content, as shown in Figure 3.5.8.

Figure 3.5.7 VIDEO options in AXIOM Process

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.5.8 Filmstrip PREVIEW card of VIDEO artifact

MAGNET AXIOM EXAMINATIONS (AX200) 181

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 5 Media

To create the filmstrip, AXIOM Process extracts a still frame from the video at 10% intervals. For short
videos this allows the examiner to quickly review the content without the need to play the file in its
entirety. This can also be very useful when reviewing child abuse material as these videos often have a
black screen at the beginning and end to prevent windows creating a suspicious thumbnail. For videos
with a longer run time the filmstrip will still provide an overview of the content, but the examiner needs
to be aware that footage occurring between the still frames might be of interest to the investigation and
longer videos might still need to be reviewed.

In the bottom right-hand corner of the filmstrip is a ZOOM size displaying the current zoomed size of
the filmstrip, as shown in Figure 3.5.8. To enlarge the filmstrip to full size, click the filmstrip and the
PREVIEW window will pop-out to full size.

If, at the time of processing, Save videos up to was selected in the VIDEOS options, as shown in Figure
3.5.7, the DETAILS pane for each VIDEO artifact will also include a playable PREVIEW card, as shown in
Figure 3.5.9. To play a video file within the PREVIEW card, simply click the play button. The playable
PREVIEW card also includes a mute button.
20
20
8/
/2
x9
.m
ks
si
en
or

Figure 3.5.9 Playable PREVIEW

f
dg
@
er
vi
ja

182 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 5 Media

CATEGORIZING PICTURES USING MAGNET.AI

The Magnet artificial intelligence module, Magnet.AI, can be used to help quickly identify picture content
of interest within the case. When the CATEGORIZE PICTURES process is started within AXIOM Examine,
Magnet.AI identifies and tags picture content that matches the selected criteria, thereby reducing the
need to manually sort through thousands of images.

PICTURE CATEGORIZATION can be started in AXIOM Examine once processing has completed. It can
be started by selecting CATEGORIZE PICTURE within PLACES TO START on the Case dashboard, as
shown in Figure 3.5.10, or it can be started by selecting the menu option Process → Categorize
pictures.

20
20
8/

Figure 3.5.10 Case dashboard overview

/2
x9
.m

Selecting to run picture categorization from the Case dashboard will automatically attempt to
ks
si
en

categorize all the pictures in the case. If a more granular approach is required, the pictures must first be
or

filtered within the Artifacts explorer.

f
dg
@

From the Artifacts explorer, first apply any necessary filters to restrict which pictures should be
er
vi

categorized, then select the menu option Process → Categorize pictures. The Categorize pictures
ja

dialog then provides the option to categorize just the Pictures in the current view, as shown in Figure
3.5.11.

MAGNET AXIOM EXAMINATIONS (AX200) 183

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 5 Media

Figure 3.5.11 Categorize pictures dialog

Clicking NEXT then opens MAGNET.AI PICTURE CATEGORIZATION table listing the categories of
content MAGNET.AI can search for.
20
20
8/
/2
x9
.m
ks
si
en
f or

Figure 3.5.12 PICTURE CATEGORIZATION categories

dg
@

Magnet.AI currently supports categorization of pictures that possibly contain: Weapons, Child Abuse,
er
vi

Nudity, and/or Drugs, and more categorization categories are under development.
ja

Once a category is enabled the Tag name can be changed by clicking into the text, changing the tag name,
then selecting UPDATE.

184 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 5 Media

Once the Categories are selected and Tag names changed as desired click CATEGORIZE PICTURES to
start the process.

After processing, the Case dashboard updates with the Magnet.AI results, as shown in Figure 3.5.13.

Figure 3.5.13 TAGS added by MAGNET.AI picture categorization

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 185

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 5 Media

MODULE REVIEW
In this module the following topics were covered:
• A review of some of the multimedia file formats supported by AXIOM and where to find a full listed
of supported formats.

• The different Views available to efficiently review MEDIA artifacts.

• How the filmstrip is created and how it can be used to speed-up the investigative process.

• How to use Magnet.AI Picture Categorization to help quickly identify pictures of interest within
the case.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

186 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 5 Media

REVIEW QUESTIONS
To help reinforce the learning objectives for this module, the following review questions have been
provided:

1. What types of data are categorized within the MEDIA artifact category?

2. What two PREVIEWS are available to help examiners quickly review VIDEO artifacts?

3. At what percentage of a VIDEO file does AXIOM Process take still frames to create the filmstrip
PREVIEW?

4. MAGNET.AI can search for and categorize pictures within the case. Name the current four
categories searched for.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 187

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 5 Media

STUDENT EXERCISE
This exercise is based on the Dashner case scenario detailed on page 38 of the manual.

• In the Artifacts explorer, select the MEDIA → Pictures category.

• Ensure the view is set to Column view.

• Sort the Model column.

List some of the detected Models.
__________________________________________________________________________
__________________________________________________________________________

• Switch to the File system explorer and navigate to the path:

\DashnerWin10PC.E01\Partition 1 (Microsoft NTFS, 59.56 GB)\Users\
dashner\.

• Highlight the \Pictures\ folder, right-click and select View related artifacts.
How many items are listed within the MEDIA → Pictures category? __________

• Create a Tag named Dashner Pictures and apply it to these Pictures.

• Switch to the File system Explorer again and ensure you are still in the path:
\DashnerWin10PC.E01\Partition 1 (Microsoft NTFS, 59.56 GB)\Users\
dashner\.

• Highlight the folder \Dropbox\, right-click, and select View related artifacts.

• Select the MEDIA → Pictures category.

20

• Select the file named 2016-10-05 08.36.34.jpg.

20
8/

• Click the CONNECTIONS icon next to the Filename in the DETAILS pane.
/2
x9
.m

• Locate the MD5 hash (beginning in 02cdbf) and select the node.
ks
si

Where else is there a copy of this file?

en

__________________________________________________________________________
f or

What is the file called?

dg
@

__________________________________________________________________________
er
vi

• Switch back to the Artifacts explorer and clear all filters.

ja

• Select the MEDIA → Pictures category.

• Filter the Model column for the keyword iphone .

188 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 5 Media

How many Pictures were taken using an iPhone? ____________________________

Where were these Pictures parsed/carved from?
__________________________________________________________________________

• Clear all filters.

• Switch to the File system explorer.

• In the NAVIGATION pane, select ALL EVIDENCE.

• In the EVIDENCE pane, right click the SanDisk Sandisk Ultra USB Device 29.47 GB
quick image.zip entry and select View related artifacts.

• On the FILTERS bar, select MEDIA from the Artifacts drop-down.

• Switch to the Thumbnail view.

• Select the MEDIA → Videos category.

What is the Created Date/Time of the Video? ____________________________

• Using just the filmstrip PREVIEW

What is the approximate run time of the Video? ____________________________
What is depicted in the video? ____________________________

• Click the CONNECTIONS icon next to the Source of the Video.

• Select the direct node for IMG_0008.MOV.

• Does it appear this file was from an external device? If so,

what was the Volume Name of the device?
__________________________________________________________________________
20
20

• Switch back to the Artifacts explorer and clear all filters.

8/
/2
x9

• On the FILTERS bar, from the EVIDENCE drop-down, select the two Generic Flash Disk USB
.m

Device 3.76 GB Full E01 evidence items.

ks
si
en

• Select the menu option Process → Categorize pictures.

f or
dg
@

• Select Pictures in the current view and click NEXT .

er
vi
ja

• Select all four categories and click CATEGORIZE PICTURES .

How many pictures are categorized as:
Possible child-abuse content _______________
Possible drugs-related content _______________
Possible nudity _______________

MAGNET AXIOM EXAMINATIONS (AX200) 189

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 5 Media

Possible weapons-related content _______________

• Did Magnet.AI TAG the hits?

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

190 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 5 Media

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20
20

____________________________________________________________________________________
8/
/2

____________________________________________________________________________________
x9
.m

____________________________________________________________________________________
ks
si

____________________________________________________________________________________
en
or

____________________________________________________________________________________
f
dg
@

____________________________________________________________________________________
er
vi

____________________________________________________________________________________
ja

____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 191

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 5 Media

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20
20

____________________________________________________________________________________
8/
/2

____________________________________________________________________________________
x9
.m

____________________________________________________________________________________
ks
si

____________________________________________________________________________________
en
or

____________________________________________________________________________________
f
dg
@

____________________________________________________________________________________
er
vi

____________________________________________________________________________________
ja

____________________________________________________________________________________

192 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools

Module 3 Computer Artifact Analysis Part 6

Encryption & Anti-forensics Tools
3.6

MODULE 3:
Computer Artifact Analysis Part 6
Encryption and Anti-forensics Tools
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 193

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

194 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools

LEARNING OBJECTIVES
In this lesson, students will take part in lecture, hands-on exercises, instructor-led exercises, and student
practical exercises to gain an understanding of the Encryption and Anti-Forensics tools artifacts within
AXIOM Examine.

GOALS
At the conclusion of this lesson, students will be able to discuss encryption and anti-forensics tools, and
use AXIOM Examine to identify encrypted files/containers and anti-forensics tools installed on a machine.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 195

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools

ENCRYPTION & ANTI-FORENSICS TOOLS

Encryption is becoming more and more common place and with free, easy to use, software readily
available, it is not unusual for everyday computer users to employ encryption to safe guard their data.
Quickly identifying if encryption software is installed on a computer immediately alerts the examiner to
be on the look out for passwords or pass phrase. Quickly identifying encrypted files or containers on the
evidence ensures the examiner has as much time as possible to obtain or break the password.
When a computer is in general use traces of information are constantly being left behind. Analysing this
trace information is the role of the digital forensics examiner. Anti-forensics tools are used to remove
these traces of activity from a computer in an attempt to mask what the user has been doing and disrupt
the investigation of digital evidence.
These anti-forensics tools themselves also leave traces behind on the computer and the evidence of their
presence on the machine is often relevant to a case in of itself. The Encryption / Anti-forensics Tools
category quickly allows the examiner to locate information indicating that encryption or anti-forensics
software has been installed.

In AXIOM Process these artifacts are listed in the Computer artifacts → ENCRYPTION group. This
group contains two artifacts: Encrypted Files, and Encryption / Anti-forensics Tools. When searching
for Encrypted Files, AXIOM Process is, in essence, conducting an entropy check of the file content. It
checks the randomness of the data content of each file in the case and generates an Entropy Value score
between 0 and 8. AXIOM Process does not determine which program or encryption scheme has been
used to encrypt the file, and due to the way entropy calculation works, it often generates a large number
of false positives that are not encrypted files. Due to the processing time overhead incurred when
searching for Encrypted Files, this artifact is not enabled by default.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er

Figure 3.6.1 AXIOM Process ENCRYPTION artifacts

vi
ja

Selecting the Encryption / Anti-forensics Tools artifact instructs AXIOM Process to search the
evidence in the case for the presence of known encryption or anti-forensics software. A list of the
software that AXIOM Process currently identifies and the executable file it is searching for is provided in
Table 3.6.1.

196 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools

Application Name Executable File

AES Crypt aescrypt.exe
AESCrypt32.exe
AxCrypt AxCrypt.exe
AxCrypt2Go.exe
BestCrypt bcveserv.exe
bcvetray.exe
bestcrypt.exe
CCleaner CCleaner.exe
CCleaner64.exe
Check Point Encryption cptray.exe
p95tray.exe
prot_srv.exe
pstartsr.exe
Eraser Eraser.exe
File Shredder Shredder.exe
Folder Lock Folder Lock.exe
Freenet FreenetTray.exe
GPG gpg.exe
i2p I2P.exe
20

Kruptos 2 Professional Kruptos2Pro.exe

20
8/
/2

Mask Surf Pro msu.exe

x9
.m

OpenPuff OpenPuff.exe
ks
si

Our Secret OurSecret.exe

en
or

PGP pgp.exe
f
dg
@

Slacker slacker.exe
er
vi
ja

Sophos SafeGuard BEDevCtl.exe

BEFCSvcn.exe
SGNMaster.exe
SGNMasterServicen.exe

MAGNET AXIOM EXAMINATIONS (AX200) 197

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools

Spotflux SpotfluxAgent.exe
Steg steg.exe
Steganos Privacy Suite SteganosHotKeyService.exe
Symantec Drive Encryption EAFRCliManager.exe
EAFRCliStart.exe
EACommunicatorSrv.exe
Timestomp timestomp.exe
Tor tor.exe
TrueCrypt truecrypt.exe
Veracrypt VeraCrypt.exe
Winclear WinClear.exe

Table 3.6.1 List of Encryption / Anti-forensics Tools searched for by AXIOM Process

Reviewing the Encryption / Anti-forensics Tools artifacts in the Dashner case, it is clear there are
several relevant entries, including the installation of Tor, AxCrypt, and CCleaner.
20
20
8/
/2
x9
.m
ks
si
en
for
dg
@
er
vi
ja

Figure 3.6.2 Anti-

Once it has been established that these applications are installed on the computer, a further search across
the evidence should be performed to identify other related artifacts e.g. User Assist or Prefetch artifacts
identifying when then applications were run.

198 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 199

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools

MODULE REVIEW
In this module the following topics were covered:
• How AXIOM Process identifies encrypted files.
• The use case and limitations of the Encrypted Files artifact.
• How to use the Encryption / Anti-forensics Tools category to identify traces of relevant software
application.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

200 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools

REVIEW QUESTIONS
To help reinforce the learning objectives for this module, the following review questions have been
provided:

1. How does AXIOM Process identify Encrypted Files?

2. Does an Encrypted Files artifact display what program was used to encrypt files?

3. What does AXIOM Process search for when identifying Encryption / Anti-forensics Tools
artifacts?
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 201

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools

STUDENT EXERCISE
This exercise is based on the Dashner case scenario detailed on page 38 of the manual.

• Using the Dashner case, in the Artifacts explorer, select the ENCRPYTION → Encryption /
Anti-forensics Tools category.

• Ensure the view is set to Column view.

• Name three programs that are currently listed in this category.

_________________________________________________________________________
_________________________________________________________________________
_________________________________________________________________________

• Locate the artifact showing the encryption software identified in the Email lesson was installed
on the computer.
When was it installed? ___________________________________________________
When was it last run? ___________________________________________________

• From the FILTERS bar, run a search for the Software name.

• Review the results in the EMAIL category.

Do the dates and times of the emails correlate with the information noted in the previous
steps?
_________________________________________________________________________
Are there any emails indicated that Dashner activated the software?
_________________________________________________________________________

• Review the results in the WEB RELATED category.

What browser was used to find and download the application?
_________________________________________________________________________
20

Do the dates and times correlate with the information noted in the previous steps?
20

_________________________________________________________________________
8/
/2
x9

• Take a moment to review the results in the OPERATING SYSTEM category. Several of these
.m

artifacts will be covered in an upcoming lesson and their relevance will be discussed in more
ks
si

detail then.
en
f or
dg
@
er
vi
ja

202 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20
20

____________________________________________________________________________________
8/
/2

____________________________________________________________________________________
x9
.m

____________________________________________________________________________________
ks
si

____________________________________________________________________________________
en
or

____________________________________________________________________________________
f
dg
@

____________________________________________________________________________________
er
vi

____________________________________________________________________________________
ja

____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 203

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 6 Encryption & Anti-forensics Tools

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20
20

____________________________________________________________________________________
8/
/2

____________________________________________________________________________________
x9
.m

____________________________________________________________________________________
ks
si

____________________________________________________________________________________
en
or

____________________________________________________________________________________
f
dg
@

____________________________________________________________________________________
er
vi

____________________________________________________________________________________
ja

____________________________________________________________________________________

204 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Module 3 Computer Artifact Analysis Part 7 Web

Related
3.7

MODULE 3:
Computer Artifact Analysis Part 7 Web Related
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 205

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

206 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

LEARNING OBJECTIVES
In this lesson, students will take part in lecture, instructor-led exercises, and student practical exercises to
gain an understanding of browser related artifacts and the databases used by browsers to store information
such as browser history, typed URLs, bookmarks, download activity, and cached files.

GOALS
At the conclusion of this lesson, students will be able to identify and discuss the different artifacts
associated with the most common browser applications, and be able to use Magnet AXIOM to conduct
examinations of web related artifacts. The student will also gain an understanding of how to use source
linking to gain access to the browser databases, and the way AXIOM recovers artifacts from those ESE
(Extensible Storage Engine) and SQLite databases. 20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 207

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

WEB RELATED ARTIFACTS

AXIOM Process searches for and processes artifacts generated by the following browsers:

• 360 Safe Browser

• Google Chrome

• Mozilla Firefox

• Microsoft Edge

• Internet Explorer 10-11

• Internet Explorer Legacy versions (version 9 and

earlier)

• Opera

• Apple Safari

• XBOX 360 Internet Explorer

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.7.1 WEB RELATED category

This information is populated into the various categories within WEB RELATED and is grouped together
by browser.

208 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

In addition, browser artifacts such as Google Analytics, Google Toolbar, Malware/Phishing URLs, eBay,
Social Media, Classified Ads, and Searches are also identified and compiled into the various REFINED
RESULTS categories.
AXIOM Examine provides various viewing options for artifacts generated from browsing activity.

BROWSER ARTIFACTS AND REFINED RESULTS

Much of the content of the REFINED RESULTS categories are compiled from the results of browser
activity. Therefore, many of the artifacts located in REFINED RESULTS are also grouped within their
respective browser artifact category within the WEB RELATED categories.
In the example shown below, a
the Google Chrome browser. The DETAILS Card shown in Figure 3.7.2, is from a REFINED RESULTS →
Parsed Search Queries artifact. The DETAILS card shown in Figure 3.7.3 is from a WEB RELATED →
Chrome Web History artifact. Each entry has the same URL, Title, and Date/Time information.
Additionally, the Source and Location fields point to the same record id within the urls table of the
same History SQLite database, so both artifacts originate from exactly the same record within the
History database.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er

Figure 3.7.2 DETAILS card for REFINED RESULT Figure 3.7.3 DETAILS card from Chrome Web history
vi
ja

Browsing History is one of the most important artifacts related to browser usage. It helps to create a
picture and pattern of user activity.

MAGNET AXIOM EXAMINATIONS (AX200) 209

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

HISTORY GOOGLE CHROME

Google Chrome can be configured with multiple browsing profiles, the first of which is named Default .
Any additional profiles created will be named Profile1 , Profile2 etc. The browser activity generated
while a profile is in use is kept separate and discreet from the others in a subfolder named after the
profile. These subfolders are stored in the following location:
\Users\<username>\AppData\Local\Google\Chrome\User Data\
So, the user data relating to the default profile is located at:
\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\

The Chrome browser history is stored in an SQLite database named History. There are three database
tables that store the history information: urls, visits, and visit_source. The urls table is a list of each
unique URL stored in the database. The visits table contains a list of each time the browser has visited
a URL, regardless of whether the URL has been accessed multiple times. The records contained in the
visits table do not detail the URL accessed, but instead contain a field url that cross-references the urls
table. The visit_source refers to how each individual visit came to be in the database. The records in
the visit_source table contain a field id that cross-references the visits table.
20
20
8/
/2
x9
.m

Figure 3.7.4 Chrome Web History artifact sourced from urls Figure 3.7.5 Chrome Web Visits artifact sourced from urls
ks

table and visits tables

si
en

The information from the urls table is extracted by AXIOM Process and placed in the WEB RELATED →
f or
dg

Chrome Web History category, as shown in Figure 3.7.4 and the information from the visits table is
@

extracted by AXIOM Process and placed in the WEB RELATED → Chrome Web Visits category. The
er
vi

records extracted from the visits table are cross-referenced with the urls and visit_source tables
ja

and the DETAILS card lists which records from each table have been used to compile the artifact, as
shown in Figure 3.7.5.

The DETAILS card on the DETAILS pane of an artifact in the Chrome Web History category includes
the following information:

210 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

ARTIFACT INFORMATION

URL The URL visited.

Last Visited Date/Time The date and time the URL was last visited.

Title The title of the webpage as it /tab.

Visit Count How many times the URL has been accessed.

Typed Count The number of times Chrome deems this was a Typed URL. Typed URLs will
be covered in more detail in a later section of this module.

EVIDENCE INFORMATION

Source The directory path (including file name) where the artifact was found.

Location The location of the data within the source file or object. The example shown
in Figure 3.7.4 and Figure 3.7.5 relate to the Chrome History SQLite
database and details the specific database tables and records the artifact
was extracted from. If the artifact is not sourced from a database, the offset
from the beginning of the file or object is listed.

The DETAILS card on the DETAILS pane of an artifact in the Chrome Web Visits category also includes:

ARTIFACT INFORMATION

Transition Type How the browser navigated to the website.

Visit Source The source of the visit entry in the database.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 211

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

The possible values for the Transition Type are:

LINK The user clicked a link in another page.

AUTO_TOPLEVEL Any content that is automatically loaded in a top-level frame. E.g. opening
the dev tools window, or opening web-based dialog boxes. It can also be
the page passed to the command line.
AUTO_SUBFRAME Any nested subframe that is loaded automatically by the parent page. This
is often seen where frames contain ads the ad URLs will have this
transition type.
MANUAL_SUBFRAME Any nested subframe that is loaded as a result of an explicit action by the
user and generates new navigation entries in the back/forward page
navigation list.
GENERATED The user started typing in the address bar, then selected an entry that did
NOT look like a URL. These are discrete from Typed URLs as the suggestion
did not look like a URL. E.g. the entry in the database might be the URL of a
google search but the user had typed Vikings in the address bar and
selected the suggested entry vikings Google Search .
KEYWORD The URL was generated from keyword search configured by the user. This
search might also generate an additional visit with a transition type of
KEYWORD_GENERATED. E.g. if the user enters a search for the
generated URL has a transition type of KEYWORD; a second URL for
wikipedia.org with a transition type of KEYWORD_GENERATED might also
be created.
KEYWORD_GENERATED Corresponds to a visit generated for a keyword. See description of
KEYWORD above.
FORM_SUBMIT The user filled out values in a form and submitted it.
20
20

NOTE: in some situations, such as when a form uses a script to submit its
8/
/2

content, submitting a form does not result in this transition type.

x9
.m

RELOAD The user reloaded the page using either the reload/refresh button, or
ks

pressing enter in the address bar. This transition type is also used for
si
en

session restore when reopening closed tabs.

f or
dg

TYPED The user either entered the URL into the address bar or selected a URL from
@

the autocomplete suggestions offered. This type is not used if the user
er
vi

selected a choice that didn't look like a URL; see GENERATED above.
ja

AUTO_BOOKMARK The user selected an entry from the User Interface. This includes
bookmarks, or items in the browser history.

The possible values for the Visit Source are:

212 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Synced Synchronized from somewhere else.

User Browsed User browsed see NOTE below.

Extension Added by an extension.

Firefox Import Imported from Firefox.

IE Import Imported from Internet Explorer.

Safari Import Imported from Safari.

NOTE: Because a value of User Browsed is by far the most common, for effi it is no
longer stored in the database. AXIOM Examine does not list an empty column on the
DETAILS card, therefore if the Visit Source is missing; the database column is empty, and
the content User Browsed can be implied. If the database content needs to be verified, use
the Source link to switch to for can be used to locate the database in the File system
explorer and the content of the visit_source table checked.

RUNNING EXERCISE
CHROME HISTORY
• Select the WEB RELATED → Chrome Web History category.

• Sort the Title column.

• Highlight the entry 3 Ways to make a Fake ID.

20

The Source details this artifact has been extracted from the History database.
20

•
8/
/2

• It has been extracted from the urls table, record id 168.

x9
.m
ks

• Click the Source Link.

si
en
or

• In the File system explorer, double-click the History database file to open it.
f
dg
@

• View the urls table and locate record id 168.

er
vi
ja

• The record details the URL and Title of the webpage, the Visit Count, and the Last Visited
Date/Time.

• It also includes how many times Chrome deems this URL was Typed.

• This table of the database only details the last time the URL was accessed.

MAGNET AXIOM EXAMINATIONS (AX200) 213

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

• Locate the last_visit_time field and record the content. ______________________________

• Open the DCode utility in the \Tools\ folder on the Desktop.

• In the Value to Decode field, type in the numerical value from the earlier step .

• Change the Decode Format to Google Chrome Value and click Decode .

• The decoded value matches the information displayed in AXIOM Examine.

• Switch to the Chrome Web Visits category.

• Sort by Title and locate the same record 3 ways to make a Fake ID.

• The Location lists the urls table record id 168 again.

• It also lists the visits table record id 219.

• Click the Source link again and open the database.

• View the visits table and locate record id 219.

• The url field contains 168, the record just viewed in the urls table.

HISTORY MOZILLA FIREFOX

Like Chrome, Firefox can also be configured with multiple browsing profiles, the first of which is named
default . Any additional profiles created will be named using the profile name provided by the user.
The browser activity generated while a profile is in use is kept separate and discreet from the others in a
subfolder named xxxxxxxx.<profile name>, where xxxxxxxx is a randomly generated alpha-numeric
20
20

value prepended to the profile name. Most of the data

8/

subfolders are stored in the following location:

/2
x9
.m

\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\
ks
si

So, the user data relating to the default profile is located at:
en
or

\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxxxxx.default\
f
dg
@

The Firefox browser history is stored in an SQLite database named places.sqlite. There are two
er
vi

database tables that store the history information: moz_places, and moz_historyvisits. The
ja

moz_places tables is a list of each unique URL stored in the database and the moz_historyvisits
table contains a list of each time the browser has visited a URL, regardless of whether the URL has been
accessed multiple times. The records contained in the moz_historyvisits table do not detail the URL
accessed, but instead contain a field place_id that cross-references the moz_places table.

214 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Figure 3.7.6 Firefox Web History artifact sourced from Figure 3.7.7 Firefox Web Visits artifact sourced from
moz_places table moz_places and moz_historyvisits tables

The information from the moz_places table is extracted by AXIOM Process and placed in the WEB
RELATED → Firefox Web History category, as shown in Figure 3.7.6 and the information from the
moz_historyvisits table is extracted by AXIOM Process and placed in the WEB RELATED → Firefox
Web Visits category. The records extracted from the moz_historyvisits table are cross-referenced
with the moz_places table and the DETAILS card lists which records from each table have been used
to compile the artifact, as shown in Figure 3.7.7.

The DETAILS card on the DETAILS pane of an artifact in the Firefox Web History category includes the
20
20

following information:
8/
/2

ARTIFACT INFORMATION
x9
.m
ks

URL The URL visited.

si
en

Last Visited Date/Time

or

The date and time the URL was last visited.

f
dg
@

Title The title of the webpage /tab.

er
vi
ja

Visit Count How many times the URL has been accessed.

Is Typed A Boolean value detailing whether Firefox deems this URL has ever been
Typed. Typed URLs will be covered in more detail in a later section of this
module.

MAGNET AXIOM EXAMINATIONS (AX200) 215

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

EVIDENCE INFORMATION

Source The directory path (including file name) where the artifact was found.

Location The location of the data within the source file or object.
The DETAILS card on the DETAILS pane of an artifact in the Firefox Web Visits category also includes:

ARTIFACT INFORMATION

Transition Type How the browser navigated to the website.

The possible values for the Transition Type are:

TRANSITION_LINK User clicked on a link

TRANSITION_TYPED User typed the URL into the address bar

TRANSITION_BOOKMARK User clicked on a bookmark for the website

TRANSITION_EMBED Content within a webpage was load (this would include

imbedded images)

TRANSITION_REDIRECT_PERMANENT Transition was a permanent redirect

TRANSITION_REDIRECT_TEMPORARY Transition was a temporary redirect

TRANSITION_DOWNLOAD A download link was clicked on

RUNNING EXERCISE
20
20

FIREFOX HISTORY
8/
/2
x9

• Select the WEB RELATED → Firefox Web History category.

.m
ks

• Sort the URL column.

si
en
or

• Highlight the entry Nicknames & Slang for Meth.

f
dg
@

• One of the artifacts has been extracted from the moz_places table and is record id 144.
er
vi
ja

• The other entry comes from the write ahead log (wal) file.

• Click the Source link of the artifact extracted from the places.sqlite file.

• In the File system explorer, double-click the places.sqlite database to open it.

216 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

• View the moz_places table and locate record id 144.

• The record details the URL and Title of the webpage, the Visit Count, and the Last Visited
Date/Time.

• It also includes whether Firefox deems the URL was ever Typed.

• Locate the last_visit_date field and record the content. ______________________________

• Open the DCode utility in the \Tools\ folder on the Desktop.

• In the Value to Decode field, type in the numerical value from the previous step.

• Change the Decode Format to Unix Numeric Value and click Decode .

• The decoded value matches the information displayed in AXIOM Examine.

• Switch to the Firefox Web Visits category.

• Sort by Title and locate the same record Nicknames & Slang for Meth.

• The Location lists the moz_places table record id 144 again.

• It also lists the moz_historyvisits table record id 173.

• Click the Source link again and open the database.

• View the moz_historyvisits table and locate record id 173.

• The place_id field contains 144 – the record just viewed in the moz_places table.
20

HISTORY MICROSOFT INTERNET EXPLORER & EDGE

20
8/
/2
x9

Microsoft Internet Explorer v9 and prior stored their browsing history in Index.dat files stored within
.m
ks

the user profile in the following location:

si
en

\Users\<username>\AppData\Local\Microsoft\History\History.IE5\
f or
dg

Internet Explorer v10 and v11 and Edge browsers store their browsing history data in an Extensible
@

Storage Engine (ESE) database, also commonly known as a Jet Blue database, named
er
vi

WebCacheV01.dat stored in the following location:

ja

\Users\<username>\AppData\Local\Microsoft\Windows\WebCache\
Internet Explorer v10 and v11 and Edge store these histories as separate tables within the
WebCacheV01.dat file. Older versions of Internet Explorer store them in separate Index.dat files
contained within the \History.IE5\ folder detailed above.

MAGNET AXIOM EXAMINATIONS (AX200) 217

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

Internet Explorer creates a new daily history the first time the browser is used after midnight each day. It
contains the browsing history for a 24-hour period from midnight to midnight. The daily histories are
stored in either a folder (older versions of IE) or a table (IE 10-11) named
MSHist01yyyymmddyyyymmdd, where the first date is the start and the second date is the end of
the history period. E.g. MSHist012016101320161014. In this example the daily history file contains
browsing activity from midnight on 13 Oct 2016 to midnight on 14 Oct 2016.
The first time Internet Explorer is used after midnight on a Monday, any daily histories are moved into a
weekly history and the daily histories are either deleted (Index.dat files) or marked as defunct
(WebCacheV01.dat tables). Each weekly history therefore contains browsing history for a seven-day
period from 00:00:00 on Monday to 23:59:59 on Sunday. The weekly histories are also stored in either a
folder or table named using the start and end date of the history period. E.g.
MSHist012016101020161017. In this example the weekly history file contains browsing activity
from midnight on 10 Oct 2016 to midnight on 17 Oct 2016.
Although Internet Explorer v10 and v11 store the history in the WebCacheV01.dat database, they also
store a zero-byte file named container.dat in the relevant daily and weekly folders in place of the old
index.dat file.

The cumulative history is created at the same time as the daily history and is simply stored in the History
folder or table.
NOTE: The date and time information of Internet Explorer Daily and Weekly history is recorded in local
time. The date and time information of Main history is recorded as UTC.

In AXIOM Examine, the three histories from Internet Explorer v10-11 are populated into two WEB
RELATED categories: Internet Explorer v10-11 Main History, and Internet Explorer v10-11
Daily/Weekly History.
20

The three histories from older versions of Internet Explorer are populated into the two WEB RELATED
20
8/

categories: Internet Explorer Main History, and Internet Explorer Weekly History.
/2
x9
.m

As the cumulative main history is created at the same time as the daily history it is not unusual to see
ks

duplicate entries across these two categories Daily/Weekly and Main.

si
en

Edge also stores its browser history in the WebCacheV01.dat stored in the folder:
f or
dg
@

\Users\username\AppData\Local\Microsoft\Windows\WebCache\
er
vi
ja

This is the same database used by Internet Explorer (versions 10 and 11), however there are separate
tables within the database for the Internet Explorer Main, Daily, and Weekly Histories and the Edge
History.
As Edge uses the same database as Internet Explorer v10-11, AXIOM Examine cannot determine whether
the information in the WebCacheV01.dat file has been written by Internet Explorer v10-11 or Edge.

218 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Additionally, Edge does not store Main, Daily and Weekly histories in quite the same way, so all Edge
browsing history is contained within the category WEB RELATED → Internet Explorer v10-11 Main
History. It is therefore the responsibility of the examiner to determine which browser generated artifacts
within this category if entries are of importance to the investigation, and this will be covered during the
practical exercise that follows.

The DETAILS card on the DETAILS pane of an artifact in the Internet Explorer 10-11 Main History
category includes the following information:

ARTIFACT INFORMATION

URL The URL accessed by the browser.

User The local Windows user name.

Accessed Date/Time The most recent visit to the URL.

Page title The title of the webpage /tab.

Access Count It is unclear all the actions that trigger this counter, but it is not necessarily the
number of times the URL has been accessed.

EVIDENCE INFORMATION

Source The directory path (including file name) where the artifact was found.

Location The location of the data within the source file or object.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 219

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

Figure 3.7.8 Edge browser history listed as Internet Explorer 10-11 Main History

RUNNING EXERCISE
INTERNET EXPLORER AND EDGE HISTORY
• Select the WEB RELATED → Internet Explorer 10-11 Main History category.

• Sort the URL column.

• Some of the entries start file:///

• The Internet Explorer history also tracks the Windows Explorer history.

• On the FILTERS bar, run a Search for accounting.csv.

• View the results in the CHAT → Skype Chat Messages category.

• This was the file Dashner sent to Luthor Felix via Skype on 14 Oct 2016 at 00:16:44.

• View the result in the WEB RELATED → Internet Explorer 10-11 Main History category.

• The active user account was dashner .

• Dashner opened this file from his \Documents\Work\Finance\ folder on 14 Oct 2016 at
02:48:25 (UTC).

• The artifact had been extracted from the WebCacheV01.dat database.

• Make a note of the Location information _________________________________________

20

• View the results in the WEB RELATED → Internet Explorer 10-11 Daily/Weekly History
20
8/

category.
/2
x9

• The active user account was again Dashner.

.m
ks

• Two of the artifacts have been extracted from the WebCacheV01.dat database file, the other
si
en

from one of the log files.

f or
dg

• All three entries detail Dashner opened the file from his \Documents\Work\Finance\ folder
@
er

on 13 Oct 2016 at 22:48:25 (Local Time).

vi
ja

• From just the information in the Internet Explorer 10-11 Main History and Internet Explorer
10-11 Daily/Weekly History categories,
computer?
___________________________________________________________________________

220 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

• Make a note of the Location information of the Internet Explorer 10-11 Daily/Weekly
History artifacts extracted from the WebCacheV01.dat
___________________________________________________________________________
___________________________________________________________________________

• Click the Source link to switch to the File system explorer.

• Right-click on the WebCacheV01.dat file, select Save file / folder to, and save the file to
the Desktop.

• When the Files saved message appears in the bottom left of the interface, click OPEN.

• The file is saved to a folder \Saved Files\.

• Start the ESEDatabaseView application in the \Tools\ folder on the Desktop and open the
exported WebCacheV01.dat database file.

• From the drop-down menu, select the Containers table and locate the entry for the table
noted in the previous steps.

• The directory is listed as

C:\Users\dashner\AppData\Local\Microsoft\Windows\History\History.IE5
\

• The table is named History, so this table is a Main or cumulative history.

• Locate the entries for the tables noted in the previous step.

• The directory of the first is listed as

C:\Users\dashner\AppData\Local\Microsoft\Windows\History\
History.IE5\MSHist012016101320161014\
20
20

• The table is named MSHist012016101320161014, so this table is a daily history covering

8/
/2

the period 13-14 Oct 2016.

x9
.m

• The directory of the second is listed as

ks
si

C:\Users\dashner\AppData\Local\Microsoft\Windows\History\
en

History.IE5\MSHist012016101020161017\
f or
dg
@

• And the table is named MSHist012016101020161017.

er
vi
ja

• This table is a weekly history covering the period 10-17 Oct 2016.

• From the database table names, this browser activity has been generated by Internet Explorer
v10 or v11.

• From the drop-down menu, select the table noted in the previous step.

MAGNET AXIOM EXAMINATIONS (AX200) 221

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

• Using the EntryID information, locate the record noted in the previous step.

• Compare the Url information with the data displayed in AXIOM Examine in the Internet
Explorer 10-11 Main History.

• The URL in the database starts Visited: dashner@... . This URL includes the name of the active
Windows user account which AXIOM Process extracts and populates into the User field.

• Switch back to ESEDatabaseView; and from the drop-down menu, select the first table noted in
the previous step and locate the correct record.

• The URL in the database starts 2016101320161014: dashner@... This URL includes the name
of the active Windows user account.

• It also includes the date and time period of the history file the URL was written to in this
instance the daily history for 13 - 14 Oct 2016.

• From the drop-down menu, select the second table noted earlier and locate the correct record.

• Once again, the URL in the database includes the active Windows user account.

• It also contains the date and time period of the history file the URL was written to in this
instance the weekly history for 10-17 Oct 2016.

• Switch back to AXIOM Examine and select the WEB RELATED → Internet Explorer 10-11
Daily/Weekly History category.

• Sort the URL column.

• Scroll down and locate the entries for files accessed from the E:\ drive.

• These entries relate to files that were accessed from an external drive (this will be confirmed in
20

a later lesson).
20
8/
/2

• Select the WEB RELATED → Internet Explorer 10-11 Main History category.
x9
.m

• Invoke a reverse sort on the Access Count column.

ks
si
en

• Highlight the first entry www.omegle.com.

f or
dg

• The Access Count is listed as 2960.

@
er
vi

• This artifact relates to record 72 in table Container_18 of the WebCacheV01.dat file.

ja

• Return to ESEDatabaseView, switch to Container_18, and locate record 72.

• Compare the URL and Access Count with the information displayed in AXIOM Examine.

• The data displayed in AXIOM Examine is correct.

222 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

• Switch to the Containers table and locate the entry for table Container_18.

• The directory is listed as

C:\Users\dashner\AppData\Local\Packages\
microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\Hist
ory\.

• From the directory information, this browser activity was generated by Edge.

• Return to AXIOM Examine and run a search for www.omegle.com across just the WEB
RELATED artifacts.

• All the entries relate to activity that occurred on 5 Oct 2016 between approx. 21:25 and 21:33.

• The entries in the Edge Cache Data and Internet Explorer 10-11 Content categories only
have an Access Count of 1 or 2.

• It is therefore more likely that the website was visited twice, not 2960 times be VERY careful
reviewing Access Count information relating to Edge.

SESSION RECOVERY
Session Recovery files provide the means for a browser to return to the last pages or tabs open. These
are used: in the event of a crash or sudden power loss; to re-open tabs that were accidently closed by the
user; or to re-open any pages still open when the browser was closed if the browser settings are set to
always pick-up where it left off.
These files can provide the examiner with additional useful information as they store evidence of web
20

browsing activity that is stored independent of the normal history artifacts.

20
8/
/2
x9

CHROME
.m
ks

Chrome stores this session recovery information in four files named: Current Session, Current
si
en

Tabs, Last Session, and Last Tabs, which are all stored in the profile folder. Therefore, for the
f or
dg

default profile these files are stored in the following location:

@
er

\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\
vi
ja

The Current Session file lists the tabs that were open during the most recent browsing session. The
Current Tabs file list the tabs that were still open when the browsing session ended. The Last
Session and Last Tabs files relate to the browsing session before the most recent/current one. The

MAGNET AXIOM EXAMINATIONS (AX200) 223

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

content of these files is parsed into the WEB RELATED categories: Chrome Current Session, Chrome
Current Tabs, Chrome Last Session, and Chrome Last Tabs.

The DETAILS card on the DETAILS pane of the artifacts contained in these four categories include the
following information:

ARTIFACT INFORMATION

URL The URL of the webpage.

Last Visited Date/Time The date and time the URL was last visited.

Title The title of the webpage as it appears i /tab.

Visit Count The number of times the browser has accessed the URL.

Redirect URL The URL to use for a redirect, if applicable.

FIREFOX
Firefox stores session recovery information from the most recent browsing session in a file named
sessionstore.js stored in the profile folder. Therefore, for the default profile this file is stored in the
following location:
\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxxxxx.default\
Firefox stores the session recovery information from the previous browsing session in a file is named
previous.js located in a subfolder of the parent profile named \sessionstore-backups\.

In addition to extracting the session recovery information from the sessionstore.js and previous.js
files, AXIOM Process also carves any Firefox session recovery data located in unallocated space and file
20

slack. All the Firefox session recovery artifacts are grouped together in the WEB RELATED → Firefox
20
8/

SessionStore Artifacts category.

/2
x9
.m

The DETAILS card on the DETAILS pane includes the following information:
ks
si

ARTIFACT INFORMATION
en
f or
dg

Title The title of the webpage as it appears /tab.

@
er

URL The URL of the webpage.

vi
ja

Referrer URL The URL of the referring website, if applicable.

NOTE: At the time of writing this manual, session recovery files for the latest versions of Firefox are
not parsed by AXIOM.

224 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

INTERNET EXPLORER AND EDGE

Session recovery files for Internet Explorer and Edge are compound files with a naming convention
{GUID}.dat. This file contains multiple entries known as Travel Logs numbered with a TL0, TL1, etc.

The session recovery files for Internet Explorer are stored in the folder:
\Users\<username>\AppData\Local\Microsoft\Internet Explorer\Recovery\
The session recovery files for Edge are stored in the folder:
\Users\<username>\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb
3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery

The Active session data is stored in a subfolder \Active\, and the last session data is stored in a subfolder
\Last Active\. Additionally, there will sometimes be subfolders named \High\ and \Low\ within the
\Active\ and \Last Active\ folders which relate to elevated security, e.g. Low standard user, and
High administrator.

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

Page URL The URL of the webpage.

Page Title The title of the webpage e bar/tab.

Image The browser generated snapshot of the webpage

Body The HTML body saved from the webpage.

Figure 3.7.9 shows an Edge Last Session artifact. The DETAILS pane includes a PREVIEW card
containing the browser generated Image of the website, as seen by the user.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.7.9 Edge Last Session artifact

MAGNET AXIOM EXAMINATIONS (AX200) 225

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

RUNNING EXERCISES
CHROME SESSION RECOVERY
• Select the WEB RELATED → Chrome Current Tabs category.

• The last time Chrome was open there were six active tabs.

• Locate the Skype My Account entry and note the Location File Offset. _________________

• Click the Source link.

• In the DETAILS pane, scroll down to the TEXT AND HEX card.

• The Chrome session recovery files are a proprietary format with an ASCII file
header.

• Click the Go To link and enter the File Offset noted in the earlier step.

• The information extracted is visible in plain text.

• Switch back to the Artifacts explorer and select the WEB RELATED → Chrome Current
Session category.

• Sort the Last Visited Date column.

• All six entries from the Chrome Current Tabs category are present.

• The other five entries are tabs that were closed during the browsing session.

FIREFOX SESSION RECOVERY

20
20

At the time of this writing, Firefox session recovery files are not parsed by AXIOM.
8/
/2
x9
.m

EDGE SESSION RECOVERY

ks
si
en

• Select the WEB RELATED → Edge Last Session category.

f or
dg

• Sort by Page URL and select the first entry.

@
er
vi

•
ja

This entry was Travel Log number 6.

• The DETAILS pane includes a PREVIEW of the webpage viewed by the user.

• Click the Source link.

• Scroll down to the TEXT AND HEX card.

226 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

• Click Find and search for the Hex values FF D8 FF .

• The snapshot of the webpage is stored as a JPEG picture within the Travel Log.

DOWNLOADS
Most browsers track information regarding file downloads and AXIOM Examine displays this information
in categories specific to each browser.

CHROME
Chrome tracks download activity in the History database file stored in the profile folder. Therefore, for
the default profile this file is stored in the following location:
\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\

The information is contained within two tables: downloads and downloads_url_chains, and the
information from these tables is extracted by AXIOM Process and placed in the WEB RELATED →
Chrome Downloads category,

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

Download Source The source URL of the downloaded file.

File Name The name given to the file when it was saved to the local machine.

Start Time Date/Time The date and time the download started.

End Time Date/Time The date and time the download completed or stopped.
20
20

Saved To
8/

The local path and filename where the file was saved.
/2
x9

State Indicates whether the download completed successfully.

.m
ks

Opened by User
si

Indicates whether the file was opened by clicking the link at the bottom of the
en
or

browser after download completed.

f
dg

Bytes Downloaded
@

The number of bytes of the file downloaded.

er
vi

File Size (Bytes)

ja

The size of the fully downloaded file.

MAGNET AXIOM EXAMINATIONS (AX200) 227

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

FIREFOX
Firefox tracks download activity in the places.sqlite database that stores the browsing history. The file
is stored in the profile folder, so for the default profile this file is stored in the following location:
\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxxxxx.default\

The information is contained within two tables: moz_places and moz_annos, and the information
from these two tables is extracted by AXIOM Process and placed in the WEB RELATED → Firefox
Downloads category,

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

File Name The name given to the file when it was saved to the local machine.

Download Source The source URL of the downloaded file.

Start Date/Time The date and time the download was started.

End Date/Time The date and time the download completed or stopped.

Saved To The local path and filename where the file was saved.

Temp Path The local path and filename where the file was temporarily stored during
download, if applicable.

State Indicates the download status: Download Complete, Download In Progress,

Download Stopped, or Download Paused.

Referrer If the webpage used a mirror for downloading, the path to the original download
20

URL.
20
8/

Bytes Downloaded The number of bytes of the file downloaded.

/2
x9

File Size (Bytes)

.m

The size of the fully downloaded file.

ks
si
en
f or

INTERNET EXPLORER AND EDGE

dg
@

Internet Explorer v10-11 and Edge track download activity in the WebCacheV01.dat file that stores
er
vi

the browsing history. The file is stored in the folder:

ja

\Users\<username>\AppData\Local\Microsoft\Windows\WebCache\

For the same reasons previously discussed during the browser history section, AXIOM Examine displays
download information extracted from both IE v10-11 and Edge in the WEB RELATED → Internet
Explorer 10-11 Downloads category.

228 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

URL The source URL of the downloaded file.

Last Accessed Date/Time The date and time the download URL was last accessed.

Redirect URL The previous URL which led the user to the download URL.

Download Location The local path and filename where the file was saved.

Temp Download Location The local path and filename where the file was temporarily stored during
download. This is usually one of the cache folders.

RUNNING EXERCISES
CHROME DOWNLOADS
• Select the WEB RELATED → Chrome Downloads category.

• Sort the File Name column and highlight the entry for the file wallpaper.jpg .

• The Download Source details the name of the file downloaded as 10wpxaF.jpg .

• The file was downloaded from the website wallpapercave.com .

• The Saved To field details the file was saved to the local machine as wallpaper.jpg in
\Pictures\ folder.

•
20

The download completed successfully, and the file was opened by the user.
20
8/

• Note the Location information of this artifact.

/2
x9

___________________________________________________________________________
.m

___________________________________________________________________________
ks
si

Click the Source link and open the History database file.
en

•
f or
dg

• View the downloads table and locate the record noted in in previous step.
@
er

The Download Source information is not contained in this database record.

vi

•
ja

• Switch to the downloads_url_chains table.

• The id field is a cross-reference to the downloads table.

• Locate the entry that cross-references the downloads table record noted in previous steps.

MAGNET AXIOM EXAMINATIONS (AX200) 229

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

• Is it the same record as noted in previous steps? __________________________________

• This is the Download Source.

FIREFOX DOWNLOADS
• Switch back to the Artifacts explorer and select the WEB RELATED → Firefox Downloads
category.

• Sort by File Name and highlight the entry RuneScape-Setup.exe .

• The Download Source details the originating URL of the download.

• \Downloads\ folder and completed successfully.

• Note the Location information of this artifact.

___________________________________________________________________________
___________________________________________________________________________

• Click the Source link and open the places.sqlite database file.

• View the moz_places table and locate the record noted.

• The only information obtained from this table is the Download Source.

• Notice the visit count is zero. Firefox does not use this field for downloads.

• Switch to the moz_annos table.

• The place_id field is a cross-reference to the moz_places table.

• Locate the entries that cross-reference the moz_places table record noted.
20

• Notice the field anno_attribute_id.

20
8/
/2

• This field is a cross-reference to the moz_anno_attributes table.

x9
.m
ks

• Note the anno_attribute_id of the records viewed ________________________

si
en
or

• Switch to the moz_anno_attributes table and locate the attributes identified earlier.
f
dg
@

• This provides a description of the records in the moz_annos table.

er
vi
ja

• Switch back to the moz_annos table and confirm the attribute descriptions are correct.

EDGE DOWNLOADS
• Switch back to the Artifact explorer and select the WEB RELATED → Internet Explorer 10-11
Downloads category.

230 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

• Highlight the entry bandcamp.com .

• The URL details the source of the download.

• The Download Location details where the file was ultimately stored on the local machine.

• The Temporary Download Location details the file was stored in one of the cache folders
during the download process.

• Note the Location information of this artifact.

___________________________________________________________________________

• Switch back to ESEDatabaseView. If it is no longer running, re-open it from the \Tools\ folder
on the desktop and open the previously extracted WebCacheV01.dat file.

• View the Containers table and locate the record noted previously.

• The Directory information details this as the \DownloadHistory\ folder within the Edge
package folder, so this file was downloaded using Edge.

• From the drop-down menu, select the table Containers.

• The URL field simply contains a GUID.

• The information relating to the download is included within the Response Headers field.

• Double-click the database record to open the Properties window and copy the data from the
Response Headers field.

• Open an online Hex to Text Converter.

• Paste in the copied response header data and convert it.

20
20

• It contains the information populated into the artifact.

8/
/2
x9

• Be aware that ESEDatabaseView truncates this field if the information is too long and it could be
.m

incomplete.
ks
si
en
or

BOOKMARKS
f
dg
@
er

Bookmarks, or Favourites, are used to mark websites for later return. They are often used for sites that
vi
ja

are visited most frequently, or sites for which a user might need to quickly return. Every browser can
create bookmarks, and these can provide useful information from an investigative standpoint. Most
browsers can also save bookmarks in a tree-like structure within the bookmark folders.

MAGNET AXIOM EXAMINATIONS (AX200) 231

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

CHROME
Chrome stores its bookmarks in a plain text file named Bookmarks. The file is stored in the profile
folder, so for the default profile the file is stored in the following location:
\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\

Figure 3.7.10 Chrome Bookmarks

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

URL The URL the bookmark points to.

20
20

Added Date/Time The date and time the bookmark was added to Chrome.
8/
/2
x9

Name The name of the bookmark or bookmark folder as it appears in Chrome.

.m
ks

Parent The parent bookmark folder in which the bookmark is located if applicable.
si
en
or

Type Indicates whether the artifact is a URL or a parent folder.

f
dg
@
er
vi
ja

FIREFOX
Firefox stores Bookmarks in the places.sqlite database that stores the browsing history. This file is
stored in the profile folder, so for the default profile the file is stored in the following location:
\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxxxxx.default\

232 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

The information is contained within the tables: moz_places and moz_bookmarks.

Figure 3.7.11 Firefox Bookmarks

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

URL The URL the bookmark points to.

Date Added Date/Time The date and time the bookmark was added to Firefox.

Last Modified Date/Time The date and time the bookmark was last modified.
20

Title The name of the bookmark or bookmark folder as it appears in Firefox.

20
8/

Bookmark Type Indicates whether the artifact is a Bookmark Item (URL) or a Bookmark
/2
x9

Folder.
.m
ks
si
en
or

INTERNET EXPLORER AND EDGE

f
dg
@

Internet Explorer and Edge browsers refer to bookmarks as Favorites. Internet Explorer stores Favorites
er
vi

as individual files in the following location:

ja

\Users\<username>\AppData\Favorites\

The content of this folder and any subfolders is reflected in the Bookmarks within Internet Explorer, so if
the user creates a bookmark folder within Internet Explorer, the folder is also created within the
\Favorites\ folder on the disk.

MAGNET AXIOM EXAMINATIONS (AX200) 233

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

Edge stores Favorites in two possible locations. Early versions of the browser stored Favorites in the
folder:
\Users\<username>\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb
3d8bbwe\AC\MicrosoftEdge\User\Default\Favorites

Favorites that were migrated to Edge from Internet Explorer upon initial installation might also be found
here.
Later versions of Edge moved the Favorites to an ESE database named spartan.edb that is stored in
the following location:
\Users\<username>\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb
3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-
0049\DBStore

The entries are stored within the database in a table named Favorites.

The DETAILS card on the DETAILS pane for artifacts in the Internet Explorer Favorites category
includes the following information:

ARTIFACT INFORMATION

Favorite Name The name of the favorite as it appears in Internet Explorer.

URL The URL the favorite points to.

Modified Date/Time The date and time the favorite was last modified.

User The user to whom the favourite belongs.

20

Favorites Root Location

20

The local path that is the root storage point for the favorite.
8/
/2

Folder Structure The folder structure under which the favorite will appear in Internet
x9
.m

Explorer.
ks
si

Icon URL
en

The URL of the icon displayed next to the favorite if an icon exists.
f or
dg
@

RUNNING EXERCISE
er
vi
ja

CHROME BOOKMARKS
• Select the WEB RELATED → Chrome Bookmarks category.

• Sort the Parent column.

234 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

• There are three Bookmark folders present on the Bookmarks bar.

• Each containing Bookmarked URLs.

• Highlight the entry Trending News | theScore.com that is in the Sports folder.

• Click the Source link.

• The Trending News entry can clearly be seen near the top of the PREVIEW pane for the
Bookmarks file.

• In the DETAILS pane, scroll down to the TEXT AND HEX card and switch the View to TEXT .

• Click FIND and search for the Text string date_added .

• Highlight the numerical value that follows the date_added string.

• Change the View back to HEX and scroll down to the DECODE card.

• Locate the DATE / TIME section.

• Confirm the content of the Chrome field matches the information displayed by AXIOM Examine.

FIREFOX BOOKMARKS
• Select the WEB RELATED → Firefox Bookmarks category.

• Sort the Title column and highlight the entry Learn more about Tor .

• The URL is listed as torproject.org and it is a Bookmark Item.

• This file has been extracted from a places.sqlite file, but it is not in the same location as the
20
20

database viewed during previous sections of this lesson.

8/
/2

• The information has been extracted from the same tables as Firefox: moz_places, and
x9
.m

moz_bookmarks.
ks
si
en

• This Bookmark is associated with an installation of Tor Browser not Firefox.

f or
dg

• Tor Browser uses a modified version of Firefox, but AXIOM associates a places.sqlite file with
@
er

Firefox, so these artifacts are placed in the Firefox categories.

vi
ja

• Run a Search for torproject across just the WEB RELATED artifacts.

• At approx. 19:00 on 16 Sept 2016 Chrome was used to access the website www.torproject.org.

• At approx. 19:01 Chrome was used to download the Tor Browser installer.

MAGNET AXIOM EXAMINATIONS (AX200) 235

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

• At approx. 19:04 Bookmarks relating to Tor were created. These artifacts are listed within the
Firefox Bookmarks category, but the Source indicates they are actually associated with an
installation of Tor Browser.

• The Visit Count in the Firefox Web History indicates the sites were never visited. These are
default bookmarks added by Tor Browser during installation.

• Clear all filters.

COOKIES
Cookies are small files saved onto a local browsing machine by websites. The user might not have
actually visited the website for which a cookie is present, another related website could have saved it to
the local machine.
Cookies can store information about the user, their browsing activity, account information, and more.
CHROME
Chrome stores its cookies in an SQLite database named Cookies stored in the profile folder. Therefore,
for the default profile this file will be stored in the following location:
\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\

The information is contained within the table: cookies.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.7.12 Chrome Cookies

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

236 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Host The host domain of the cookie.

Name The name of the cookie.

Value The value contained in the cookie.

Accessed Date/Time The date and time the cookie was last accessed.

Created Date/Time The date and time the cookie was created.

Expiration Date/Time The date and time the cookie expires.

Path The path of the cookie value.

FIREFOX
Firefox stores cookies in an SQLite database named cookies.sqlite stored in the profile folder.
Therefore, for the default profile the file is stored in the following location:
\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxxxxx.default\

The information is contained within the table: moz_cookies.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.7.13 Firefox Cookies

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

MAGNET AXIOM EXAMINATIONS (AX200) 237

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

Host The host domain of the cookie.

Name The name of the cookie.

Value The value contained in the cookie.

Accessed Date/Time The date and time the cookie was last accessed.

Created Date/Time The date and time the cookie was created.

Expiration Date/Time The date and time the cookie is set to expire.

Path The path of the cookie value.

INTERNET EXPLORER
Internet Explorer stores cookie data as individual files on the local machine. Windows 7 and prior stored
the cookie files in the folder:
\Users\<username>\AppData\Roaming\Microsoft\Windows\Cookies\

In Windows 8 the Cookies moved to the folder:

\Users\<username>\AppData\Local\Microsoft\Windows\INetCookies\

As with other Internet Explorer artifacts, there might also be a \Low\ folder present that relates to
browser activity generated when the browser was started with standard, rather than elevated, privileges.
In early version of Internet Explorer cookie files were named user@hostname.txt e.g.
dashner@gmail.txt. However, Microsoft recognized that in the event of a system breach, extensive
useful information could be gained from cookie files and the format changed to a randomly generated 8-
character alphanumeric value e.g. LG1FD45A.txt.
20
20
8/

Internet Explorer v10 and v11 store the information about the cookie (cookie metadata) and the cookie
/2
x9

content in two different locations.

.m
ks

The cookie metadata information is contained within the WebCacheV01.dat file located in the folder:
si
en

\Users\<username>\AppData\Local\Microsoft\Windows\WebCache\
f or
dg
@

It contains information such as: when the cookie was created, last accessed, expires etc. It also contains
er

the name of the individual cookie content file that is stored on the disk.
vi
ja

The individual cookie content file is stored in the folder:

\Users\<username>\AppData\Local\Microsoft\Windows\INetCookies\

These cookie files are also named using a randomly generated 8-character alphanumeric value but can
have either a .txt or .cookie extension.

238 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

The DETAILS card on the DETAILS pane of artifacts in the Internet Explorer Cookies category include
the following information:

ARTIFACT INFORMATION

Host The host domain of the cookie.

Name The name of the cookie.

Value The value contained in the cookie.

Created Date/Time The date and time the cookie was created.

Expiration Date/Time The date and time the cookie expires.

Flags Any flags associated with the cookie.

The DETAILS card on the DETAILS pane of artifacts in the Internet Explorer 10-11 Cookies category
include the following information:

ARTIFACT INFORMATION

User The Windows user associated with the cookie.

URL The host domain of the cookie.

Accessed Date/Time The date and time the cookie was last visited.

Updated Date/Time The date and time the cookie was last updated by the host domain.

Created Date/Time The date and time the cookie was created.

Access Count As with the browsing history, it is unclear all the actions that trigger this
20

counter, but it is not necessarily the number of times the cookie has been
20
8/

accessed.
/2
x9

Filename The name, including the full path, of the cookie content file.
.m
ks

File Size
si

The size of the cookie.

en
f or
dg
@

EDGE
er
vi
ja

Edge also stores the cookie metadata information in the WebCacheV01.dat file located in the folder:

\Users\<username>\AppData\Local\Microsoft\Windows\WebCache\

The Edge cookie content files also have the name format xxxxxxxx.txt or xxxxxxxx.cookie and
are either stored in the folder:

MAGNET AXIOM EXAMINATIONS (AX200) 239

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

\Users\<username>\AppData\Local\Packages\microsoft.microsoftedge_8wekyb
3d8bbwe\AC\MicrosoftEdge\Cookies\

Or subfolders within the same package, but with a number in the folder name. e.g.
\Users\<username>\AppData\Local\Packages\microsoft.microsoftedge_8wekyb
3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\

\Users\<username>\AppData\Local\Packages\microsoft.microsoftedge_8wekyb
3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\

Other applications can also store cookies including: Windows Store, Windows Photos, Office Hub, Skype,
and Cortana.
As with other artifacts extracted from the WebCacheV01.dat file, Edge cookies are listed under the
Internet Explorer 10-11 cookie category.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg

Figure 3.7.14 Edge cookie located in the Internet Explorer 10-11 Cookies category
@
er
vi
ja

GOOGLE ANALYTICS
Google Analytics is a service offered by Google to provide a means for websites to track visitor activity in
a more detailed manner. This tracking is accomplished using special multi-part cookies. AXIOM Process
identifies cookies containing Google Analytics information, extracts the component parts and compiles
them into three REFINED RESULTS categories: Google Analytics First Visit Cookies, Google

240 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Analytics Referral Cookies, and Google Analytics Session Cookies. AXIOM Process also carves
Google Analytics cookies from other areas and AXIOM Examine displays them within the WEB RELATED
category.
NOTE: Although separated into different categories within AXIOM Examine, the Google Analytics
cookie components: First Visit, Referral, and Session, are actually part of the same cookie file.

FIRST VISIT COOKIES

The First Visit cookie tracks how many times the website has been visited and records the two most
recent visits.

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

Host The Host domain of the website.

Creation Date/Time The date and time the cookie was created on the local machine.

Most Recent Visit Date/Time The date and time of the most recent session.

2nd Most Recent Visit Date/Time The date and time of the 2nd most recent session.

Hits Number of times the website has been visited.

Original Artifact The artifact category from which this refined result was compiled.
20
20
8/
/2
x9
.m
ks
si
en
or

Figure 3.7.15 Google Analytics First Visit Cookie

f
dg
@

SESSION COOKIES
er
vi
ja

The Session cookie tracks information regarding the activity during a browsing session on the website.

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

Host The Host domain of the website.

MAGNET AXIOM EXAMINATIONS (AX200) 241

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

Page Views The number of pages within the website that have been loaded.

Start Current Session Date/Time The date and time the user started browsing the website.

Outbound Link Events Left The number of remaining Outbound links from the website. This
value usually starts at 10.

Original Artifact The artifact category from which this refined result was compiled.

Figure 3.7.16 Google Analytics Session Cookie

REFERRAL COOKIES
The Referral cookie indicates how the web browser arrived on the website.

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

Host The Host domain of the website.

Last Update Date/Time The date and time the cookie was last updated.
20

Campaign How the browser arrived at the Host webpage:

20
8/

Direct the website was accesses directly by the user.

/2
x9

Organic the user selected a search engine result.

.m

Referral the user selected a link from another website (not a search
ks

engine).
si
en

Access Method How the website was accessed (usually the same as campaign)
f or
dg
@
er
vi
ja

242 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Figure 3.7.17 Google Analytics Referral Cookie

RUNNING EXERCISE
CHROME COOKIES
• Select the WEB RELATED → Chrome Cookies category.

• Sort the Name column

• Select the first entry myvikingsrewards.com.

• The Source details the cookie was parsed from the Cookies database file.

• The Location details the table name and entry.

FIREFOX COOKIES
• Select the WEB RELATED → Firefox Cookies category.
20

• Sort the Name column

20
8/
/2

• Select the first entry fbcoverlover.com.

x9
.m

The Source details the cookie was parsed from the cookies.sqlite database file.
ks

•
si
en

• The Location details the table name and entry.

f or
dg

INTERNET EXPLORER COOKIES

@
er
vi

• Select the WEB RELATED → Internet Explorer Cookies category.

ja

• Filter the Host column fo omeonewhocares

• Sort by the Name.

• Each entry points to a different offset in the same Cookie file.

MAGNET AXIOM EXAMINATIONS (AX200) 243

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

• Each Name starts __utm. This is the Google Analytics cookie identifier.

• From the Source field, note the name of the cookie file.
__________________________________________________________________________

• Clear the filters, then select the REFINED RESULTS → Google Analytics First Visit Cookies
category.

• Reverse sort by Host and locate the entry for .

• This is the same cookie file as noted previously.

• Clear all filters.

INTERNET BROWSER CACHE

The browser cache is a temporary storage location on the local machine/device. It is used by the browser
to store the component parts of a website that has been visited by the user. These files could include:
html files, JavaScripts, cascading style sheets (CSS), as well as pictures and other multimedia content.
Each time a website is visited, the browser checks to see if the site has been accessed before, and if it
has, it checks with the Host to ascertain if any content has been updated since the last visit. The browser
only downloads files that have either been updated since the last visit or are not already stored in the
cache. The purpose of the cache is to reduce network bandwidth usage which reduces the speed at which
a webpage will load.

CACHE CHROME
Chrome stores its cache in three different folder locations, all of which are located in the user profile
20

folder. Therefore, for the default profile the cached content is stored in the following locations:
20
8/

\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\Cache\
/2
x9
.m

\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\GPUCache\
ks
si

\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\Media Cache\

en
f or
dg

Which folder a cached component is stored into is dependent on the content. Large media files such as
@

video and audio are saved to the \Media Cache\ folder; data that can
er
vi

processing unit are saved to the \GPUCache\ folder; and everything else, such as html files, javascripts,
ja

style sheets, and small graphics, are saved to the \Cache\ folder.

Each cache folder contains an index file and four block files named data_0, data_1, data_2 and
data_3.

244 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Figure 3.7.18 Sample Chrome cache folder

When a webpage component is stored in the cache, metadata information about the file is also stored.
This metadata can include: the host site, URL, the HTTP response, and when the file should expire and be
deleted from the cache. The file content and its metadata are stored as two separate components;
however, both are stored within the same cache folder. Therefore, if a video file is saved to the cache both
the file content and \Media Cache\ folder.

If the data to be saved, whether that be the file content itself or its metadata, is less than 16384 bytes in
size it will be saved into one of the block files. Which block file the data is saved into is dependent on the
size of the data as per Table 3.7.1.
Block File Size of file content or metadata
data_0 Between 0 and 144 bytes.
data_1 Between 144 and 1024 bytes.
data_2 Between 1024 and 4096 bytes.
data_3 Between 4096 and 16384 bytes.
Table 3.7.1 Chrome cache block file data allocation

If the data to be saved is larger than 16384 bytes it is saved into an individual file named f_0000xx where
xx is a hex value that simply increases by 1 for each new file written to the cache folder.
Consequently, small files, such as png or gif files, are usually stored within one of the block files; most
20

large media files, such as videos, are stored as individual f files; and most file metadata is found in the
20

data_1 block file.

8/
/2

The index file within the same cache folder stores the cross-
x9
.m

and its metadata.

ks
si

Because the file content and metadata are tracked independently AXIOM Examine displays two
en
or

EVIDENCE INFORMATION sections. The first details the Source and Location information of the
f
dg

metadata component. The second details the Source and Location for the data content of the cached
@
er

file. The example shown in Figure 3.7.19 is a small PNG file which has been saved to the \Cache\ folder.
vi
ja

The metadata information is stored in the data_1 block file so, from Table 3.7.1, must be between 144
and 1024 bytes in size. The actual PNG file content is stored in the data_3 block file so, from Table 3.7.1
must be between 4096 and 16384 bytes in size. Reviewing the Content Size (Bytes) in the ARIFACT
INFORMATION confirms the file size is 5969 bytes.

MAGNET AXIOM EXAMINATIONS (AX200) 245

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

Figure 3.7.19 Chrome Cache Records

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION
20
20

URL The URL of the cached item.

8/
/2
x9

First Visited Date/Time The date and time the URL was first visited.
.m
ks

Last Visited Date/Time

si

The date and time the URL was last visited.

en
or

Last Synced Date/Time

f

The date and time the cached item was last synced with the website.
dg
@

File Type
er

The type of file that was cached.

vi
ja

Content Size (Bytes) The size of the cached item in bytes.

246 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

RUNNING EXERCISE
CHROME CACHE
• Select the WEB RELATED → Chrome Cache Records category.

• Right-click the title of the Content Size (Bytes) column and select Filter on column.

• This column contains numerical information so the filter that can be applied is: A range, Equal
to, Less than or equal to, or More than or equal to.

• Select A range, and filter for files between 1500 and 2000 bytes in size.

• Sort the Content Size (Bytes) column and locate the PNG file that is 1702 bytes in size.

• This is a picture, so the DETAILS pane includes a PREVIEW of the file.

• The first EVIDENCE INFORMATION details the metadata is stored in the block file data_1 at
offset 242944. So, the metadata must be less than 1024 bytes in size.

• The size of the cached file is between 1024 and 4096 bytes. As expected, the second EVIDENCE
INFORMATION details file content is stored in the block file data_2 and it can be found at
offset 102400.

• Both the metadata and the file content are stored in the \Cache\ folder.

• Click the Location link for the file content (in the second EVIDENCE INFORMATION).

• AXIOM Examine switches to the File system explorer with the data_2 file highlighted.

• In the TEXT AND HEX card of the DETAILS pane, the curser is at offset 102400.
20
20

•
8/

The PNG file header can clearly be seen at this offset.

/2
x9

• Switch back to the Artifact explorer and clear the filter.

.m
ks
si

• Scroll down and locate the PNG file that is 108122 bytes in size.
en
f or

• The metadata is again located in the block file data_1, this time at offset 78592.
dg
@
er

• The size of the cached file is 108122 bytes, which is greater than 16384, so the file content has
vi
ja

been saved to an individual f file f_000006.

• This cached file and its metadata were also saved to the \Cache\ folder.

• From the Artifacts drop-down on the FILTERS bar, filter for just the MEDIA categories and the
Chrome Cache Records.

MAGNET AXIOM EXAMINATIONS (AX200) 247

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

• Then run a search for the keyword \Cache\ ensuring you put a backslash at both the beginning
and end.

• Select the MEDIA → Pictures category and sort the Size (Bytes) column.

• Both the pictures previously viewed in the Chrome Cache Records category are also present
in the MEDIA → Pictures category.

• Clear all filters.

• Select the WEB RELATED → Chrome Cache Records category again.

• Sort by the First Visited Date/Time.

• Select the second entry 23 Aug 2016 17:29:15.

• This is a cached video file.

• The DETAILS pane includes a playable PREVIEW card.

CACHE FIREFOX
Roaming profile, but the Firefox
Local profile. For the default Firefox profile, the cache is located at:
\Users\<username>\AppData\Local\Mozilla\Firefox\Profiles\xxxxxxxx.default\
cache2\
This folder contains a file named index, and two subfolders: \entries\, and \doomed\. The index
includes information such as: when each cached file was written into the cache, and when it will expire.
The \entries\ folder contains the cached files themselves and the \doomed\ folder contains expired
20
20

cached content that is usually deleted by Firefox when the browser closes or the next time it restarts.
8/
/2

Rather than store the file content and the metadata separately as Chrome does, Firefox appends the
x9
.m

metadata information to the end of the cached file. The last 4 bytes of the file are a big-endian integer
ks

value that details the size of the cached content, and therefore where the metadata content starts within
si
en

the logical file. In the Artifact explorer, the Content Size (Bytes) field details the size of the cached
or

content only. It is NOT the size of the file stored in the Firefox cache folder on the disk/device. The logical
f
dg

file in the cache as displayed in the File system explorer also contains the metadata information so will
@
er

always be larger. AXIOM Process extracts the metadata information from the file and displays it in the
vi
ja

DETAILS pane in the Artifacts explorer.

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

248 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

URL The URL of the cached item.

Date Created Date/Time The date and time the file was written to the cache.

MIME Type The MIME type of the cached item.

Content Size (Bytes) The size of the cached item in bytes (content only, not the metadata).

Figure 3.7.20 shows the DETAILS card of a Firefox Cache Records artifact as displayed in the Artifacts
explorer. The Content Size (Bytes) is listed as 9551 bytes and it is a JPEG file.

20
20
8/
/2

Figure 3.7.20 Firefox Cache Record displayed in the Artifacts explorer

x9
.m

Figure 3.7.21 shows the same file viewed in the File system explorer. The size of the logical file is
ks
si

12822 bytes and the two bytes at offsets 9549 and 9550 (the last 2 bytes of the cached file) are the FF
en
or

D9 JPEG footer.
f
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 249

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

Figure 3.7.21 Firefox Cache Record displayed in the File system explorer

RUNNING EXERCISE
FIREFOX CACHE
• Select the WEB RELATED → Firefox Cache Records category.

• Filter the MIME Type column for jpeg .

• Filter the Content Size (Bytes) column for files between 5000 and 7000 bytes.

• Sort by the Content Size (Bytes).

•
20

All the results are jpeg pictures between 5000 and 7000 bytes in size.
20
8/

• Highlight the first entry.

/2
x9

The URL of this cached file is http://i.ebayimg.com/thumbs/images/g/ozsAAOSwpzdWrKLW/s-

.m

•
ks

l140.jpg
si
en
or

• It was saved to the cache on 21 Sept 2016 at 20:27:34.

f
dg
@

• A copy of the picture is also displayed in the PREVIEW card of the DETAILS pane.
er
vi
ja

• Note the Content Size (Bytes) information. _________________________________

• Click the Source link.

• The logical size of the file stored in the cache is 7386 bytes.

250 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

• In the DETAILS pane, scroll down to the TEXT AND HEX card.

• Click GO TO and enter the Content Size (Bytes) as 7386.

• The Metadata information starts immediately after the JPEG footer.

• On the TEXT AND HEX card, switch the View to TEXT .

• Scroll down and locate the URL information.

• Highlight the URL including the colon immediately preceding it.

• The Current offset should be 6753; and

• The Current selection should be 65.

• Right-click and select Copy selection to copy the highlighted data.

• Open the HashCalc utility in the \Tools\ folder on the Desktop.

• Ensure the Data Format is set to Text String .

• Paste the copied URL into the Data field and click Calculate .

• The name of the file stored in the cache is derived from the SHA1 hash of the URL.

• Return to the Artifacts explorer and clear all filters.

CACHE EDGE
Edge stores the metadata information and a cross reference to the cached file itself in the
20

WebCacheV01.dat file located in the folder:

20
8/

\Users\<username>\AppData\Local\Microsoft\Windows\WebCache
/2
x9
.m

The cached files themselves are stored in the following folder location, where xxxxxxxx is a randomly
ks
si

named subfolder:
en
or

\Users\<username>\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb
f
dg

3d8bbwe\AC\MicrosoftEdge\Cache\XXXXXXXX\
@
er
vi

Or subfolders within the same package, but with a number in the folder name. e.g.
ja

\Users\<username>\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb
3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XXXXXXXX\

MAGNET AXIOM EXAMINATIONS (AX200) 251

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

Figure 3.7.22 shows an Edge Cache Data artifact. The EVIDENCE INFORMATION details the table
and record within the WebCacheV01.dat file that contains the metadata information of the cached
file. The Original Path details where the file is saved on disk.

Figure 3.7.22 Edge Cache Records

The DETAILS card on the DETAILS pane includes the following information:
20
20

ARTIFACT INFORMATION
8/
/2
x9

URL The URL of the cached item.

.m
ks

Creation Date/Time The date and time the cached data was saved to the local machine.
si
en
or

Last Modified Date/Time The date and time the cached item was last modified on the source side.
f
dg
@

File Type The file type of the cached item.

er
vi
ja

Visit Count The number of times the cached file has been accessed.

Content Size (Bytes) The size of the cached file in bytes.

Original Path The original absolute path to the cached file.

252 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Relative Path The relative path to the file based on the location of the WebCacheV01.dat
database file.

RUNNING EXERCISE
EDGE CACHE
• Select the WEB RELATED → Edge Cache Data category.

• Reverse Sort the Content Size (Bytes) column.

• Select the artifact that is 348079 bytes in size.

• On the DETAILS pane, the PREVIEW card displays a preview of the picture.

• The ZOOM details it is not being displayed full size.

• Click the picture in the PREVIEW card.

• AXIOM Examine attempts to display the picture full size.

• Click the Source link in the DETAILS Card.

• In the File system explorer, right-click the highlighted WebCacheV01.dat file, and select
View related artifacts.

• AXIOM Examine automatically switches back to the Artifacts explorer and applies a filter to
display all the artifacts sourced from the WebCacheV01.dat database.

• Clear all filters.

20
20
8/
/2

TYPED URLS
x9
.m
ks

CHROME AND FIREFOX

si
en
or

Typed URLS need to be treated with a little caution. In the past, this field indicated when a URL had been
f
dg

typed (or copied/pasted) directly into the address bar of the browser. However, things are slightly more
@

complicated now. If the user starts typing into the address bar, whether that be a URL or simply a search
er
vi

string, the browser will often provide autosuggestions for the user. If the user accepts one of these
ja

autosuggestions this will also appear as a Typed URL. This field does not necessarily mean the user has
typed the URL directly into the address bar, it is more accurate to say that the user typed something into
the address bar.
Chrome stores Typed URLs in the History database, which for the default profile is located at:

MAGNET AXIOM EXAMINATIONS (AX200) 253

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\

Firefox stored Typed URLs in the places.sqlite database, which for the default profile is located at:

\Users\<username>\AppData\Local\Mozilla\Firefox\Profiles\xxxxxxxx.default\

AXIOM Examine displays this information in the respective Web History and Web Visits categories.
Chrome stores a numerical counter of how many times Chrome deems the URL was typed, as shown in
Figure 3.7.23.

Figure 3.7.23 Chrome Typed URL

20
20
8/

Firefox stores a Boolean Yes/No value detailing whether Firefox deems the URL has ever been typed, as
/2

shown in Figure 3.7.24.

x9
.m
ks
si
en
f or
dg
@
er
vi
ja

254 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Figure 3.7.24 Firefox Typed URL

INTERNET EXPLORER AND EDGE

Internet Explorer and Edge both track Typed URLs in the user registry.
Internet Explorer tracks Typed URLs in the main user registry hive NTUSER.dat, that is stored in the
following location:
\Users\<username>\

The information is stored in the following 2 registry keys:

SOFTWARE\Microsoft\Internet Explorer\TypedURLs\
SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\
20
20
8/
/2

UsrClass.dat, that is stored in the

x9

Edge tracks Typed URLs in the supplementary user registry hive

.m

following location:
ks
si
en

\Users\<username>\AppData\Local\Microsoft\Windows\
f or
dg

The information is stored in the following 3 registry keys:

@
er

LocalSettings\Software\Microsoft\Windows\CurrentVersion\AppContain
vi
ja

er\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Typ
edURLs

LocalSettings\Software\Microsoft\Windows\CurrentVersion\AppContain
er\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Typ
edURLsTime

MAGNET AXIOM EXAMINATIONS (AX200) 255

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

LocalSettings\Software\Microsoft\Windows\CurrentVersion\AppContain
er\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Typ
edURLsVisitCount

RUNNING EXERCISE
CHROME TYPED URLS
• Select the WEB RELATED → Chrome Web History category.

• Reverse sort the Typed Count column.

• The URL http://gmail.com has a Typed Count of 3 and a Visit Count of 4.

• The Last Visited Date/Time is 07 Oct 2016 at 17:33:53.

• Select the WEB RELATED → Chrome Web Visits category and sort by the Date Visited
Date/Time.

• Filter the URL column for http://gmail.com .

• The first three entries all have a Transition Type of TYPED. So, these are the three entries
Chrome deems were Typed URLs.

• The fourth entry has a Transition Type of AUTO_BOOKMARK, so the user selected an entry
from the user interface.

• The Typed Count for all four entries is 3. The Typed Count information is extracted from the
single entry in the urls table which is being cross-referenced by each of the four entries in the
visits table. It is NOT a running total, it is the total number of times the browser deems the URL
20

has been TYPED.

20
8/
/2

•
x9

Clear all filters.

.m
ks
si

FIREFOX TYPED URLS

en
or

• Select the WEB RELATED → Firefox Web History category.

f
dg
@
er

• Reverse sort the Is Typed column.

vi
ja

• The Is Typed field of the logon URL http://play.clubpenguin.com/#/login is Yes.

• Switch to the WEB RELATED → Firefox Web Visits category and sort the Date Visited
Date/Time column.

256 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

• Filter the URL column for clubpenguin.com/# .

• The first time the login page was accessed the Transition Type was TRANSITION_LINK.

• The second time the login page was accessed the Transition Type was TRANSITION_TYPED.

• Both login pages have an Is Typed status of yes. The Is Typed information is extracted from
the single entry in the moz_places table which is being cross-referenced by both entries in the
moz_historyvisits table. It is a field that records whether the URL has ever been typed. As
soon as Firefox deems the URL was typed this field updates to yes, and AXIOM Examine will
then display yes for all the entries cross-referencing this URL in the database. The Transition
Type field accurately details whether on each occasion Firefox deems the URL was typed.

• Clear all filters

INTERNET EXPLORER TYPED URLS

• Switch to the WEB RELATED → Internet Explorer Typed URLs category and sort by
Source.

• Highlight the entry parsed from \Users\dashner\NTUSER.DAT and click the Location
link.

• Expand the NTUSER.DAT file and navigate to the key:

SOFTWARE\Microsoft\Internet Explorer\TypedURLs\

• There is only registry value listed url1.

• It is a Typed URL for microsoft.com .

20

• Navigate to the next key down

20

SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\
8/
/2
x9

• Each registry value listed in the TypedURLs key has a corresponding value in the
.m
ks

TypedURLsTime key.
si
en

•
or

The value url1 contains the data 0 indicating this URL has never been typed.
f
dg
@

• This Typed URL is a default added by Windows during installation.

er
vi
ja

EDGE TYPED URLS

• Scroll back up to the User hives and collapse the NTUSER.DAT file.

• Expand the supplementary user hive UsrClass.dat ensure you have selected the one from

MAGNET AXIOM EXAMINATIONS (AX200) 257

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

the folder \Users\Dashner\, not the one from the \windows.old\ folder.

• Navigate to the key:

Local Settings\Software\Microsoft\Windows\
CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8we
kyb3d8bbwe\MicrosoftEdge\TypedURLs\

• These are the URLs that Edge deems were typed.

• The value url3 relates to the URL http://gmail.com . Switch to the TypedURLsTime key
and highlight the corresponding value.

• The content of the Data field is a 64bit Windows date and time.

• In the HEX card on the DETAILS pane, highlight all 8 bytes of data.

• Scroll down to the DECODE card and locate the DATE / TIME section.

• This is the date and time Edge deems the user typed the URL.

• Switch to the TypedURLsVisitCount key and highlight the corresponding value.

• Edge deems the URL http://gmail.com was typed 3 times.

• Return to Artifacts explorer

FORM FILL INFORMATION AND SEARCH DATA

Most browsers provide a means to store form information that would commonly be used to fill in basic
information on multiple websites, such as name, phone number, address, etc.
20
20

Additionally, searches executed using the browser search box, or a search function on a website, will
8/
/2

sometimes be stored as form information.

x9
.m
ks
si
en

CHROME
f or
dg

Chrome refers to form data as Autofill values and saves them in an SQLite database named Web Data
@

stored in the profile folder. Therefore, for the default profile this file will be found in the following location:
er
vi
ja

\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\

The information is contained within the table: autofill.

258 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Figure 3.7.25 Chrome Autofill

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

Name Name of the autofill field (email, address, etc.).

Date Created Date/Time The date and time the autofill value was created.

Value The autofill value stored in the database.

Count The number of times the autofill value has been used/accessed.

In the example shown in Figure 3.7.25 the autofill Value stored in the Web Data database is
isaih.dashner and has a Count of 1. This Value contains a Chrome
it does not matter, that is what the user typed and therefore Chrome saved it into the database as is.
20

Some searches conducted using Chrome are also tracked in the Web Data SQLite database. The items
20
8/

generated from searching populate the Name column with a query header. The query header comes
/2
x9

from the search engine or website, and for many this is simply a q , but it varies depending on the specific
.m

site. Figure 3.7.26 shows search strings contained within the Web Data database.
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.7.26 Entries in the Chrome Web Data database

MAGNET AXIOM EXAMINATIONS (AX200) 259

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

FIREFOX
Firefox stores form data in an SQLite database named formhistory.sqlite stored in the profile folder.
Therefore, for the default profile the file is stored in the following location:
\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxxxxx.default\

The information is contained within the table: moz_formhistory.

Figure 3.7.27 Firefox FormHistory

The DETAILS card on the DETAILS pane includes the following information:

ARTIFACT INFORMATION

Field Name The name of the form field.

20
20

Value
8/

The form value stored in the database.

/2
x9

First Used Date/Time The date and time the field was first used.
.m
ks

Last Used Date/Time

si

The date and time the field was last used.

en
or

Times Used
f

The number of times the field has been used.

dg
@

ID
er

The unique ID of the field. This is essentially a number identifying the order in
vi
ja

which the field values were written into the database.

Firefox stores search terms executed via the built-in browser search box in the formhistory.sqlite
database. As can be seen in Figure 3.7.28, this usually populates the Field Name with searchbar-
history . This data can be cross referenced with the Firefox artifacts in WEB RELATED, Parsed Search
Queries, and Google Searches to possibly determine the source of the search.

260 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Figure 3.7.28 Entries in the Firefox formhistory.sqlite database

INTERNET EXPLORER AND EDGE

Internet Explorer and Edge both store form data in the user registry hive NTUSER.DAT. The
information is stored in the registry key:

\SOFTWARE\Microsoft\Internet Explorer\Intelliforms\FormData

However, the information is encrypted using the Windows Data Protection API, which incorporates the
Windows user password. Therefore, the content is not parsed by AXIOM.

RUNNING EXERCISE
CHROME AUTOFILL
• Select the WEB RELATED → Chrome Autofill category and sort the Date Created
Date/Time column.

• Chrome was used to run a search for dark net markets noobs .

• This Value was Created on 23 Aug 2016 at 18:07:27.

• From the FILTERS bar, run a search for dark net markets noobs .
20

• Select the result in the WEB RELATED → Chrome Web Visits category.
20
8/
/2

• The Date Visited Date/Time matches when the Autofill entry was added to the database.
x9
.m

• The Transition Type is FORM_SUBMIT.

ks
si
en

•
or

The autofill information relates to a search run on the reddit.com website.

f
dg

•
@

Clear all filters.

er
vi

FIREFOX FORMHISTORY
ja

• Select the WEB RELATED → Firefox FormHistory category.

• The user ran searches for microsoft office , and ccleaner .

• Clear all filters.

MAGNET AXIOM EXAMINATIONS (AX200) 261

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

MODULE REVIEW
In this module the following topics were covered:
• Identifying browser artifacts generated by Chrome, Firefox, Internet Explorer and Edge. This
included: browsing history, bookmarks, download activity, and browser cache.
• Understanding Source linking and viewing SQLite database content within AXIOM.
• Viewing the content of ESE database files by extracting the file from AXIOM Examine and using an
external application.
• Understanding that some applications use a modified version of Firefox and how to identify these
artifacts using Source linking.
• Understanding that Internet Explorer v10-11 and Edge use the same WebCacheV01.database file
and how to use Source linking to identify which browser generated an artifact.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

262 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

REVIEW QUESTIONS
To help reinforce the learning objectives for this module, the following review questions have been
provided:

1. Firefox stores much of its data in SQLite databases. How can the content of SQLite database be
viewed in AXIOM Examine?

2. Why is browser history for Edge contained within the WEB RELATED → Internet Explorer 10-11
Main History category?

3. Name three pieces of information displayed in AXIOM Examine for a file downloaded using
Chrome.

4. What is Session Recovery data?

5. Name the database file that stores/tracks most of the artifacts generated by Edge.
20
20
8/
/2
x9
.m

6. What is the difference between a normal cookie and a cookie from a website using Google
ks

Analytics?
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 263

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

STUDENT EXERCISE
This exercise is based on the Dashner case scenario detailed on page 38 of the manual.

• Select the WEB RELATED → Firefox FormHistory category.

• A search was conducted for ccleaner a program that can delete information of possible
evidentiary interest.
When was this search conducted? _________________________________________

• Create a Tag named CCleaner and apply it to the artifact.

• From the FILTERS bar, conduct a search for ccleaner .

• Review the results in the ENCRYPTION → Encryption/Anti-forensics Tools category.

• Apply the CCleaner tag to any relevant results.

• Review the results in the WEB RELATED → Firefox Web Visits category.

• Sort the artifacts by Date Visited Date/Time.

What do the results indicate?
___________________________________________________________________________
___________________________________________________________________________
___________________________________________________________________________

• Apply the CCleaner tag to any relevant results.

• Review the results in the WEB RELATED → Firefox Cache Records category.
Can you identify the downloaded file? _________________________________________

• Apply the CCleaner tag to any relevant results.

20
20

•
8/

Clear all filters.

/2
x9

• Select the WEB RELATED → Firefox Downloads category.

.m
ks
si

• Apply the CCleaner tag to any relevant results.

en
or

Which downloaded file is the CCleaner installer?

f
dg

___________________________________________________________________________
@
er
vi
ja

• Take a moment to review the results in the OPERATING SYSTEM category. Several of these
artifacts will be covered in an upcoming lesson and their relevance will be discussed in more
detail then.

• Apply the CCleaner tag to the results in the OPERATING SYSTEM category. these will be
discussed in more detail in a later lesson.

264 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

• Clear all filters.

• From the FILTERS bar, conduct a search for hexchat .

• Select the WEB RELATED → Chrome Web History category and sort the Last Visited
Date/Time column.
What is Hexchat?
__________________________________________________________________________
Which website was the user reading this information from?
__________________________________________________________________________

• Create a Tag named Hexchat and apply it to the relevant results.

• Review the results in the WEB RELATED → Chrome Web Visits category.

• Apply the Hexchat tag to any relevant results.

Why is there an extra result in the Chrome Web Visits category?
__________________________________________________________________________

• Switch to the WEB RELATED → Chrome Downloads category.

• Apply the Hexchat tag to any relevant results.

What is the start and end time of the file downloaded?
__________________________________________________________________________
What folder location on the disk was the file downloaded to?
__________________________________________________________________________
Was the file opened by the user? ______________________________________________

• Switch to the File system explorer.

• Navigate to the download location noted earlier

20

•
20

Compare the file system date and time information with the information.
8/
/2

• Apply the Hexchat tag to the downloaded file.

x9
.m

• Switch back to the Artifacts explorer.

ks
si
en

• Review the results in the OPERATING SYSTEM → Installed Programs category.

f or
dg
@

• Apply the Hexchat tag to any relevant results.

er

Did the user install the application immediately after it was downloaded? ____________
vi
ja

• Review the results in the OPERATING SYSTEM → Windows 8/10 Prefetch Files category.
Did the user run the Hexchat application? If so, how many times? __________________

MAGNET AXIOM EXAMINATIONS (AX200) 265

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

266 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 7 Web Related

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20
20

____________________________________________________________________________________
8/
/2

____________________________________________________________________________________
x9
.m

____________________________________________________________________________________
ks
si

____________________________________________________________________________________
en
f or

____________________________________________________________________________________
dg
@

____________________________________________________________________________________
er
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 267

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 7 Web Related

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

268 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

Module 3 Computer Artifact Analysis Part 8

Operating System
3.8

MODULE 3:
Computer Artifact Analysis Part 8 Operating System
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 269

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

270 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

LEARNING OBJECTIVES
In this lesson, students will take part in lecture, hands-on exercises, instructor-led exercises, and student
practical exercises to gain an understanding of Magnet AXIOM capabilities in recovering Artifacts from the
files system and registry of a computer running the Windows Operating System. The Computer Artifact
Analysis section of the course is composed of several modules, each of which focuses on a specific set
of key artifacts most commonly encountered during the analysis of computer evidence recovered from
the Windows Registry. The Registry Explorer will be utilized to validate artifacts recovered from the
registry and populated in the Operating System Artifact Category. Investigation and tracking of USB
devices, Jump Lists, Prefetch files, LNK Files, Windows Notification Center, Operating System
Information, Shellbags, Timezone Information, User Accounts, User Assist, Virtual Machines, and
Windows Event Logs are all a part of this lesson and how the data correlates with each other to tell a
story of computer usage and put a person behind the computer while the nefarious acts took place. An
introduction to Mobile Device Operating System artifacts will be discussed and examined as an
introduction to Module 4: Mobile Artifact Analysis.

GOALS
At the conclusion of this lesson, students will be able to identify, discuss, and use Magnet AXIOM to
conduct examinations of computers using the Windows Operating System to search, recover, and tag key
artifacts.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 271

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

OS ARTIFACTS PERSONAL COMPUTERS (PCS)

Operating system artifacts, from either PCs or mobile devices, can represent some of the most valuable
picture of device and user
behaviour. This category covers a wide rang artifacts and can include detailed
information about software installations, network connections, file access, USB connections, changes to
user accounts, and system settings, just to name a few. It is always beneficial to the investigator to
include an analysis of operating system artifacts. Artifacts from this category are often generated
automatically by the host system with little or no direct user control. In addition, the locations for most
of the system files which track the activities are either unknown to the user or difficult to disable without
the proper software or a deeper understanding of the operating system. Therefore, system level artifacts
are not easily hidden or removed by the user in most instances.
In a 1995 book entitled The Demon-Haunted World Dr.
e
absence of operating system artifacts which should normally be present. If a user manages to locate a
third-party software utility which functions to destroy potential evidence at the system level, then the
absence of such artifacts should raise a f to a trained investigator. This might indicate steps were
taken outside the normal operations of the operating system to prevent the recovery of evidence.
Ironically, even if a user is successful in destroying a system level artifact, the operating system stores
records of the software used to delete the artifact and the user who executed it. This information can be
recovered in areas such as the Windows event logs and the Windows registry. In Windows computers
running operating systems such as Vista, Server 2008 and higher the .evtx extension is used for the core
event log files. In Windows 7 and earlier versions of the Windows OS the .evt extension is used instead for
the log files. Also, in Windows 10 there are many logs contained in ETL (Event Tracking Log) files.

In AXIOM Process under the Computer artifacts section, the user can configure which of the operating
system artifacts to recover and what options to use during that recovery. By default, AXIOM will attempt
to recover all known categories of operating system artifacts from a PC or Mac evidence source. The
20

Windows Event Logs are an extremely valuable resource for the investigator, their inclusion can add
20

hundreds of thousands of artifacts to the case and can increase the time it takes to load and process the
8/

case. Once the event logs are recovered the search and filter capabilities of AXIOM Examine make
/2
x9

analysing the Windows Event Logs easily manageable. The cost to the examiner would be upfront and
.m

could pay off large benefits on the back end if searching through event logs was going to be part of the
ks
si

case.
en
f or
dg
@
er
vi
ja

272 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.1 OPERATING SYSTEM ARTIFACT VIEW FROM MAGNET AXIOM PROCESS

Similar to PC and Mac evidence sources, mobile devices can also provide the investigator with valuable
information recovered from their own unique set of operating system files. The mobile device OPERATING
SYSTEM categories are also configured by the user within AXIOM Process within the Mobile artifacts
section of ARTIFACT DETAILS. Operating System Artifacts for mobile devices can provide Wi-Fi profiles,
Cached Cell information, and much more.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.8.2 EXAMPLE OF MOBILE OPERATING SYSTEM ARTIFACTS

On a computer running a Windows operating system, the artifacts can be recovered from the Windows
folder structure, the user profile folder structure, the Windows registry, a restore point, or the System
Volume Information folder, and unallocated space. As with all artifacts in AXIOM, if an individual operating

MAGNET AXIOM EXAMINATIONS (AX200) 273

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

system artifact was not identified by AXIOM Process then an empty category will not be created in AXIOM
Examine.

Figure 3.8.3 WINDOWS OS ARTIFACT CATAGORIES

WINDOWS REGISTRY
At the heart of most of the Operating System artifacts in AXIOM are the Windows registry files. Microsoft

contains profiles for each user of the computer, and information about system hardware, installed
20
20

programs, and property settings. Windows continually references this information during its operations.
8/

Unfortunately, even though the Windows registry files contain some of the most valuable artifacts for an
/2
x9

investigator, they are often one of the most infrequently- explored forensic resources. This can be due to
.m

a lack of understanding of their value or an inability of a forensics tool to access and analyze the registry
ks
si

files. AXIOM provides a solution to both challenges.

en
or

During the creation of the case within AXIOM Process, Windows registry files recovered from the
f
dg

\Windows\System32\config\ and the \Windows.Old\ folder such as the System, SAM,

@
er

Software, and Security global hives and the NTUSER.DAT and UsrClass.dat
vi
ja

profile folder, restore points, and volume shadow copies are analyzed. Artifacts parsed from the registry
hives are stored within the OPERATING SYSTEM category of AXIOM Examine. For investigators who
are relatively new to the exploration of the Windows registry files, and the data they can store, the
Artifacts explorer within AXIOM Examine provides an intuitive and easily-understood view of the data in
both the EVIDENCE and DETAILS panes. To further their understanding of the source of the registry

274 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

artifacts, investigators can follow the hyperlinks in the ARTIFACT INFORMATION sections of the
DETAILS pane. AXIOM Examine will automatically switch to the Registry explorer in the NAVIGATION
pane and allow the investigator to explore the hive and key structures of the source registry files. For
investigators who are more familiar with the Windows registry, and its files, the Registry explorer in
artifacts.
In addition, the Registry explorer of AXIOM Examine also allows the investigator to create user defined
artifacts, HEX card view of the DETAILS pane. For example,
using the Registry explorer in AXIOM Examine, an individual user defined artifact can be created and
tagged for data within a specific value. The user defined registry artifact can be used for adding emphasis
to a relevant artifact not automatically recovered by AXIOM.

20
20
8/
/2
x9
.m
ks
si

Figure 3.8.4 REGISTRY HIVES LOCATED IN WINDOWS OPERATING SYSTEM

en
or

Given the wide variety of operating system artifacts which can potentially be available in the Windows
f
dg
@

registry and the depth in which each registry file can be explored, this module alone could encompass a
er

week-long course. In the interest of time however, this module will focus on some of the key
vi
ja

OPERATING SYSTEM categories from the registry and other system-level files to illustrate the value of
understanding the importance of operating system artifacts and how critical a role they can play in an
investigation.

MAGNET AXIOM EXAMINATIONS (AX200) 275

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

FILE SYSTEM INFORMATION

The File System Information artifact is a system level artifact, parsed from the Boot Record of the drive
which was imaged, and subsequently processed in AXIOM. The Volume Offset (Bytes) value can help
the investigator determine if the artifact is from the Master Boot Record (MBR) or Volume Boot Record
(VBR). The artifact provides technical information about the drive that was examined, including the drive
geometry,

20
20

Figure 3.8.5 TECHNICAL INFORMATION ABOUT THE DRIVE RECOVERED FROM THE VOLUME BOOT RECORD
8/
/2
x9
.m

DRIVE IDS AND MOUNTED DEVICES

ks
si
en

Among some of the basic responsibilities of the investigator is to account for all the available space for
f or
dg

storing data on a drive and to determine the organizational structure of the drive. An understanding of
@

the fundamental forensic principles of drive geometry, formatting, and partitioning can be very helpful
er
vi

when interpreting the File System Information and linking it to other operating system artifacts recovered
ja

s from the evidence, which identify files

accessed by the user on the C: and D: partition, then it is possible that the drives represent separate
logical volumes (partitions) on a single physical drive. If so, then the File System Information artifacts

276 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

category will contain two entries, one for the MBR at offset 0 of the drive and a second from the VBR
within the first sectors of the partition.
Figure 3.8.6 MOUNTEDDEVICES WITHIN THE SYSTEM HIVE

Using the Registry explorer within the NAVIGATION pane of AXIOM Examine allows the user to explore
the structure of the System Hive, which includes a MountedDevices key. Within the
MountedDevices key will be the drive letters associated with the logical partition
(\DosDevices\C:). The first four bytes in the Data field for the drive letter within MountedDevices
are referred to as
Within the DahsnerWin10PC.E01 evidence file in the MBR at offset 440 you will see a drive signature of
AD F3 10 AB which, is the same as the 4-Byte drive signature value in MountedDevices for the C:
drive. Multiple logical volumes on the same physical disk will also share the same drive signature.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.8.7 DRIVE SIGNATURE FROM THE MASTER BOOT RECORD OFFSET 440

MAGNET AXIOM EXAMINATIONS (AX200) 277

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

To locate the drive signature for comparison with the MountedDevices value, use the File system
explorer in the NAVIGATION pane of AXIOM Examine. Highlight the root of the volume, and then select
EVIDENCE pane. In the DETAILS pane, scroll down to the TEXT
AND HEX card, and select the HEX option. Place the mouse cursor in the Hex view and select the GO
TO search optio rch for the value. Highlight the four bytes from offset 440-443,

\DosDevices\C: MountedDevices key.

iscuss an example of where this drive signature could be of importance to you. An examination
was conducted where a suspect used a thumb drive to copy child sexual assault material onto a second
suspects computer. When the second suspect was arrested and his computer was examined, it led to a
removable device with a specific drive signature.
Through the interview process suspect two identified suspect one as his co-conspirator. Suspect one was
arrested and his house searched. Removeable drives were collected but none matched the drive identifier
found in the System hive of the registry under mounted devices belonging to suspect two. During the
interview process suspect two failed to confess and denied he knew suspect one. Based on all the items
of digital media and their respective drive identifiers, Law enforcement knew there was a missing
removable drive. Further searching of the residence revealed a false bottom in the desk of suspect two
and when analyzed the drive identifier matched and the child sexual assault material on the thumb drive
matched hashes of those foun
The drive signature is added to drives the first time they are exposed to a computer running a Windows
Operating System and is assigned to the drive during initialization. If the drive is reformatted it will change
the volume serial number but not affect the drive signature. The only thing that would affect the drive
signature would be if the drive was wiped and the Master Boot Record (MBR) was erased. The first time
after the wipe that the drive was place back into a Windows OS computer, the user would be asked if they
wanted to initialize the disk which is basically building the MBR and Master Partition Table (MPT).
20

PARTITIONING SCHEME
20
8/
/2
x9

In addition to identifying t the system

.m

volume in the MountedDevices key, investigators can also use the File system explorer located in
ks
si

the NAVIGATION pane, and the MBR of the Unpartitioned Space artifact, to locate the Master Partition
en
or

Table (MPT). The partition table, like the drive identifier, can assist the investigator in understanding the
f
dg

logical structure of the drive being examined. The MPT is located at offset 446 of the MBR and contains
@
er

64 Bytes of space available for partition table entries, with each entry occupying a maximum of 16 Bytes.
vi

-bootable entry will

ja

-hidden partitions entries can begin

278 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.8 MASTER PARTITION TABLE LOCATED IN THE MBR AT OFFSET 446 FOR A LENGTH OF 64 BYTES

RUNNING EXERCISE
FILE SYSTEM INFORMATION
• Launch AXIOM Process.

• From the EVIDENCE SOURCES section, select COMPUTER.

• Select LOAD EVIDENCE, followed by IMAGE and select the DashnerWin10PC.E01 file.

• After loading the image file, select Computer Artifacts from the ARTIFACTS DETAILS
section.

• Review the OPERATING SYSTEM artifact category, and the ability to select individual artifacts.

• Close AXIOM Process, and launch AXIOM Examine.

20

• Open the pre-built Dashner case.

20
8/

• In the NAVIGATION pane, expand the OPERATING SYSTEM category.

/2
x9
.m

• Select the File System Information category in the NAVIGATION pane.

ks
si
en

• Note the Id value for the system. This should .

f or
dg

•
@

Note the information for drive geometry, and file system.

er
vi

• Switch to the File system explorer in the NAVIGATION pane

ja

• Highlight the DashnerWin10PC.E01 image file

• In the EVIDENCE pane, select the Unpartitioned Space entry.

• In the DETAILS pane, scroll down to the TEXT AND HEX card, and select the HEX view.

MAGNET AXIOM EXAMINATIONS (AX200) 279

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

• Use the GO TO search option, and search for offset 511. This will be the ending values of the boot

• Use the GO TO search option, and search for offset 446. This is the partition table. Note it is the
last 64-bytes of data within the boot record, prior to the 55 AA value.

• Locate the first 16-Byte entry and note is begins with a bootabl is Partition 1
identified by AXIOM in the File system explorer of the NAVIGATION pane.

• Locate the second 16-byte entry, and note it begins with a non-
Partition 2 identified by AXIOM in the File system explorer of the NAVIGATION pane.

• Search for offset 440. Write down the 4- .

• Switch to the Registry explorer of the NAVIGATION pane.

• Expand the System hive and highlight the MountedDevices key in the NAVIGATION pane.

• In the EVIDENCE \DosDevices\C:

field matches the 4-Byte value at offset 440 of the MBR.

• In the HEX card, highlight the 4-Byte value.

• Right-click the highlighted bytes and select Display as artifact.

• Once AXIOM saves the custom artifact, select VIEW ARTIFACT from the Status Bar.

• Select the Examiner Created category and the File Snippets artifact.

• Open the TAGS, COMMENTS & PROFILES pane r System

apply the tag to the file snippet artifact from offset 440.
20

•
20
8/
/2
x9

OPERATING SYSTEM INFORMATION

.m
ks
si
en

The File System Information artifact is a system level artifact, parsed from the Boot Record of the drive
or

which was imaged, and subsequently processed in AXIOM. The Volume Offset (Bytes) value can help
f
dg
@

the investigator determine if the artifact is from the Master Boot Record (MBR) or Volume Boot Record
er
vi

(VBR). The artifact provides technical information about the drive that was examined, including the drive
ja

280 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.9 OPERATING SYSTEM INFORMATION FROM THE SOFTWARE AND SYSTEM HIVES

The information parsed from the System and Software registry files, which compose the Operating
System Information artifact, can provide valuable insight for the investigator. The version of the
operating system installed, can help the investigator identify the capabilities of the system being

the investigator may have to contend with BitLocker encryption. The build number of the operating
system will tell the investigator if specific artifacts should exist on the computer media. For instance, in
20

build number 1803, Microsoft introduced what they are calling a timeline. By selecting the alt+tab keys
20
8/

at the same time prior to build number 1803 the open tiles in Windows will cascade on the screen. After
/2
x9

the release of build number 1803 the pressing of the alt+tab keys now produce a timeline of activity by
.m

the user. Knowing the build number could explain why certain artifacts are not present on a given
ks

computer system.
si
en
or

In addition, the computer name value can be useful when examining the Windows Event Logs artifacts,
f
dg

and identifying activities associated with the host system performed by the user.
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 281

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.10 OPERATING SYSTEM ARTIFACT INFORMATION

Using Source Linking from the DETAILS card, investigators can view the values stored in the
SOFTWARE\Microsoft\Windows NT\CurrentVersion key. Within this key, AXIOM parses the
values displayed in the EVIDENCE and DETAILS panes, including the version and build number;
installation date/time; digital product key information; installation path; product name; and, registration
for the operating system.
20

Within the System hive, AXIOM parses the data from the ShutdownTime value, which is stored as an
20
8/

8-byte Windows date and time in hexadecimal and converts it to a human readable date and time and
/2

displays it as the Last Shutdown Date/Time field of the DETAILS pane, as seen in Figure 3.8.10.
x9
.m
ks

To validate what AXIOM is interpreting for us, we can use Source Linking to go the registry location to
si
en

see the RAW registry information stored in Hexadecimal. If you want to utilize the built-in functionality of
or

AXIOM, you can highlight those 8 bytes and then scroll down to the DECODE card below the HEX card
f
dg

and look at the windows date and time LE (Little Endian). Alternatively, we can then use the DCode
@
er

program introduced in an earlier module to decode the stored hex value of 1D 3C CE BD 36 2B D2 01. As
vi
ja

you can see in the figure below the Decode Format needs to be Windows 64-bit Hex value and the time
decoded matches the figure below as interpreted by Magnet AXIOM.

282 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.11 CONTENTS OF SOFTWARE REGISTRY HIVE

TIMEZONE INFORMATION
Following the SOFTWARE\Microsoft\Windows NT\CurrentVersion\TimeZones key will
20

link to the Software registry file. This key stores the data AXIOM parses in the Display field of the
20
8/

EVIDENCE and DETAILS panes of AXIOM Examine.

/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 283

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.12 TIMEZONE INFORMATION FROM THE REGISTRY

The Time Zone Information artifacts are parsed from the System and Software registry files. Using the
source link for the ControlSet###\Control\TimeZoneInformation key will allow the
investigator to view the data parsed from the System registry file. This data includes the majority of the
values displayed in the EVIDENCE and DETAILS panes in AXIOM Examine. Identifying the local machine
time zone settings allows the investigator to adjust the time zone settings in their forensics software
tools, to reflect the time zone for the system they are examining.

USER ACCOUNTS
The User Accounts artifacts are parsed from the SAM and Software files of the Windows registry, located
at Windows\System32\config, as well as other restore points, volume shadow copies, and backup
locations.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.8.13 SOURCE LINKING TO THE SAM REGISTRY HIVE

Details parsed from the SAM and Software files can include the user account name and description, dates
and times associated with logins and password changes, account status, user security identifiers (SID),

284 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

and the Profile Path for the specific user. The User Accounts artifacts can be very useful for the
investigator. The User Name and Security Identifier values can be used for sorting, searching, and
filtering in AXIOM Examine to help analyze Windows Event Logs; or as part of an Identifier set of values
when creating profiles in AXIOM Examine, for filtering user-specific artifacts.

Figure 3.8.14 USER ACCOUNT INFORMATION FROM THE SAM AND SOFTWARE REGISTRY HIVES

The group membership information can also help the investigator identify what local privileges the user
has on the system being examined. A registry file, such as the SAM file, is composed of 4096-Byte
20

sections
20

date/time the file was last modified, and the storage path for t
8/
/2

block are the 4096-Byte data blocks, which begin with

x9

store the keys, sub keys, values and data for the registry file, have both allocated and unallocated space.
.m
ks

The allocation status of the hbin blocks instructs the operating and file systems to treat the data area like
si
en

any other storage area on the drive. Correspondingly, if a user account has been deleted, a forensic tool
or

such as AXIOM may be able to recover data for the deleted account. The challenge lies in the version of
f
dg

the operating system being examined. For Windows XP and earlier, the likelihood of recovering data from
@
er

the unallocated space of a registry file was good. However, beginning with Windows Vista and continuing
vi

through Windows 10 it is highly unlikely that data will be recoverable from the unallocated space of a
ja

registry file due to the improvements made in the way Windows handles the unallocated space in the
registry files. As a result, other system-related files may need to be examined for the presence of legacy
user account data from the registry, such as restore points, volume shadow copies, and Windows Event
Logs. The ProfileList key of the Software registry file may also maintain a ProfileImagePath
value for the deleted user account.

MAGNET AXIOM EXAMINATIONS (AX200) 285

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

The majority of details in User Accounts artifact are pa

key, which is labeled with the Hexadecimal value. The hex value for the key is actual
Identifier (RID), which is the last numeric value of the SID, and found at offset 48-51 of the F value.

Figure 3.8.15 SAM FILE INFORMATION BEING PARSED

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

286 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

SAM FILE - F KEY

F KEY VALUE OFFSETS
8-15 Date and time of last login 64-bit Windows timestamp
24-31 Password reset 64-bit Windows timestamp
timestamp
32-39 Account expiration date 64-bit Windows timestamp

40-47 Last unsuccessful login 64-bit Windows timestamp

48-51 Relative Identifier (RID) 4-byte Hex value

56 Account Status/Password 1-byte Hex value. Left nibble identifies account status (Account
Disabled)
0 = Account Active
1 = Account Disabled

The right nibble identifies if a password has been set

0 = Password required

4 = Password not set

5 = Account not used yet, such as the Guest account

60-61 Country code Default = 0000, U.S. = 0001, Canada = 0002

64-65 Number of invalid logins 2-byte Hex value
66-67 Number of valid logins 2-byte Hex value
20
20

This is OS-specific. For example, if Windows 8 or 10, then the count may not be incremented if the user logs
8/
/2

in with their credentials

x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 287

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.16 F KEY OF SAM FILE INTERPRETING THE RID AT OFFSET 48

SAM FILE V KEY

V VALUE OFFSETS
12-15 Relative offset to windows user 4-byte Hex value
account from the end of the
header
16-19 Length of the field 4-byte Hex value
24-27 Relative offset to the full name 4-byte Hex value
from the end of the header
20
20

28-31 Length of the field 4-byte Hex value

8/
/2
x9

36-39 Relative offset to the description 4-byte Hex value

.m
ks

40-43 Length of the field 4-byte Hex value

si
en
or

156-167 Pointer to LM password hash 12-byte Hex value See note below
f
dg
@

166-177 Pointer to NT password hash 12-byte Hex value See note below
er
vi
ja

Note: In Windows 10 Release version 1709 the pointers to the LM and NT HASH above were changed.

288 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.17 V KEY OF SAM FILE SHOWING NAME OF USER PROFILE

SOFTWARE HIVE
The Profile Path value for the User Accounts artifact is parsed from the ProfileImagePath value of
the SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList\<SID> key in the
Software registry file. As mentioned earlier, the ProfileList key may still be maintaining a record of
a deleted Windows user accounts, in the event the data is unavailable in the SAM file, due to the version
of the operating system.
20
20
8/
/2
x9
.m

Figure 3.8.18 PROFILEIMAGEPATH KEY WITHIN SOFTWARE HIVE SHOWING DASHNER IS USER WITH RID OF 1000
ks
si
en
or

RUNNING EXERCISE
f
dg
@
er

OPERATING SYSTEM INFORMATION

vi
ja

• Return to the Artifact explorer in the NAVIGATION pane and select the Operating System
Information category.

• Note the information parsed in the Source column of the EVIDENCE pane, and the current,
previous, and backup locations for the OS information.

MAGNET AXIOM EXAMINATIONS (AX200) 289

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

• Select the entry from the EVIDENCE pane that comes from the Windows\System32\config
path.

• In the DETAILS pane, note the System and Software files identified in the Source fields of
the EVIDENCE INFORMATION.

• Use the source link for the Software file, in the Location field, and view the source in the
Registry explorer.

• In the EVIDENCE pane, view the values from the CurrentVersion key displayed in the
EVIDENCE pane.

• Return to the Artifacts explorer and follow the link for the System file Location
ControlSet01\Control\Windows.

• In the EVIDENCE pane, note the value for ShutdownTime. Select the artifact, then view the
data in the DETAILS pane and the HEX card.

• Highlight the 8-Byte value and select DECODE. Note AXIOM decodes the 64-bit timestamp.
Compare the decoded value to the Last Shutdown Date/Time field in the Artifacts explorer.

• Return to the HEX card for the artifact in the Registry explorer.

• Highlight the 8-byte timestamp. Right-click the data and select Display as artifact.

• Tag the Operating System Information

TIMEZONE INFORMATION
20
20

• Select the Timezone Information category from the NAVIGATION pane.

8/
/2
x9

• In the EVIDENCE pane, select the entry from Windows\System32\config.

.m
ks
si

• In the DETAILS pane, note the data parsed from the System and Software registry files.
en
f or

Select the source link for the Location field of the System file and view the key values in the
dg

•
@

Registry explorer of the NAVIGATION pane.

er
vi
ja

• Return to the Artifacts explorer and follow the source link for the Location field parsed from
the Software file, which identifies the Display field of the DETAILS pane.

• Use the Tools menu, and the Manage date/time format option to set AXIOM Examine to the
time zone for the Dashner computer (EST -05:00).

290 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

• Tag the Timezone Information

USER ACCOUNTS
• Select the User Accounts category.

• Sort by the Source column and view the four entries from
Windows\System32\config\SAM.

• Select the dashner entry from the EVIDENCE pane, and note the information parsed in the
DETAILS SID matches
the Id value from the File System Information artifact.

• View the EVIDENCE INFORMATION entries for the SAM file, and the Locations from the keys
within the SAM file.

• Follow the source link for the SAM\Account\Users\000003E8 key and view the data in
the Registry explorer of the NAVIGATION pane.

• In the EVIDENCE pane, select the individual values, and view the data parsed in the DETAILS
pane for GivenName, InternetUserName, Surname, and UserPasswordHint. Note
kingsfan1

• In the EVIDENCE DETAILS pane and the HEX

card.

• Select offsets 8-15 of the F value. This is the 64-bit timestamp for the last successful login. Use
the DECODE option to view the converted timestamp value.

• Select offsets 48-51. This is the Relative Identifier (RID) for the Dashner user account Security
20

Identifier (SID). You can use the Windows calculator tool and the programmer option to convert
20

the Hex value of 3E8 to a decimal value of 1000.

8/
/2

•
x9

Select offset 56. This identifies the account status (enabled/disabled) and if a password is
.m
ks
si

•
en

Select offsets 66-67. This is the number of successful logins. It is a

or

DETAILS pane for

f
dg

the Dashner user account.

@
er
vi

• EVIDENCE pane.
ja

• Select offset 528. This is the storage location for the hash of the Dashner login password. It
-byte hash of the password.
Following these 20 Bytes is the LAN password hash, if present. In this case, we only see the 4-
Byte header and not a stored 16-Byte h

MAGNET AXIOM EXAMINATIONS (AX200) 291

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

account. Further analysis of the Windows Event Logs for the security.evtx file would need to be
performed to determine if a password was set.

• Return to the Artifacts explorer. Tag the 3 accounts from Windows\System32\config to

the Dashner System Info tag (Admin, Guest, dashner).

USB DEVICES
When a user connects a USB device to a host system for the first time, a small popup window is often

popup windows are

usually fo
the USB device, with options for the user on how they wish to interact with the newly-recognized drive.
20
20
8/
/2
x9
.m
ks
si

Figure 3.8.19 SHOWING THE TRACKING OF USB DEVICES

en
f or
dg
@

filled with writes to numerous system files and the Registry, which can be analyzed and recovered with
er
vi

AXIOM, and stored in the USB Devices artifact category. These source files can include the Software and
ja

System registry files, setupapi.dev.log files, pagefile.sys, Windows Events Logs, NTUSER.DAT
files, and system files within restore points and volume shadow copies. The information can provide the
investigator with the date/time the USB device was first connected and Windows installed the necessary
device driver software as well as the description of the device such as the name, manufacturer, and device
identifiers. AXIOM can also recover the drive letter assigned by Windows and which Windows user profile

292 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

was associated with the connected device. In addition, the information can help an investigator
understand how a USB device was used on a given system, after it was connected, and possibly explain
how a suspect might have used the USB device in the commission of a crime. For example, if a user
accessed a file on the USB device through the Windows Explorer utility, artifacts may be recovered from
t folder, pagefile.sys, or $MFT, prefetch, and user assist to name a few. Also, an LNK file
may exist on the computer system providing valuable information for the examiner in the Operating
System → LNK Files category. The entry can include the drive letter assigned to the USB device, as well
as the volume serial number (VSN) for the device. Using the VSN as a keyword search in AXIOM Examine
may result in the matching value being found in the USB Devices category, allowing the investigator to
associate the USB drive with the LNK File entry. The data from the MountedDevices, USBSTOR, and
DeviceClasses key within the System registry file, the class ID and volume GUID values for the USB
can be found in the MountPoints2 key in the NTUSER.DAT file for a Windows user, allowing the
investigator to associate a specific user with a USB device.

Figure 3.8.20 REGISTRY EXPLORER OF USBSTOR KEY TRACKING DEVICES BY THEIR

NOMENCLATURE

The USBSTOR key of the System registry hive provides a number of the values categorized in the
ARTIFACT INFORMATION fields displayed in the DETAILS pane.
20
20
8/
/2
x9

MOUNTED DEVICES
.m
ks
si

The data within the MountedDevices key from the System registry file, allows investigators to match
en
or

the device to a drive letter if assigned or volume GUID if it has been previously-mounted by the Windows
f
dg

operating system. It can also help the investigator link a Windows user to a USB device, using the
@

identifying information. The entries within the MountedDevices key fall into two general categories,
er
vi

volatile and non-volatile. The volatile entries are associated with the drive letters not otherwise
ja

automatically-assigned by either the operating system or the user. For example, the System volume is
often reserved as the C:\ drive, while A:\ and B:\ are often reserved for legacy floppy disk drives. Users
however, can also create additional logical volumes on a drive, and format them with a file system that
is recognized by the Windows operating system. In these instances, the volumes will be mounted when
the system boots, and assigned a fixed (non-volatile) drive letter, like D:\. When a USB device is

MAGNET AXIOM EXAMINATIONS (AX200) 293

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

connected, Windows attempts to identify the file system the device was formatted with. If
then Windows assigns the next available drive letter such as E:\, F:\, G:\, etc. Until a new USB device is
connected, the drive letter assignment in the MountedDevices key will still maintain information for the
previously-connected USB including the drive letter. Once a new USB drive is connected it will receive the
next drive letter and the information which was previously stored in the \DosDevices\F: value will be
stored as a non-volatile entry within the MountedDevices key, identified by the symbolic link naming
convention \??\ Within the name for the symbolic link a value will be stored as a and all
the information previously-stored in the drive letter entry will remain inside. The data stored within the
symbolic link will also be found within the DeviceClasses key of the System registry file and can be used
as another source of validation for the connection of the USB drive to the host system being examined.

Figure 3.8.21 MOUNTED DEVICES SHOWING SAME USB TRACKED IN USBSTOR

Looking at the MountedDevices Key at the item in Figure 3.8.21, concentrate on the Data value in the
HEX card. One of the items within will be the device serial number of A20054824b3fb032. You can also
see this in the USBSTOR key displayed in Figure 3.8.22, indicating this USB device had previously been
inserted into the computer running this Operating System.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

294 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.22 HEX CARD SHOWING USBSTOR RAW DATA

Magnet AXIOM attempts to recover the last assigned drive letter by tracking the device through the

the serial number A20054824b3fb032 was previously assigned drive letter E:\.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.8.23 DETAILS CARD SHOWING LAST ASSIGNED DRIVE LETTER AND SERIAL NUMBER

MAGNET AXIOM EXAMINATIONS (AX200) 295

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

MOUNTPOINTS2
Using the volume GUID as an identifier can provide the investigator with one of the most valuable details
included within the USB Devices category, which is the association of the USB drive to a specific
Windows user account.
This data is identified through a combination of keys, which include the MountedDevices and
DeviceClasses from the System file, and the MountPoints2 NTUSER.DAT
file. The MountPoints2 key lists all the volumes a user can access, and devices they have connected
while logged into the computer. Using the volume GUID from MountedDevices, an investigator can
find a corresponding key in the NTUSER.DAT file, for the user who connected the USB device.
Timestamps associated with the GUID-labeled key will correspond to the date/time the device was
connected by the user.

Figure 3.8.24 MOUNPOINTS2 FROM THE USER HIVE OF NTUSER.DAT FILE

20
20

USERASSIST
8/
/2
x9

The UserAssist artifacts are parsed from the NTUSER.DAT file, from the key
.m
ks

Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\<GUID>\
si
en

Count. Within the Count sub key are the values which track information for shortcuts created and
f or

accessed by the user, as well as applications launched by the user. Since the artifacts are parsed from
dg
@

the NTUSER.DAT file, they are unique to a specific Windows user profile, and can provide valuable
er

Count values
vi
ja

includes the name of the application launched by the user, the number of times the application has been
launched, and the date/time the application was last launched.
The following identifies the GUIDs within the UserAssist key, based on the version of the Windows
operating system being examined:

296 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

Windows XP:
{75048700-EF1F-11D0-9888-006097DEACF9} Application (*.exe) and Link (*.lnk) entries
{5E6AB780-7743-11CF-A12B-00AA004AE837} IE Favorites, and IE toolbar entries Windows Vista:
{75048700-EF1F-11D0-9888-006097DEACF9} Application (*.exe) and Link (*.lnk) entries
{5E6AB780-7743-11CF-A12B-00AA004AE837} IE Favorites and IE toolbar entries Windows 7:
{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} Link (*.lnk) entries
{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} Application (*.exe) entries Windows 8:
{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD} Link (*.lnk) entries
{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} Application (*.exe) entries

Windows 10:
{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD} Link (*.lnk) entries
{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} Application (*.exe) entries
20
20
8/
/2
x9
.m

Figure 3.8.25 MAGNET AXIOM ARTIFACT EXPLORER OF THE USERASSIST REGISTRY ENTRIES
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 297

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.26 RAW REGISRTY VIEW OF USERASSIST REGISTRY ENTRIES

hich the
letters of the English alphabet are rotated 13 (Right on Table ROT) positions. For example, an entry of
table below is a reconstructed Alphabet based on
ROT13.
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
N O P Q R S T U V W X Y Z A B C D E F G H I J K L M

AXIOM understands the obfuscation scheme and decodes the ROT13 value for the File Name, the
numeric value for the Application Run Count, and the 64-bit value for the timestamp in the Last Run
Date/Time field in the ARTIFACT INFORMATION section. Given that the number of entries within
UserAssist can be quite lengthy, if an investigator knows the name of the application of interest, the
right-click Filter on column feature can be applied to the File Name column in the EVIDENCE pane,
20

and a search can be conducted for the name of the application. The User Name and File Name columns
20
8/

in the EVIDENCE pane can also be sorted, to provide the investigator with a more manageable view of
/2
x9

applications for a specific user if multiple users are present on a system.

.m
ks
si
en
f or
dg
@
er
vi
ja

298 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.27 ROT13 OBFUSCATED USERASSIST ENTRIES

LNK FILES
The LNK Files artifacts are parsed from a number of locations within the operating system, which can
include the $MFT; the pagefile.sys; the Program Files, ProgramData, and Program Files (x86) folders,

artifact for the forensics investigator. They are shortcut files that link to an application, folder, or file found

because of the extension in the naming convention. LNK files can be created by the user or automatically
by the Windows operating system. Each occurrence and file location have their own value and meaning.
Windows-created LNK files are generated when a user opens a local or remote file or document, which
can give an investigator valuable information and insight i
excellent artifacts for forensic investigators who are trying to find files that may no longer exist on the
deleted, stored on a USB, or network share.
20

Although the file(s) might no longer exist, the LNK files associated with the original file could still exist
20
8/

on the system and provide valuable information as to what was accessed by the user. Information parsed
/2

for the LNK file can be useful when searching or filtering within a case, to help the investigator narrow
x9
.m

the focus on a specific artifact or identify associations between multiple artifacts. For example, the
ks

Volume Serial Number (VSN) value from an LNK file can be used to help identify an entry in the USB
si
en

Devices artifacts category, and perhaps even associate a drive letter to the USB drive.
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 299

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.28 LNK FILES INTERPRETED BY MAGNET AXIOM

The LNK files p file folder

are found in the folder
Users\<profile>\AppData\Roaming\Microsoft\Windows\Recent. Within this folder are the
entries with the *.lnk extensions. Information parsed by AXIOM from an LNK files include the Linked
Path (original path) for the item; timestamps associated with the source file when the LNK file entry was
created, indicating when the source file was accessed by the user. Also, the Drive Type, such as a fixed
or removable drive, the Volume Name (label) for the drive, and the Volume Serial Number (VSN) of
20

the drive, as well as the logical size of the target file is also recovered from within LNK files.
20
8/
/2
x9

RECENT DOCS
.m
ks
si
en

In addition to the LNK file entries found within the Recent folder, Windows also tracks the accessed
or

NTUSER.DAT file, in the RecentDocs key. In

f

resources, files, and application shortcuts in the

dg
@

the root of the key will be a listing of the most recent files, folders, applications, and other shortcuts
er

accessed by the user, regardless of file type (extension). The values within the RecentDocs key are listed
vi
ja

numerically, beginning with and incrementing up in value for each newly-added entry. However,
Windows stores the values numerically, in ascending order, and not in the order in which they were
accessed by the user. Instead, Windows stores a value in the root of the RecentDocs key called,
MRULIstEx MRUListEx stores the entries
based on the order in which they were accessed by the user, beginning with the most recent. As a result,

300 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

the entries in the MRUListEx can be compared to the listed values, to help identify the order. Within the
RecentDocs key is a series of sub keys, named by file extension. Similar to the RecentDocs key,
each of the sub keys also maintain an MRUListEx value, which identifies the order in which the items
were accessed by the user for a given file type. Viewing the corresponding value for the entry, an
investigator can see the *.lnk file entry information, in both ASCII and Unicode.

Given the often-questionable efficiency with which Windows performs its housekeeping tasks, if a user
deletes the entries within the Recent folder, it is very likely that an investigation of the RecentDocs key
of the NTUSER.DAT file will reveal a listing of the files and folders accessed by the user, which were
subsequently deleted, in an effort to prevent their recovery.

20
20
8/
/2
x9

Figure 3.8.29 RECENT DOCS IN REGISTRY EXPLORER

.m
ks
si
en

JUMP LISTS
f or
dg
@

Jump Lists were introduced in the Windows 7 operating system and continue to be an integral part of the
er
vi

Windows 10 operating system, providing valuable user activity information to investigators. Similar to
ja

the LNK File category, the Jump List artifacts are also parsed from the folder
Users\<profile>\AppData\Roaming\Microsoft\Windows\Recent\. Within the Recent folder are two

Jump List entries contain information for the resource accessed by the user including the path, the name of
the application used to access the resource, the date/time the application was used, and the resource

MAGNET AXIOM EXAMINATIONS (AX200) 301

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

accessed. Jump Lists also track details of the drive the resource was accessed from including VSN and
volume label and if the Jump List is an automated item created by the operating system or a custom item
created by the user. The AutomaticDestinations folder contains entries generated by the operating
system, and other default applications in Windows, while the CustomDestinations folder stores entries
created by the user.
Similar to LNK files, Jump Lists can be very useful for the investigator for a number of reasons. They can
identify files and resources accessed by the user, including last accessed timestamps as well as file paths.
Jump Lists store information on Most Recently Used files and applications by the user. Jump lists also
help the investigator identify applications the user has used to create, edit, or view specific files, such as
graphic files and videos. They can help the investigator establish user history, and timelines, for user
behavior and file access. Jump Lists can also provide detailed information on the object or volume on
which the user accessed the files with the application. Finally, a Jump List entry, like an LNK File entry,
may be the only remaining evidence that a file existed on a local system, or removable media as LNK files
remain even though the original source file has been deleted.
20
20
8/
/2
x9
.m
ks
si
en
or

Figure 3.8.30 JUMP LIST DATA FOR DRUGS LIST.TXT SHOWING IT WAS OPENED IN WORDPAD
f
dg
@

The AutomaticDestinations folder stores entries automatically-generated by the Windows operating

er
vi

system, when a user launches an application, accesses a file, or interacts with Windows Explorer to
ja

accesses a known resource. Each file is named with an application ID value, followed by
- The application ID value is maintained by Microsoft and is unique to the
application being tracked by the Jump List functionality of Windows. According to Microsoft, it represents a
CRC64 hash of the path for the application. AXIOM uses the application ID (App ID) value to identify the

302 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

EVIDENCE and DETAILS panes of AXIOM Examine. There

are a number of online resources for lists of application identifiers including:
https://www.forensicswiki.org/wiki/List_of_Jump_List_IDs.

Figure 3.8.31 AUTOMATICDESTINATIONS APPID TO LINK TO ASSOCIATED PROGRAM

The automaticDestinations-ms file uses a compound binary file structure. Within the file is a destination list,
data stream, which serves as a Most Recently Used (MRU) or Most Frequently Used (MFU) list,
last accessed timestamps, target file names and paths, object and volume identifiers, and, references to the
Microsoft Shell Link (MS-SHLLINK) data streams stored in the compound file itself. The MS-SHLLINK
streams are commonly used to support the launching of an application, and links to other objects, using
Object Linking Embedding (OLE) functionality. For Jump List entries, the MS-SHLLINK functions as a
reference to a target file, so it can be accessed more efficiently by the system. The combination of DestLlist
and MS-SHLLINK data streams provide the information AXIOM uses to parse the details in the columns of
the EVIDENCE pane, and ARTIFACT INFORMATION sections of the DETAILS pane.
The CustomDestinations folder operates similarly to the AutomaticDestinations folder. Each entry
uses the same naming convention for the files, with an alphanumeric prefix that represents a CRC64 hash
for the application path, which AXIOM uses to identify the App value. Unlike the
automaticDestinations-ms files, which are generated by the operating system, the customdestinations-
ms entries are created when a user Task Bar. In
addition, the customDestinations-ms file does not use the compound binary file format, but a more
simplistic structure. The MS-SHLLINK data streams are still used, but the data is stored in a series of LNK-
20

formatted sequential entries. Finally, unlike an automaticDestinations-ms entry, which is controlled by the
20

operating system, additional metadata can be added to the customDestinations-ms data stream and is
8/
/2

controlled by the application associated with the custom Jump List entry. Similar to the
x9

automatcDestinations-ms Jump List entries, the customDestinations-ms files can provide the
.m
ks

investigator with valuable information which can be used to identify frequently-accessed applications
si

(pinned), historical user data, timeline analysis data, and potential references to applications which may
en
or

no longer be available on the local system being analyzed.

f
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 303

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.32 CUSTOMDESTINATIONS CREATED WHEN A USER PINS APPS TO THE A SPECIFIC
LOCATION (TASK BAR, START MENU)

SHELLBAGS
Shellbags have been present in the operating system since Windows XP but have only recently become a
popular artifact as examiners have begun to realize their potential value to an investigation. ShellBag
entries store Windows user preferences for sizes, positions, and content views of a folder, when viewed
through Windows Explorer, which includes network folders and removable devices. For example, if a user
accesses a folder on a USB device, which contains photos, the default view for Windows Explorer is the
Details view. However, the user wants to change the default view to thumbnails so that each time he opens
the folder thereafter it will be in thumbnail view. The user can change the option from Details to one of the
Icon choices in the view drop-down menu from the Windows Explorer tool bar. Behind the scenes,
Windows (Vista, 7, 8, and 10) saves the preferences in the UsrClass.dat file for the user. In Windows XP,
the preferences were saved in the NTUSER.DAT file. This module will focus on the functionality of the
newer versions of Windows. The ShellBag artifacts provide the investigator with additional behavioral
insight for the user on folder preferences, local browsing history in Windows Explorer, and like LNK Files
and Jump Lists, potential information about files and folders that no longer exist on the system being
analyzed.
20
20

Figure 3.8.33 SHELLBAGS ARTIFACT WITH MAGNET AXIOM

8/
/2
x9
.m
ks
si
en
f or
dg
@

Location for Shellbags artifacts by operating system version:

er
vi
ja

For Windows XP, Shellbags artifacts are located in the NTUSER.DAT file:

• Software\Microsoft\Windows\Shell

• Software\Microsoft\Windows\Shell\NoRoam

304 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

For Windows Vista, 7, 8, and 10, Shellbags artifacts are also found in the UsrClass.dat hive:

• Local Settings\Software\Microsoft\Windows\Shell\Bags

• Local Settings\Software\Microsoft\Windows\Shell\BagMRU

AXIOM parses the Shellbags artifacts for Windows Vista, 7, 8, and 10, from the UsrClass.dat file, located
at Users\<profile>\AppData\Local\Microsoft\UsrClass.dat. Information displayed in the
columns of the EVIDENCE pane and ARTIFACT INFORMATION sections of the DETAILS pane include
the path for the folder, date/time it was last accessed within Windows Explorer (Last Explored), file
system timestamps, and the viewing mode preference for the contents of the folder.

Figure 3.8.34 SHELLBAGS FROM THE USERCLASS.DAT FILE SPECIFIC TO A USER

RUNNING EXERCISE
LNK FILES
• Return to the Artifacts Explorer in the NAVIGATION pane.

• Select the LNK Files category.

20
20
8/

• In the FILTERS bar, open the Artifacts drop-down menu, check LNK Files, and click OKAY .
/2
x9
.m

• The artifacts in the EVIDENCE pane should now be limited to LNK File entries only.
ks
si

• In the keyword search window of the FILTERS bar,

en

\ GO .
f or
dg

• The EVIDENCE pane should now be limited to only LNK File entries from the Dashner user
@

account Recent folder.

er
vi
ja

• Sort by the Linked Path column.

• Scroll through the list of artifacts and note the entries grouped together from the C:\ and
E:\ drives.

• Sort by the Volume Name column and not

MAGNET AXIOM EXAMINATIONS (AX200) 305

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

• Compare the Linked Path entries for the E:\ drive to the Volume Name column. Note that

volume. Each volume has its own unique serial number as well, so dealing with two
separate volumes where Dashner accessed files.

• Select the MyUSB artifacts and create a new tag for LINK .

• Clear the filters to reset the view .

USB DEVICES
• Select the USB Devices category.

• Sort by the Friendly Name column.

• Note the Serial Number column entries for the 3 unique SanDisk USB drives, and the Western
Digital USB drive.

• In the Last Assigned Drive Letter column, note the E:\ drive was assigned for 2 different
SanDisk drives.

• View the Volume GUID column values for SanDisk drives.

• Note the beginning GUID values for each device:

• 73462160 SanDisk Sandisk Ultra USB Device

• 041064e6 SanDisk Ultra USB Device

• 398401c0 SanDisk Cruzer USB Device

20
20

Switch to the Registry explorer in the NAVIGATION pane.

8/

•
/2
x9

•
.m

Expand the System file and select the MountedDevices key.

ks
si
en

In the EVIDENCE pane, expand the Name column so the Volume GUID values are visible.
or

•
f
dg
@

• Note that both Volume GUIDs from the USB Devices category are listed as symbolic links
er
vi

\??\.
ja

• Select the Volume GUID that begins with and note the data parsed in the HEX
card of the HEX pane listing the device as .

• Select the Volume GUID that begins with and note the data parsed in the HEX
card of the HEX pane listing the device as Sandisk .

306 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

• Select the Volume GUID that begins with and note the data parsed in the HEX
card of the HEX pane listing the device as .

• \DosDevices\E: alue and note the data parsed in the HEX card
of the HEX pane, listing the device as

• Each of these SanDisk USB devices have been connected to the local machine. Two of them,
at one time, were assigned drive letter E:\. The most recently-connected device was the
was the last device assigned as the E:\ drive.

• Expand the ControlSet001 key and the Enum key.

• .

• Expand each Disk&Ven entry and note the sub keys named with the Serial Number from the
Artifacts Explorer, identifying 3 separate SanDisk devices.

•
Dashner\NTUSER.DAT~1\Software\Microsoft\Windows\CurrentVersion
\Explorer\MountPoints2

• In the MountPoints2 key, note the presence of the same volume GUIDs found in the
MountedDevices key of the System file, and in the Volume GUID column in the Artifacts
explorer for the USB Devices category. Based on the Volume GUIDs, we can associate the
3 SanDisk drives with the Dashner user account.

• Return to the Artifacts explorer and the USB Devices category.

• Select the entries for the SanDisk and Western Digital (WD) drives, and create a new tag for
associated with those devices named Devices
20
20

JUMP LISTS
8/
/2

• Select the Jump Lists category in the NAVIGATION pane.

x9
.m
ks

• In the EVIDENCE pane, sort by the Linked Path column.

si
en
or

• Right-click the Linked Path column and select, Filter on column. Enter \ a keyword
f
dg

search to filter the list. Note the entries for the E:\ drives previously-identified in the LNK File
@

entries. Sort by the Volume Name

er
vi
ja

Device Jump List and associate the findings accordingly in each

one of those newly created tags.

• Clear the filter and sort by the Jump List Type column, to organize all th
entries.

• Right-click the Jump List Type Filter on column

MAGNET AXIOM EXAMINATIONS (AX200) 307

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

keyword search to limit the artifact list to only items from customDestinations-ms entries,
created by the Dashner user activities.

• Note the entries for the Chrome browsing activities -

entries and create a new tag for Jump List and associated those results to
the newly created tag.

• Clear the filter condition.

• Sort by the Potential App Name column.

• Note the files that were accessed within the Dashner user account with Notepad.exe and
Wordpad.exe.

• Select the Wordpad.exe entries and create a

associate those artifacts with the newly created tag.

SHELLBAGS
• Select the Shellbags category from the NAVIGATION pane.

• Sort by the Mode column and locate all the entries for .

• Right-click the Mode column and filter for .

• View the entry for Computer: {24ad3ad4-a569-4530-98e1-ab02f9417aa8}Cool stuff\ .

• Select the Artifacts drop-down menu from the FILTERS bar. Check LNK Files and Shellbags.

• ord search window and click GO to further limit the results in the
EVIDENCE pane.
20
20
8/

• The resulting data will be the 2 entries from the Jump Lists category and the 5 entries from the
/2
x9

LNK Files category in the NAVIGATION pane.

.m
ks

• Select the LNK Files and view the 5 entries in the EVIDENCE pane.
si
en
or

• Note the path displayed for C:\Users\dashner\Pictures\Cool Stuff, and the entries that
f
dg
@

include the *.jpg files that were accessed by the Dashner user.
er
vi

• Switch to the File system explorer and attempt to locate the \Cool Stuff\ folder, and
ja

associated *.jpg files, in the path listed in the LNK Files category. This is an example of how
Jump List and LNK Files may be the only remaining evidence of a file or folder from the host
system accessed by the user, as the original file or folder have been deleted.

• Return to the Artifacts explorer. Select the LNK Files and Shellbags entries and create a

308 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

tags.

• Clear any filter conditions

PREFETCH
AXIOM parses the Windows Prefetch artifacts from the Prefetch folder, located at Windows\Prefetch.
The Windows Prefetch functionality was first introduced in Windows Server 2003, and Windows XP. There
are two type of prefetching. Boot prefetching gathers data of files which were accessed during the boot
process to make it faster the next time the computer boots. Forensically speaking boot prefetching has
no value. Application prefetching tracks the application that is launched, the last 8 dates and times the
application was launched. By default, the Prefetch service tracks both types of operations, but the
EnablePrefetcher value of the PrefetchParameters key, in the System hive, can be modified
to track one or the other, or disabled entirely. When an application is launched on the host system for the
first time, a corresponding *.pf file is also created in the Prefetch folder. The purpose of the application
prefetch is to speed up the time it takes Windows to load applications. The files stored in the Prefetch
folder are listed alphabetically, based on the name of the application that was launched.
The naming convention for the *.pf file begins with the application name and .exe, followed by a
proprietary hash value, and the .pf extension. For example, the Prefetch file entry for Chrome.exe would
CHROME.EXE-5FE990A0.pf
applications, along with any dependencies, are stored in a file within the Prefetch folder called layout.ini.
Entries in the layout.ini file are written in the order in which they were loaded. According to Microsoft, the
Prefetch files are treated as data objects, and therefore a maximum storage capacity has been set for the
Prefetch folder entries of 126 in Windows XP, and increased to 129 in Windows Vista, 7, 8, and 10.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.8.35 DETAILS CARD FOR CHROME.EXE PREFETCH FILE

MAGNET AXIOM EXAMINATIONS (AX200) 309

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

Once the maximum number of entries has been reached, Windows will automatically delete all but 32 of
the entries. There does not seem to be a factor which determines which 32 entries are retained, but it
may follow a First In First Out (FIFO) convention, in which the most recent entries would be retained.
As mentioned earlier, operating system artifacts can provide an investigator with a very clear picture of
a user
relevant data within the artifacts. AXIOM presents the data in an intuitive manner to the investigator and
stakeholders. Among the many key artifacts are the names of applications launched on the host system,
the date and time they were most recently launched, and how many times they have been launched. An
analysis of the UserAssist key in the NTUSER.DAT file provides this data as it relates to a specific
Windows user profile. The Windows Prefetch files track similar information, but are system wide, rather
than user-specific.
The data stored within the Prefetch (*.pf) files, for versions of Windows prior to 10, was uncompressed,
and relatively intuitive to interpret. AXIOM understands the compression mechanism and is able to
decompress the data, and parse the application name, date/time of last launch, and the number of
launches.
For Windows Prefetch files, prior to Windows 10, the following offset locations within the *.pf file store
the relevant forensic data:

Windows XP

• Offset 0-11 Header

• Offset 4-7 Record Entry Header

20

• Offset 16 Application Name (variable length)

20
8/

• Offset 120-127 Date/Time of Last Launch

/2
x9
.m

• Offset 144-147 Number of Launches

ks
si
en

Windows 7/8
f or
dg

• Offset 0-11 Header

@
er

• Offset 4-7 Record Entry Header

vi
ja

• Offset 16 Application Name (variable length)

• Offset 128-135 Date/Time of Last Launch

• Offset 152-155 Number of Launches

310 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.36 HEX AND TEXT CARD VIEW OF THE CHROME.EXE-D999B1BA.PF

Windows 10, Prefetch and SuperFetch files are compressed with the XPRESS HUFFMAN algorithm, a.k.a.
the MAM format, which is not new. Windows 8.1 uses MAM to compress SuperFetch files, but not
Prefetch files. Moreover, from what is known, checksum is present only for SuperFetch files and never
for Prefetch files.
It remains unclear why Prefetch and SuperFetch files are compressed. Usually compression means space
saving, however in this case we believe it has something to do with input/output (IO) reduction to the hard
disk drive.

PREFETCH SETTING IN THE REGISTRY

The Prefetch/Superfetch functionality, as previously-mentioned, will monitor applications loaded during
the boot process, or subsequently launched by a user. By default, all of these are monitored by the
operating system. A more advanced user, however, can choose which activities Prefetch/Superfetch will
monitor, or they can disable the functionality completely. There are very few reasons for disabling the
20
20

feature in Windows, as it is designed to enhance the user experience, providing access to resources in a
8/

much more efficient manner. Therefore, if the service is disabled, it may be indicative of a user who is
/2
x9

trying to prevent the discovery of application usage on the local system.

.m
ks

Identifying the Prefetch/Superfetch settings requires an examination of the Windows registry.

si
en

Specifically, the System hive. Within the System file, the Prefetch/Superfetch settings can be found in the
or

following path:
f
dg
@

System\ControlSet###\Control\Session Manager\Memory Management

er

\PrefetchParameters
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 311

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.37 SYSTEM REGISTRY HIVE SETTINGS FOR SUPERFETCH AND PREFETCH

Within the PrefetchParameters key will be two values which track the status of the Prefetch/Superfetch
service, EnablePrefetcher and EnableSuperfetch. Each value will have a hexadecimal value
representing the condition of the service:

0 = Service disabled
1 = Applications only

2 = Boot process only

3 = Applications and boot process
(default)

WINDOWS EVENT LOGS

20
20
8/

The ability of the Windows operating system to log events has been available for system administrators
/2
x9

logs, the event

.m

service provided system admins with a standardized format, and centralized location, for viewing
ks
si

important application and system activities recorded by the Windows operating system. In general, the
en

event types include general information, warnings, errors, successes audits, and, failure audits. If
f or

necessary, the information from the early event logs could be used to help correct a problem or improve
dg
@

overall system performance.

er
vi
ja

312 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.38 WINDOWS EVENT LOGS ARTIFACTS

Even though the more recent versions of the Windows operating system have expanded the degree of
detail included in the event log files, increased the number of services which use the Windows Event Log
Application Programming Interface (API), and improved the interoperability among the various services
which can write to an event log, the basic underlying functionality remains the same.

AXIOM parses the Windows Event Logs artifacts from the *.evt/*.evtx files stored within the
Windows\System32\winevt\Logs folder. The data parsed from the file includes the numeric Event
ID value, the Security Identifier (SID) associated with the log entry, the created date/time for the log entry,
a brief summary of the event, the level of the event, the service that was associated with the log entry,
the name of the computer, and the detailed event data for the log entry.
Based on improvements to the Windows event logging functionality and the capabilities of most forensic
tools for parsing the event log entries investigators are faced with a number of challenges. Rather than
dealing with just the core system level event logs of the past (Application, Security, and System), the Logs
folder may now contain over one hundred event logs. Those event logs are generated by the operating
system and each containing potentially hundreds of individual entries. In addition to the Windows-based
20

event logs, third-party applications are also allowed to generate their own custom event logs provided
20

they comply with the Windows API requirements. Adding the functionality of third party applications to
8/

generate logs adds an avalanche of log files that make it difficult to search through to find the needle in
/2
x9

the haystack.
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 3.8.39 AXIOM FILE SYSTEM VIEW OF EVENT LOG FILES FORM CORE SYSTEM TO THIRD PARTY
APPLICATION EVENT LOG FILES

MAGNET AXIOM EXAMINATIONS (AX200) 313

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

WINDOWS EVENT LOG FILTERING

What is t
functionality make it easy to find t
not uncommon for investigators to be presented with well over one hundred thousand individual
Windows Event Logs artifacts in their case. The challenge for the examiner is to find a way of narrowing
their focus to only the event log entries which are most relevant to their investigation, such as the number
of times a laptop successfully connected to a wireless network, a user account was created or deleted,
or if an application was installed such as an anti-forensics tool capable of preventing the recovery of
critical evidence.
Using the filtering capabilities of AXIOM Examine, users can very quickly create a simple or compound
filter condition that makes short work of identifying the key Windows Event Log entries. From the
FILTERS bar in AXIOM Examine, users can select the Artifacts drop-down menu, and check the
Windows Event Logs option, to limit the application of the filter condition to only those specific artifacts.
Next, right-click the Event ID column in the EVIDENCE pane and select Filter on column. In the Filter
options popup window, set the Number is value to Equal to, and enter the desired numeric Event ID
value.
20
20
8/
/2

Figure 3.8.40 ARTIFACT FILTERING TO WINDOWS EVENT LOGS AND COLUMN FILTER ON EVENTID TO
x9

NARROW INVESTIGATIVE FOCUS

.m
ks

After the initial filter results are displayed in AXIOM Examine, the list of artifacts is substantially less than
si
en

the unfiltered view. However, the Event ID filter results may not be as narrow as expected. To further
or

reduce the displayed results to those for a specific activity, such as connecting to a wireless network,
f
dg

additional filtering can be done within the EVIDENCE pane. For the Windows Event Logs category, all
@
er

columns within the EVIDENCE pane allow for the Filter on column feature. If a user wants to narrow
vi
ja

the results, a known value can be used as a filter on column criteria. For example, for the wireless
network connections, the -Windows-WLAN-
entry. Using the Event Description Summary column, the user can right-click the column and use the
Filter on column filter results to only
those entries associated with the WLAN service provider.

314 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

Figure 3.8.41 RESULTS OF 3 EVENTS AFTER NARROWING THE SEARCH DOWN TO EVENTID 8000
AND FILTERING ON COLUMN FOR WLAN

In some cases, it may not be necessary to apply an additional filter condition to the results, to identify the
relevant log entries. Instead, simply using the column sorting functionality of AXIOM Examine may be
sufficient. For example, if the initial filter results are relatively manageable, but they include entries
associated with numerous SIDs on the local system, the investigator can left-click the Security User ID
column, and sort numerically by user SID. The investigator can then use the up/down scroll bar to locate,
examine, or tag the en vely.
20
20
8/

Figure 3.8.42 COLUMN SORTING ONLY ON SID 1000 TO FIND EVENTIDS BELONGING TO DASHNER (IN
/2

THIS CASE)
x9
.m
ks
si

RUNNING EXERCISE
en
f or
dg

WINDOWS PREFETCH FILES

@
er
vi

• Select the Windows 8/10 Prefetch Files category.

ja

• Sort by the Application Name column.

• The CCSETUP522.EXE application was last launched on 9/21/16 at 3:08:13 PM. Create a new tag

MAGNET AXIOM EXAMINATIONS (AX200) 315

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

• The CCLEANER64.EXE was launched a total of 10 times on 10/10/16 at 7:28:45 PM and 4 times
on 10/20/16 at 3:13:05 PM.

• To understand the use of CCLEANER on the host system, we need to examine several artifact
categories. From the Artifacts drop-down menu of the FILTERS bar, check the following
categories:

• LNK Files

• Startup Items

• UserAssist

• Windows 8/10 Prefetch Files

• Windows Event Logs

• keyword search window on the FILTERS bar and click GO .

• In the NAVIGATION pane, select the LNK Files category and note the entries in the EVIDENCE
pane for 9/21/16 at 3:08:13 PM. The first entry is from the Desktop, most likely after the
application was downloaded, and installed, and the second is from the Start Menu, which is
probably where CCLEANER had an option to include in the Start Menu during the installation.

• Select the UserAssist category. Note the 2 entries for CCleaner64.exe, and the Last Run
Date/Time and Application Run Count values. It appears the user installed the application but
never ran the application.

• Select the Windows 8/10 Prefetch Files. Note the 2 entries for CCleaner64.exe and
CCleaner.exe. The CCleaner. exe application was launched 1 time, on 10/20/16 at 3:13:01 PM.
20

The CClean e is 10/13/16 at 9:45:42

20

PM.
8/
/2

Select the Startup Items category and view its entry in the EVIDENCE pane, identifying the
x9

•
.m

13/16 at 9:45:45 PM. The automated

ks

monitoring functionality of CCleaner.exe can account for the multiple launches, even though the
si
en
or

processes are not tracked in the UserAssist key of the NTUSER.DAT file, even though the user
f
dg

installed the client.

@
er
vi

• Select the Windows Event Log entries. Sort by the Security User ID column and note the
ja

with the

• Select the MATCHING RESULTS so all items are listed in the EVIDENCE pane. Select all items
and add them to the CCleaner tag.

316 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

• Clear all filters.

WINDOWS EVENT LOGS

• Select the Windows Event Logs category. We want to identify all successful connections to a
wireless network on the Dashner laptop.

• Sort by the Security User ID column in the EVIDENCE pane. This is one method for locating all
t. Instead, use
the Filter on column option.

• Right-click the Security User ID column and select Filter on column a search
term, and note the list is now limited to 28,457 entries. Still a large number of entries to
manage.

• Clear the filter conditions and return to the Windows Event Logs artifact.

• Right-click the Event ID column and use the Filter on column feature. Set the Number is
value to Equal to

• Right-click the Event Description Summary column and .

•
network connections.

• View the Event Data

are two SSIDs listed,

•
20

• Clear all filter conditions.

20
8/
/2
x9

MODULE REVIEW
.m
ks
si
en

In this module Students learned about: OS Artifacts, Registry Artifacts, USB tracking, Drive Letter for
f or

Mounted Devices, Time Zone Information, LNK files, Recent Docs, and Jump Lists. Students also learned
dg
@

ShellBags, Prefetch, Event Logs and how to filter on these items.

er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 317

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

REVIEW QUESTIONS
To help reinforce the learning objectives for this module, the following review questions have been
provided:
1. List the Windows registry files from which many of the Operating System artifacts are recovered?

2. The User Accounts artifacts are parsed from which two values in the SAM file?

3. What is the name of the key in the NTUSER.DAT file that allows AXIOM to link a USB device with
a user account?

4. The UserAssist key of the NTUSER.DAT file tracks applications launched by a user. In
addition to the application name, what two pieces of information does the key also provide?

5. What is the name of the scheme Windows uses to scramble the data in the UserAssist key?
20
20
8/

LNK Files are mainly r

/2

6. \Recent\ folder. What key in the NTUSER.DAT

x9
.m

file should also be examined for evidence of recently-accessed documents?

ks
si
en
f or
dg
@

7. If a user is suspected of watching a video from an external drive connected to the host system, what
er
vi

three OPERATING SYSTEM artifacts can help the investigator identify the name of the file, path
ja

for the file, and application used to watch the video?

318 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

8. The ShellBags artifact category is parsed from which Windows registry file?

9. The Windows Prefetch service provides investigators with which three key pieces of information?

10. What are the three core Windows Event Logs?

11. What AXIOM Examine feature allows investigators to quickly identify the most relevant Windows
Event Log entries?
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 319

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

Notes

320 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 3 Computer Artifact Analysis Part 8 Operating System

____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20
8/

____________________________________________________________________________________
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 321

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 3 Computer Artifact Analysis Part 8 Operating System

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

322 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

Module 4 Mobile Artifact Analysis

4

MODULE 4:
Mobile Artifact Analysis
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 323

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

324 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

LEARNING OBJECTIVES
In this lesson, students will take part in lecture, instructor-led exercises, and student practical exercises
to gain an understanding of the capabilities of Magnet AXIOM in recovering artifacts from mobile devices.
Supported Mobile Operating Systems will be discussed in detail, and how to acquire this data into
evidence files as well as how to process the artifacts from the mobile phone images. Students will learn
the artifact types accessible from mobile sources; and how to use AXIOM Examine to discover additional
data that is not a natively parsed artifact.

GOALS
At the conclusion of this lesson, students will be able to identify supported mobile operating systems and
add data from mobile sources to identify artifact types. Students will gain an understanding of how to use
Magnet AXIOM to conduct forensic examinations on mobile devices.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 325

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

SMARTPHONE OPERATING SYSTEMS

Magnet AXIOM can use and process images from multiple smartphone platforms. iOS, Android, Windows
Phone Series, and Kindle Fire phones are all supported for loading and processing with AXIOM Process
and AXIOM Examine. AXIOM Process can accept images from multiple platforms and types for each of
these operating systems, as well as offer the ability to image iOS and Android devices in addition to
processing them. To load images or file dumps for any of these mobile operating systems, choose
MOBILE from the SELECT EVIDENCE SOURCE screen. At that point, AXIOM/ will present options for
the four supported mobile operating systems to the user.

Figure 4.1 AXIOM SUPPORTED MOBILE OPERATING SYSTEMS

IOS
20
20

tem, iOS, is one of the most widely used operating systems worldwide. In 2016, 1
8/
/2

billion Apple devices were found to be in active use worldwide. Originally released in 2007, it did not have
x9

a specific name, and was called by er, the software was called iPhone OS.
.m
ks

It kept this name until 2010, when Apple changed the name to iOS with the release of the iPhone 4. Even
si

though it was called iPhone OS, it was the same operating systems used by the first-generation iPad and
en
or

early generations of the iPod Touch devices.

f
dg
@
er

as today. iOS shares many similarities with macOS (or Mac OSX as it was previously known). Both
vi
ja

operating systems are also based on the Unix operating system.

With each subsequent release of iOS, Apple adds features for the end users, but also closes security
holes, fixing exploits. These exploits may reduce the ability to gain information from the device by forensic
e
features, each version may also change what information can be obtained. For example, Apple stopped

326 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

examiners from using a diagnostic option to obtain data with the release of iOS 8 by locking out the
options to communicate using the diagnostic option.

Table 4.1 iOS release dates and supported hardware

Apple devices have several identifying values including the IMEI (international mobile equipment identity),
MEID (mobile equipment identifier), and serial number assigned by Apple. In addition to these values
commonly used by mobile service providers, Apple also uses a value known as the Unique Device
Identifier or UDID to help uniquely ID each device. This value is calculated based on hashing certain other
unique values on a device such as a unique chip ID, Wi-Fi MAC address, and Bluetooth MAC address.
The UDID is used by Apple to track devices within their internal structure. It is also used to uniquely
identify a backup on a PC. When an iOS device is plugged into a Windows PC, the UDID is also logged into
20

the registry of the PC. The UDID is a 40-character alphanumeric value.

20
8/
/2

There are two ways to find out a devi

x9
.m
ks

changes to UDID. However, this method will only work if the device is unlocked and paired with the PC
si

that iTunes is running on.

en
f or

Depending on the version of iOS, if the device is locked, it is still possible to find the UDID of the device
dg
@

using the following method.

er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 327

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

INSTRUCTOR DEMONSTRATION
UDID IDENTIFICATION
• Open Device Manager by runni devmgmt.msc -Run option.

• Expand the listing for Universal Serial Bus Controllers and locate the listing for Apple Mobile
Device USB Driver.
Note: If iTunes is not installed on the machine, the device will show up as Apple iPhone
(iPad/iPod) under the Portable Devices listing.

• Right-click on the listing for the device and select Properties.

• On the Details tab, select from the Property drop-down menu.

• The value that is loaded will contain the UDID as the last 40 characters. As an example, from the
above method, the value:
USB\VID_05AC&PID_12A8\B6400EF1103E745AF6CE6976CF3DD955FF4208BF
shows the device UDID as B6400EF1103E745AF6CE6976CF3DD955FF4208BF and allows us
to use the VID/PID values to see this is an iOS device.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 4.2 UDID of Apple mobile device

328 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

REGISTRY ENTRIES
Because the iOS device passes the UDID into the registry, this can be used to track this information on a PC.
Once an iOS device is plugged into the Windows PC, regardless if locked, trusted, or otherwise, the UDID
is logged as part of the device instance path within the SYSTEM registry key.

To check these values in AXIOM Examine, a user can expand the OPERATING SYSTEM category and select
the USB Devices artifact. AXIOM Examine will display the UDID of the device in the Serial Number
column. The Friendly Name column will also show that it refers back to an iOS device, as well as the
Device Class ID.

Figure 4.3 UDID recovered by AXIOM

To see all iOS devices that have been connected to the evidence PC, sort on the Friendly Name or Device
Class ID columns. The VID for Apple Devices is 05AC, while the PIDs for Apple Devices are:
20

• 1227 Mobile Device (DFU Mode)

20
8/

• 1281 Apple Mobile Device [Recovery Mode]

/2
x9

•
.m

1290 iPhone
ks
si

• 1291 iPod Touch 1.Gen

en
f or

• 1292 iPhone 3G
dg
@
er

• 1293 iPod Touch 2.Gen

vi
ja

• 1294 iPhone 3GS

• 1296 iPod Touch 3.Gen (8GB)

• 1297 iPhone 4

MAGNET AXIOM EXAMINATIONS (AX200) 329

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

• 1299 iPod Touch 3.Gen

• 129a iPad

• 129c iPhone 4(CDMA)

• 129e iPod Touch 4.Gen

• 129f iPad 2

• 12a0 iPhone 4S

• 12a2 iPad 2 (3G; 64GB)

• 12a3 iPad 2 (CDMA)

• 12a4 iPad 3 (WiFi)

• 12a5 iPad 3 (CDMA)

• 12a6 iPad 3 (3G, 16 GB)

• 12a8 iPhone5/5C/5S/6/6+/6S/7/7+/8/8+/10

• 12a9 iPad 2

• 12aa iPod Touch 5.Gen [A1421]

• 12ab iPad 4/Mini1

To exemplify this, under the USB Devices Artifact, right click on the column Device Class ID and choose
Filter on column. When presented with options for filtering, enter the Apple-
and choose SEARCH . All Apple devices will be displayed.
20
20
8/

ITUNES BACKUP
/2
x9
.m

iOS devices can leave backups behind on PCs. These backups are referred to as iTunes backups and are
ks
si

essentially a copy of the iOS device frozen at a point and time. Most of the data that a forensic examiner
en

would obtain from an iOS device comes from this backup process, so finding previously saved backups
f or
dg

on a PC are a great source of evidence. It can also provide information from a device that an examiner
@

cannot get into due to handset passwords or a lost device.

er
vi
ja

Saved iOS Backups generated with iTunes can be found on a Windows PC under the following directory:
\Users\<username>\AppData\Roaming\Apple Computer\MobileSync\Backup\

Because the backups are stored in the User area of the file system, it may be possible to find multiple
copies of the same device under separate windows users.

330 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

Figure 4.4 iOS backup path stored by UDID

Inside of the \Backup\ folder, there will be folders for each specific device that was backed up, listed by
their UDID. A UDID may be listed multiple times but will be appended by a 24hr date/time value. This
refers to a backup that was performed on a previous version of iTunes and may not be complete backups.
a user will find multiple files with alphanumeric names.
These files will have no file extension. These files represent a file that belongs on the iOS device. The
names reflect a SHA1 value, however, instead of being the hash of the file itself, it is a hash of the path of
the file as it relates to the original device. Apple does not store the full path, but instead uses a list of
s include:
• AppDomain-com.some.user.installed.app
• CameraRollDomain
• DatabaseDomain
• HomeDomain
•
20

KeychainDomain
20

• ManagedPreferencesDomain
8/

•
/2

MediaDomain
x9

• MobileDeviceDomain
.m
ks

• RootDomain
si

•
en

SystemPreferencesDomain
or

• WirelessDomain
f
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 331

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

Figure 4.5 SHA1hash value of path to file on iOS device

To calculate the value, Apple uses the domain followed by the rest of the path. An example would be for
the sms.db file which contains all the iMessages, SMS and MMS messages on the Apple device. Its full
path on a device is /private/var/mobile/Library/SMS/sms.db but is represented in the backup as
HomeDomain-Library/SMS/sms.db. To calculate the SHA1 value name for the sms.db file:

HomeDomain-Library/SMS/sms.db = 3d0d7e5fb2ce288813306e4d4636395e047a3d28

Therefore, if a user would find the file 3d0d7e5fb2ce288813306e4d4636395e047a3d28 in any

iOS backup, it would reflect the SQLite database containing these messages.
20
20
8/
/2
x9
.m
ks
si
en

Figure 4.6 HashCalc example of SMS.DB path and its SHA1 value
f or
dg
@

A full list of all the paths (with domains) can be found in the manifest.mbdb file for devices running iOS
er
vi
ja

9 or below. This is a proprietary file which stores the paths in text. With iOS 10, Apple changed from this
.mbdb file to an SQLite database called Manifest.db.

In addition to the SHA1 named files, there are several .plist (property list) files on the computer where
the Apple device was backed up. These three files, Manifest.plist, Status.plist, and Info.plist reflect

332 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

information from the device that was backed up. These files do not belong on the device itself but contain
important information about the device such as name, IMEI, UDID, and when it was backed up.
The Info.plist file contains the majority of the information of concern to the Forensic Examiner. It
contains:
• Device Name
• Display Name
• GUID
• ICCID
• IMEI
• Last Backup Date
• Phone Number
• Product Type
• Product Version (iOS Version)
• Serial Number
• UDID
• iTunes Version
• List of Installed Applications
• List of Applications in Library
The Manifest.plist is a binary plist file (unlike the Info.plist, which is XML formatted) containing
several important pieces of information such as whether or not the backup is encrypted, the UDID of the
device, and whether or not a passcode was set on the device. The Status.plist file contains the UDID,
the state of the backup, and whether or not it is a full backup.
Each of the SHA1 named files can be directly opened, by a viewer capable of doing so, but the file
extensions are not present. If the files are viewed in a Hex editor, all the file headers would match the
type of file each one actually was.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 333

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

Figure 4.7 PREVIEW card of an INFO.PLIST file

LOADING FORENSIC IMAGES/DATA INTO AXIOM

As part of the normal operation of AXIOM Process, iTunes backups are automatically ingested, parsed,
and sorted into artifacts for the examiner to review in AXIOM Examine. However, when an iTunes backup
is encrypted that automatic ingestion cannot happen. With the release of AXIOM 1.1, support for adding
evidence to an existing case was introduced.
In order to process the encrypted iTunes backup,
backups are stored by iTunes in the following location:
20
20

\Users\<username>\AppData\Roaming\Apple Computer\MobileSync\Backup\
8/
/2

In AXIOM Examine, choose the File system explorer and browse your way to the path mentioned above
x9
.m

in the Dashner user profile. Inside of the \Backup\ folder you will see a folder with the same UDID as the
ks
si

IOS device. In the EVIDENCE pane, right click on the folder and choose the option to Save file / folder
en

to ZIP as seen in Figure 4.8.

f or
dg
@
er
vi
ja

334 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

Figure 4.8 Saving iTunes backup to a zip file on the examiner system

After having saved the backup to a zip file you are now ready to ingest the backup into the Case using AXIOM
Process.

RUNNING EXERCISE
ADDING IMAGES TO AXIOM USING AN EXISTING CASE
• Close AXIOM Examine.
20

• Launch AXIOM Process form the desktop of the student machine.

20
8/

•
/2

Choose the option to open a recent case and open the Dashner case.
x9
.m

• In the SCAN INFORMATION area enter the specifics of the new scan. In this case, select the
ks

Description
si
en

box.
f or
dg

•
@

Select GO TO EVIDENCE SOURCES .

er
vi

• As this is a Mobile Backup, select MOBILE under SELECT EVIDENCE SOURCE.

ja

• Under SELECT EVIDENCE SOURCE, select IOS as this is an IOS backup.

• Select LOAD EVIDENCE.

• Select IMAGE.

MAGNET AXIOM EXAMINATIONS (AX200) 335

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

• Choose the Dashner IOS Backup.zip file and choose Open .

• When presented with the Backup Encryption Password window use , as

shown in Figure 4.9 and select OK

Figure 4.9 Backup encryption recognized

• If you typed the password in correctly you will see the Dashner IOS Backup.zip file and the
folder structure under it containing the UDID of the IOS device pertaining to the backup.

• Select the ANALYZE EVIDENCE option and choose ANALYZE EVIDENCE .

When AXIOM detects that an iOS backup is utilizing backup encryption, it will alert the user to enter in the
password.
This password is separate from the iOS device lock or iCloud password. It is set by the user connecting
the device to iTunes then checking the option for enabling encryption. If the device is managed by an MDM
(mobile device manager) software, backup encryption may also be enabled.

IMAGING IN AXIOM
20
20
8/

In addition to loading the previously created backups, AXIOM Process also has the ability to directly image
/2
x9

iOS devices. Once an iOS device is connected, it will appear under the ACQUIRE EVIDENCE window as
.m

long as all the necessary steps have been taken. AXIOM Process will display an Apple logo for each
ks
si

detected iOS device. In addition, it will display a model number, OS version, device shell color, and
en

whether or not the device has privileged access. Only a Quick image type will be available unless AXIOM
f or
dg

reports that privileged access is set to Yes.

@
er
vi
ja

336 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

Figure 4.10 AXIOM acquisition options

The model number reflects the internal numbering structure that is used by Apple. A full breakdown of
the devices to their internal numbering is:
IPAD:
• iPad (1st Generation): iPad 1,1
• iPad 2: iPad 2,1; iPad 2,2; iPad 2,3; iPad 2,4
• iPad 3: iPad 3,1; iPad 3,2; iPad 3,3
• iPad 4 (with Lightning port): iPad 3,4; iPad 3,5; iPad 3,6
• iPad Air: iPad 4,1; iPad 4,2; iPad 4,3
• iPad Air 2: iPad 5,3; iPad 5,4
• iPad Pro (12.9 in): iPad 6,7; iPad 6,8
• iPad Pro (9.7 in): iPad 6,3; iPad 6,4
IPAD MINI:
• iPad Mini: iPad 2,5; iPad 2,6; iPad 2,7
20
20

• iPad Mini 2: iPad 4,4; iPad 4,5; iPad 4,6

8/
/2
x9

• iPad Mini 3: iPad 4,7; iPad 4,8; iPad 4,9

.m
ks

• iPad Mini 4: iPad 5,1; iPad 5,2

si
en
or

IPHONE:
f
dg
@

• iPhone: iPhone 1,1

er
vi

•
ja

iPhone 3G: iPhone 1,2

• iPhone 3GS: iPhone 2,1
• iPhone 4: iPhone 3,1; iPhone 3,2; iPhone 3,3
• iPhone 4S: iPhone 4,1

MAGNET AXIOM EXAMINATIONS (AX200) 337

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

• iPhone 5: iPhone 5,1; iPhone 5,2

• iPhone 5C: iPhone 5,3; iPhone 5,4
• iPhone 5S: iPhone 6,1; iPhone 6,2
• iPhone 6: iPhone 7,2
• iPhone 6+: iPhone 7,1
• iPhone 6S: iPhone 8,1
• iPhone 6S+: iPhone 8,2
• iPhone SE: iPhone 8,4
• iPhone 7: iPhone 9,1; iPhone 9,3
• iPhone 7+: iPhone 9,2; iPhone 9,4
• iPhone 8: iPhone 10,1; iPhone 10,4
• IPhone8+: iPhone 10,2; iPhone 10,5
• IPhoneX: iPhone 10,3; 10,6
IPOD TOUCH:
• iPod touch: iPod 1,1
• iPod 2G: iPod 2,1
• iPod 3G: iPod 3,1
• iPod 4G: iPod 4,1
20

• iPod 5G: iPod 5,1

20
8/
/2

• iPod 6G: iPod 7,1

x9
.m

If there is a password on the iOS device AXIOM will display the message in Figure 4.11 until the trust
ks
si

relationship with the forensic computer has been established.

en
f or
dg
@
er
vi
ja

Figure 4.11 Trust This Computer notification in AXIOM Process

338 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

Prior to acquiring iOS devices, the iTunes software needs to be installed by the end user. The iTunes
software installs the drivers for all iOS devices. Due to legal restrictions, these drivers cannot be
packaged outside of iTunes and Apple requires the entire software package to be downloaded and
installed to use the drivers. The newest version of iTunes can be located at:
http://www.apple.com/itunes/download/
Connected iOS devices will also display a warning to the user to unlock the device and accept the pairing
record. If the device is locked, this pairing record cannot be authorized, and AXIOM will not be able to
communicate with the device.
In iOS version 6, Apple added a new le
Before the computer can gain access to the device to pass data and communicate with it, the end user
he iOS device, as shown in Figure 4.12.

generated and saved on the PC in the folder:

C:\ProgramData\Apple\Lockdown

The Property List (plist) will have the naming convention mirroring the UDID of the Apple Device pairing

no pairing record will be created, and no data communication will be possible. Regardless of which option
a user presses, the device will still create a registry entry once it is connected.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi

Figure 4.12 Trust This Computer notification on iOS device

ja

In previous versions of iOS, the pairing re

higher, the pairing record is more secure, and will be invalidated once the Apple device is rebooted.

MAGNET AXIOM EXAMINATIONS (AX200) 339

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

MOBILE IMAGE TYPES

AXIOM Process has two options for iOS imaging. By default, all imaging will be carried out using the Quick
option. This only requires the device to be connected and the pairing record to be accepted. The Quick option
will perform several steps based on the version of iOS that is running but will be able to acquire most of the
relevant data. The information acquired by this method is in line with other forensic vendors on the market.
Unlike most vendors, Magnet Forensics chooses to use the terminology Full and Quick versus Physical
and Logical which have different connotations when it comes to computer forensics vs mobile forensics.

A Full image is only available when the Apple device is jailbroken. AXIOM will check for this authority and
report it under the Privileged access listing. If the access is detected and displays Yes, then the drop-down
box will be active and allow the user to create a full image of the device.

Figure 4.13 Quick and Full acquisition types

Depending on the version of iOS that is detected, AXIOM will attempt a number of acquisition methods to
obtain the most data available. Most of the data will be acquired by using the iTunes Backup Process. This
method will be attempted on all versions of iOS. Using the same backup process as iTunes, this method
will obtain most user data including SMS/iMessage/MMS, Contacts, Call Logs, Web History, 3rd party data,
and more.
Depending on the version of iOS, other methods may be applied to acquire data. These methods include
the Apple File Conduit and Apple File Relay methods. The Apple File Relay method uses a diagnostic tool
to acquire copies of the core databases from the operating system. This method will also bypass iTunes
Backup Encryption.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Table 4.2 AXIOM acquisition methods depending on iOS version

340 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

IOS FULL IMAGES AND JAILBREAKING

To obtain the Full image type using Magnet AXIOM, the device must be jailbroken and have a specific
tweak installed. This tweak, or unauthorized package, is called It is
produced by the founder and maintainer of the Cydia application repository. It allows for a USB connection
to connect to and communicate with the raw file system of the device. This allows AXIOM Process to
obtain all the logical files on the device.
This AFC2 method is not used by many new jailbroken tools as it also removes file system protection.
Jailbreaking the iOS device is not always possible. It should be evaluated on a case-by-case basis.
Currently, only certain versions of the iOS operating system are eligible for jailbreaking. Because each
version of the operating sys
where Apple stops its signing support, there are some versions that never gain jailbreak functionality.
Jailbreaking removes the restrictions on the operating system created by Appl
philosophy. This allows for a user to install applications or modifications to the device that have not been
approved by Apple. It could allow a user to reskin the device to use different logos and visual options and
install software that was not meant or approved to run on the device. For forensics, a jailbroken device
means the removal of the gateways or restrictions that stop the acquisition of the entirety of the data.
The device is still encrypted, regardless of its jailbroken state. By having a jailbroken device, the examiner
can access ALL the logical files on the device instead of the interpreted data fed to them by the API Apple
driver, via the backup process.
When AXIOM Process obtains a full image from a jailbroken device, the entire file system is recovered.
Apple uses symbolic links within the file system. This may lead to duplicate files being recovered due to
extra copies of files existing within the file system.
Because ALL files from the file system are recovered, additional data points will be available for parsing.
Email from the core Mail.App application will be available in the analysis as well as third party artifacts
regardless of whether the developer selected them to be part of the backup process. Other artifacts like
20

iOS Snapshots, Spotlight searches, and additional location data will also be populated from a full image.
20
8/
/2
x9
.m
ks
si
en
f or
dg
@

Table 4.3 Jailbroken Apple device acquisition using AFC2

er
vi

AXIOM Process produces two log files when acquiring data from mobile devices. These two files are the
ja

image_info and activity_log files. The image_info file stores information about the device as well
as the imaging process including identifiers, segment locations and, time and date of the process. An
example of an image log follows:
Imager Product: IEF
Imager Version: 1.0.6.2484

MAGNET AXIOM EXAMINATIONS (AX200) 341

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

Examiner Name:
Evidence Number: dashner’s iPhone
Description:

Relative Activity Log Path: activity_log.txt

Original Activity Log Path: C:\Users\cvance\Desktop\AXIOM - May 52016
100546\activity_log.txt
Activity Log MD5 Hash: E72F38B45C016F8EACA48BA1AE5396D4

Output Directory: AXIOM - May 5, 2016 100546

Full Output Directory: C:\Users\cvance\Desktop\AXIOM - May 52016 100546

Total Segments: 1

Relative Segment 1 Path: Apple iPhone6,1 quick image.zip

Full Segment 1 Path: C:\Users\cvance\Desktop\AXIOM - May 52016 100546\Apple iPhone6,1
quick image.zip
Segment 1 MD5 Hash: 2DB07C7ED94F6D3AC8D6E3318AD15E2D
Segment 1 SHA1 Hash: DD8FA612328A5DDB860726D41EECD4330ECBB2B3

Imaging Start UTC: 2018-05-20 14:11:22

Imaging Start UTC Ticks: 636125694822677036
Imaging End UTC: 2018-05-20 14:12:33
Imaging End UTC Ticks: 636125695534590874

Device Information
Manufacturer: Apple
Product Model: iPhone6,1
Operating System Version: 9.3.3
Unique Identifier: b6400ef1103e745af6ce6976cf3dd955ff4208bf
Serial Number: F17ML38LFNJJ

Additional Device Information

Device Class: iPhone
Device Color: #3b3b3c
Device Name: dashner’s iPhone
20

Firmware Version: iBoot-2817.60.2

20

Hardware Model: N51AP

8/

Hardware Platform: s5l8960x

/2
x9

MLB Serial Number: F3X41640DN6F7GRA

.m

Password Protected: false

ks

Time Interval Since 1970: 1476972331.756091

si

Time Zone: America/Toronto

en

Time Zone Offset From UTC: -14400.000000

f or

Trusted Host Attached: true

dg
@

Unique Chip ID: 5566054799920

er

Unique Device ID: b6400ef1103e745af6ce6976cf3dd955ff4208bf

vi

Device Enclosure Color: #99989b

ja

Backup Encrypted: False

The activity_info log file will store information about the process that was performed on the device
during the acquisition. It will keep a log of what steps were taken and if any of those steps failed to execute
properly. An example output from an iOS device is as follows:

342 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

2018-05-20 14:11:22 Info: Starting backup on device

b6400ef1103e745af6ce6976cf3dd955ff4208bf’.
2018-05-20 14:11:39 Info: Starting backup filesystem compressing from device
‘b6400ef1103e745af6ce6976cf3dd955ff4208bf’.
2018-05-20 14:11:42 Info: Initiating file relay for device
‘b6400ef1103e745af6ce6976cf3dd955ff4208bf’.
2018-05-20 14:11:42 Error: An exception was caught while trying to read file relay for
device ‘b6400ef1103e745af6ce6976cf3dd955ff4208bf’.
SystemNotSupportedException: File relay is not supported on iOS 8+
2016-10-20 14:11:42 Info: (Re)starting AFC service.
2018-05-20 14:11:42 Debug: Starting AFC service on the device using the lockdown escrow.
2018-05-20 14:11:43 Debug: Stopping current AFC service...
2018-05-20 14:11:43 Info: (Re)starting AFC service.
2018-05-20 14:11:43 Debug: Starting AFC service on the device using the lockdown escrow.

IMAGE FILES
The image file on an iOS device from both the quick and full types of acquisitions will be a .zip compressed
file. Within a quick image, the .zip file will contain the backup-enabled files, property list files containing
information about the backup, and if available files from the AFC collection.
A full image will contain the entire file system which is compressed into a .zip file. Due to use of
symbolic links, there may be duplicates of files in the file system.
20
20

Figure 4.14 Image file displayed in Windows Explorer

8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 343

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

INSTRUCTOR DEMONSTRATION
ACQUIRING AN IOS DEVICE
• Connect the device to the examination machine.

• Unlock t

• Open AXIOM Process from the Desktop.

• In the CASE DETAILS pane assign the file paths and case name.

• In the EVIDENCE SOURCES, under SELECT EVIDENCE SOURCE, choose MOBILE.

• Under SELECT EVIDENCE SOURCE, choose IOS.

• Under IOS LOAD OR ACQUIRE, choose ACQUIRE EVIDENCE.

• Select the device when it appears and click NEXT .

• Unless the device is Jailbroken, leave the IMAGE TYPE as Quick.

• AXIOM Process then provides the option to create an encrypted backup. If a password is added,
additional information such as the Home data and keychain will be acquired.

• Jump to the Mobile artifacts section.

• Press CLEAR ALL.

• Under the OPERATING SYSTEM section, select the File System Information artifact.

• Press GO TO ANALYZE EVIDENCE , then press ANALYZE EVIDENCE .

20
20

• ed but the File

8/
/2

System Explorer artifacts.

x9
.m
ks
si

ACQUIRING AN ANDROID DEVICE

en
or

•
f

Connect the device to the examination machine.

dg
@
er

• Ensure USB debugging is enabled by swiping down from the top of the screen and pressing the
vi
ja

• In Settings, scroll down to Developer Options. In this menu, ensure USB Debugging has been
checked.

• Open AXIOM Process from the Desktop.

344 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

• When prompted with a security prom

• In the CASE DETAILS pane assign the file paths and case name.

• In the EVIDENCE SOURCES, under SELECT EVIDENCE SOURCE, choose MOBILE.

• Under SELECT EVIDENCE SOURCE, choose Android.

• Under ANDROID LOAD OR ACQUIRE, choose ACQUIRE EVIDENCE.

• Select the device when it appears and click NEXT .

• At the SELECT IMAGE TYPE screen select a Quick image.

• Jump to the Mobile artifacts section.

• Press CLEAR ALL.

• Under the OPERATING SYSTEM section, select the File System Information artifact

• Press GO TO ANALYZE EVIDENCE , then press ANALYZE EVIDENCE .

• File
system explorer being available.

MOBILE ARTIFACTS
AXIOM Process will present the Mobile artifact categories in the left pane of the program. By default,
all artifacts will be loaded in the right pane. When highlighting a category, the artifacts associated with
20

that category will be loaded into the right pane. To select an entire category the user can place a check in
20

the box beside that category. The same applies for individual artifacts in the right pane.
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 4.15 Mobile artifacts in AXIOM Process

MAGNET AXIOM EXAMINATIONS (AX200) 345

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

Some artifacts will have an OPTIONS link as seen in Figure 4.16. These links allow the user to set specific
options about that artifact. Sometimes this is to provide an additional passcode like the iOS Mobile
Backup artifact. This will allow the user to provide the passcode to decrypt the iOS backup. Other option
buttons like on the Videos artifact allow the user to export the video files as part of the evidence
processing step.

Figure 4.16 Video artifact during AXIOM Process

SQLITE AND PLIST FILES

Most of the artifacts in iOS come from two types of data files. These are SQLite databases and property
list files. AXIOM Process will go through each of these types of files for specific artifacts recovering any
active records. In some cases, AXIOM Process will also carve these databases and other files for
additional or potentially deleted data.
The majority of the data comes from the directory in the file system known as /private/var/mobile.
The three subdirectories which hold large amounts of data are /Library/, which holds most of the core
user data; /Media/, which contains the camera roll, pictures, and videos on the device; and
20
20

/Containers/, which contains third-party and core application data on the device.
8/
/2
x9

There are two types of Property List Files within the iOS file system. The first type, XML, are easy for an
.m

examiner to read with readily accessible tools. They are formatted with standard XML (Extensible Markup
ks
si

Language) and can be read by any tool which can show HTML/XML code. These property list files have a
en

standard header, which in ASCII is:

f or
dg

<?xml version=”1.0” encoding=”UTF-8”?>

@

<!DOCTYPE plist SYSTEM “file://localhost/System/Library/DTDs/ PropertyList.dtd”>

er
vi

<plist version=”1.0>.
ja

They also have a standard footer, which is:

</plist>

346 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

The second type, binary plist files, are formatted to be easily read by computers instead of humans. These
re a
separate viewer to decode and view the text data stored within.
Both types of property list files will store text data and Base-64 encoded data. They may use the base-64
data to store other property list files, pictures, videos, or just additional text stores. Binary and XML plist
files are widely used across the device to store user and configuration information such as previously
connected wi-fi networks. They are also used in third-party application data to store configuration
information for each app which can contain usernames, install date/times, last opened date/times, and
more. In addition to the file
iTunes/iCloud backup process to store information about the device that was backed up.
In the MAC and iOS Operating Systems there are no registry Hives like in Windows and Windows Mobile
devices. Instead, iOS uses plist files as registry files as well as individual application configuration files.
The other heavily used storage type is the SQLite database. These are used to store information both
from the core operating system and third-party applications. Contacts, Call Logs, SMS/iMessages,
Emails, Web History, and more are stored within SQLite databases. The SQLite databases have multiple
file extensions including .db, .storedata,.sql, .sqlite., and some have no extension at all. These databases

iOS uses SQLite version 3.7 which means they use write-ahead logs more extensively than older rollback
journals. Because of this the data may be stored within the write ahead log instead of the main database
in the core file system. When a backup process occurs on the Apple device, active records from the
temporary files are checked into the main databases, which is then passed to the examiner. This means
that potentially deleted data still exists on the device, but only available if the user can acquire through a
jailbroken device and to access the core file system and not through the backup process.
NOTE: If the examiner is in possession of a jailbroken phone, Magnet Forensics
image be acquired.
20
20

VIEWING ARTIFACTS
8/
/2
x9

AXIOM Examine offers several helpful ways to review the data that comes from the iOS operating system.
.m

In addition to the Artifacts explorer, the File system explorer offers several tools to help review plist
ks
si

and SQLite database files. Within the Artifact explorer, users have the option to see the data in several
en
or

different ways including sorting the data by time, report geolocations, or by a threaded view for many
f
dg

chat clients. The data can also be viewed in Row, Column, or Classic view.
@
er
vi

Newly available views such as Thumbnail view can help filter the acquired data. Examiners can then
ja

use the views set to see data in whatever way to assist the examiners workflow.

MAGNET AXIOM EXAMINATIONS (AX200) 347

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

Figure 4.17 Views available in AXIOM Examine

CONVERSATION VIEW
The Conversation view can be used on all artifacts grouped into the CHAT categories as seen in Figure
4.17.
20

The Conversation view is one of the most helpful of the views and will automatically filter the available
20

results into an easy to use conversation. Each threaded chat will display the data as it appears on the
8/
/2

device. This allows the user to view the chats as they would have appeared, sorted based upon the
x9
.m

time/date of the message. It is also easy for the user to export the data in this view into both PDF and
ks

HTML formatted reports.

si
en
f or
dg
@
er
vi
ja

348 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

Figure 4.18 CHAT category

20
20
8/
/2
x9
.m
ks
si
en
or

Figure 4.19 Conversation view in PREVIEW card

f
dg
@

In addition to the Artifact explorer, examiners now have access to the File system explorer. This allows
er
vi

users to view the SQLite and property list files in a raw view directly within AXIOM Examine. By selecting
ja

a SQLite database from the File system explorer, a built-in SQL viewer will be presented, allowing the
user to review all the records of the database whether they were directly parsed or not. This allows a
parsed by AXIOM Examine.

MAGNET AXIOM EXAMINATIONS (AX200) 349

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

Figure 4.20 EVIDENCE INFORMATION from DETAILS Card showing SQL tables

XML property list files are viewable in the PREVIEW card, which will appear when the file is selected. This
will allow the user to review additional configuration information and other data found within these files.

CUSTOM ARTIFACTS
The Custom Artifacts can be incredibly beneficial to examiners in mobile device cases. Dynamic App
Finder will parse through SQLite database tables that do not match already parsed artifacts and display
them for additional examinations. Custom Artifacts was created primarily for mobile chat applications,
however, can be used for other applications as well. Columns for each table can be assigned as one of four
types: Message, Date/Time, Sender, or Recipient. By selecting the drop-down for the wanted column, the
examiner can select one of the four options. Any changes are shown in the preview window. When the
Date/Time type is selected, AXIOM will attempt to auto-set the correct type of date and time from Mac
Absolute Time, Google Chrome Time, Unix, and Windows Time.
To deselect tables that are not to be included into AXIOM Examine, the examiner should remove the check
from the box in the enabled column.
20

Pressing the Save Selected Artifacts options will add any new definitions to the Custom Artifacts
20
8/

database preserving them for use in later cases.

/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

350 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

Figure 4.21 CUSTOM ARTIFACTS builder

ANDROID OS
The Android operating system is currently the most widely used operating system in the world. Android
is based on the Linux kernel, and is mostly open source. It is as some
of the code is still maintained and protected by Google Inc., the current owner of Android. Unlike iOS,
which is solely made by Apple in terms of hardware and software, Android devices are made by multiple
manufacturers worldwide, which means there are often slight changes between devices including where
some data may be stored, default features, and more.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 4.22 Android

Because both manufactures, and carriers have a hand in the distribution of the operating system updates,
there are several devices which may never get the latest version of the OS, and may be kept on older,
less secure versions. This may allow forensic analysts to obtain additional data from these devices.

MAGNET AXIOM EXAMINATIONS (AX200) 351

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

ACQUIRING ANDROID DEVICES

There are several steps that are needed to be taken to analyze Android devices. As with many devices,
one of the most important steps is a driver needs to be on the host machine to allow communication with
the device. Because of how Android devices communicate, they also require an option known as USB
debugging to be enabled.
Finally, depending on the level of communication that is needed, root level authority on the device may
also be required.

Figure 4.23 ADB Debugging demystified

Drivers are a very important part of the communication process. Each Android device will have a set of
drivers that can be used. Many times, the drivers which are installed are dependent upon the
20

manufacturer. There may be a driver for the modem, one for the COM port communication, another for
20
8/

special software installation from the carrier, etc. The driver that matters the most for forensics is the
/2
x9

ADB Driver. This is a separate driver that allows for the ADB communication to complete. Some other
.m

drivers may work, but it is best to use a dedicated ADB driver. Once the device is placed into USB
ks

debugging mode, the ADB debug driver can be installed by a manufacture source or by a third-party
si
en

vendor, i.e. a generic or vendor-neutral driver.

f or
dg

The ADB driver Magnet AXIOM uses can be found in the following directory after the installation of Magnet
@

AXIOM:
er
vi
ja

C:\Program Files\Magnet Forensics\Magnet AXIOM\AXIOM Process\Local ADB Driver\

352 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

Figure 4.24 ADB driver installation for Android

WHAT IS ADB
ADB stands for Android Debug Bridge and this is the communication protocol developed for Android. It
allows for the communication of devices to a host machine using a client/server environment. The ADB
server is broken up into three parts. A client, server, and daemon. The client and server run on the
development or forensic machine. The server handles background communication while the client is what
will talk to the daemon. The ADB daemon runs on the Android device in the background. All forensic tools
use the ADB protocol to communicate with Android devices in one way or another. A daemon is
synonymous with a service running on a device.
It is possible to obtain the ADB setup by downloading the Android SDK for Google from
20

http://developer.android.com. In addition, Magnet AXIOM has also included a version of the ADB setup to
20

allow it to communicate with plugged in devices. This is found under:

8/
/2

C:\Program Files (x86)\Magnet Acquire\ADB\

x9
.m
ks

Magnet AXIOM will use this version of the ADB commands to communicate with the connected device and
si
en

perform several functions such as installing a custom application, performing backups, attempting
or

software exploits, and extracting files from the file system.

f
dg
@

Having ADB access a device is a great way to troubleshoot it to make sure it is connected and available
er
vi

for extraction. To do this, open Windows Explorer and browse to the directory:
ja

C:\Program Files (x86)\Magnet Acquire\ADB\

MAGNET AXIOM EXAMINATIONS (AX200) 353

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

• adb devices This queries the device to make sure it is connected. It will return the Android ID for
any connected device as well as a status for the device such as authorized, unauthorized, offline,
or recovery.
• adb shell This command opens a Linux shell into the device which can be used to check root
level permission or

if the device is utilizing a superuser application to help manage root permissions.

• adb install [path to apk] This will install an application by pointing it to an .apk file on the system.
• adb pull [path on device] [path on local machine] This will pull files from the android device. (File
system permission dependent)
• adb push [path on local machine] [path on device] This will push files to the android device. (File
system permission dependent)

DEVELOPER OPTIONS
For the ADB protocol to work, Developer Options must be enabled on the device. Since Android version
4.2, the developer options area was hidden from the end user. To re-enable this menu, locate the About
Device Build Number is displayed. Tap on Build
Number 7 times until a pop-up window displays Developer mode has been turned on. Once developer
options are enabled, a separate menu will be available under the Settings area.

USB DEBUGGING
Once the developer options are re-enabled, USB debugging can be turned on. By default, USB Debugging is
20

turned off by the Operating System. The ADB protocol being left open could allow users unauthorized
20

access to a device. This is a downside for forensic examiners. Because the USB debugging option cannot
8/
/2

be turned on unless the device is unlocked. Without the debugging option, ADB communication be
x9

enabled either.
.m
ks

If the device is unlocked, USB debugging can be enabled by using the menus to navigate to Settings -
si
en

Developer Options -USB Debugging. Select the checkbox for this option to enable it. In newer versions
f or

of Android, a separate pop-up is displayed warning against enabling this option, making it less likely a
dg
@

user would enable it.

er
vi

Also, under this option menu is a Stay Awake option. This option keeps the screen on and keeps
ja

the device from locking with a handset password if it is connected to power. This option should be enabled
by first responders if available.
With the release of Android 4.2.2 an additional security prompt was added to reduce unauthorized access.
Once developer options have been enabled and USB debugging turned on, an additional prompt will appear.
This prompt will appear for each computer the device connects to as it uses unique RSA keys for each

354 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

computer. These RSA keys stored on the device under /data/misc/adb/adb_keys. As new keys are
added, the file is appended to.
To
run on the host computer. If the prompt display, there are a few troubleshooting steps that can be
taken including:
Rebooting the Device
-
Pressing Revoke USB Debugging authorizations from the Developer Options menu
While the previous options are needed to enable communication, an additional option is needed for enable
logical extractions. By default, Android only allows for approved sources to install applications. The
whitelist is provided as part of the Google Play store. To install applications from additional sources, the
Unknown option must be enabled. In most versions of Android, this can be found under Settings
→ Security.
This option allows for the installation of applications from third party application stores and also the
applications. This means that any application can be installed into an Android device with this
option enabled. Forensic suites use this option to inject a custom application to recover information from
the Android device.
The Verify apps option should also be unchecked. This option will check applications before they run,
which is good for applications that may include malicious code. However, some of the commands used by
forensic applications can also trigger this warning.

ANDROID IMAGE TYPES

After all the needed communication steps, have taken place and the device is seen by AXIOM Process, there
20

are two types of images that can be acquired. A Quick image will capture active data on the device including
20

SMS, Contacts, Call Logs, and more using an APK installation to capture information. In addition, it will
8/
/2

also perform an ADB backup command to gather information.

x9
.m

A Full image will capture the entire block of memory of the device, however, this requires the device has
ks
si

root level access. This is done by installing a security exception which removes the protection put in place
en

by the operating system designers.

f or
dg
@
er
vi
ja

Figure 4.25 Alert by AXIOM Process that device has rivileged access F

NOTE: If privileged access exists it is the recommendation of Magnet Forensics to conduct a Full
Image.

MAGNET AXIOM EXAMINATIONS (AX200) 355

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

Within the settings for AXIOM Process, the user can set an option for Device By default, the
.APK file that is installed for a quick image is left on the device after the acquisition process is complete.
This will leave the .apk on the device as well as the data that it gathers under the directory
/data/com.magnetforensics.acquire/. By checking the Device within the AXIOM
settings, this will trigger the software to be uninstalled after the data is gathered.

Figure 4.26 AXIOM Process settings to RESTORE DEVICE STATE after acquisition

When using the Quick image, two sets of data are recovered. The first, Agent Data, will show information
that has been recovered using the Magnet AXIOM .apk agent. The agent will acquire SMS/MMS data from the
mmssms.db file and contact/call logs will be recovered from the Contacts3.db file. The actual database files
will not be acquired due to the security of the device, however, copies of the active information of the data from
the database will be extracted.
The second set of data, adb-data.tar, will include information from the adb backup information. There are two
folders within this tar file, Shared and Apps. Shared will contain information from the operating system
and the internal (emulated) or external microSD cards. The Apps folder will contain information that
20
20

developers have chosen to be backed up from core and third-party applications. This is not a true file system
8/

copy of the device, only what developers have chosen to be backed up, and areas of the file system that are
/2
x9

not protected.
.m
ks
si
en
f or
dg
@
er
vi
ja

356 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

ROOTING

Figure 4.27 Android ROOT

Before the Full image type in AXIOM can be explained, rooting must be explained. Similar to jailbreaking
in the iOS device, rooting obtains level or elevated user permissions to the file system of the device.
By default, Android locks most the of core storage (/data/) area behind elevated permissions to keep
information safe from unauthorized access. To obtain the files important to an examination such as the SMS
database, these restrictions must be circumvented or removed.
The root level process typically involves utilizing a security exploit to run unsigned or custom code to
elevate these permissions. There is no single way to do this, as exploits may be based on particular
hardware in one device but not another. If a device has been rooted by an end user or a third-party tool,
there may be a secondary gateway application such as SuperSU that acts as a permission manager for
applications wanting root access.
The two types of root are shell and permeant roots. A shell root is a temporary root which only persists
until the device is rebooted. This type of root is valued by the forensic community as it is considered more
They are less likely to be developed by third party hackers or developers because most
end-users want a root that will persist throughout the use.
A permeant root is one that is much more likely to be found in third party rooting techniques and tools such
20
20

as KingRoot, KingoRoot, PingPong Root, StumpRoot, and more. These tools are typically developed for
8/

specific devices or versions of the operating system and may make long lasting and dramatic changes to
/2
x9

the file system. Many root level exploits will attempt to place files in the /system partition which is
.m

write-protected by default. In order to do this, they must first change the permissions on this directory.
ks
si
en

If a forensic tool cannot obtain root automatically, it may be necessary for an examiner to seek out an
or

exploit on their own. A good place to start is the developer forum and website http://xda-developers.com. It
f
dg

is important to note that many third-party rooting tools are not developed with any forensic process in mind.
@
er

They may wipe or change information on a device and should be tested and verified on a test device before
vi
ja

being used on evidence in a formal case.

AXIOM will attempt to shell root the device using one of two methods. These methods are based on open-
source roots that will target security exploits up to Android version 4.4.2. Any version higher than this is not
currently able to be rooted by AXIOM. AXIOM will only attempt a root when a shell root can be safely
achieved. It will not permanently root the device for the user. AXIOM will log which methods were attempted

MAGNET AXIOM EXAMINATIONS (AX200) 357

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

which methods were successful. If the device cannot be rooted by AXIOM, a third-party tool can be used to
achieve root before bringing it back to AXIOM for imaging.
To remove the root that AXIOM Process pushes to the device, simply reboot it.

ARTIFACTS IN A FULL IMAGE

The Full Image acquisition by AXIOM will image each partition on the Android device. Each of these partitions
will be added to the full image .raw file. While most of the data comes from the userdata partition, other
important partitions including system, cache, and recovery store data for the examiner to review. When
loaded into AXIOM Examine, partitions can be expanded, and additional artifacts can be generated out of the
data found within.
Important areas include:

• /data/app/ -- Storage area for installed applications (APKs)

• /data/app-private/ -- Storage area for pre-installed applications by

carriers/manufactures

• /data/data/ --Main user data storage area

• /data/system/ -- Storage area for handset locks and other security information

• /data/media/ -- Mounted area for internal or emulated MicroSD storage

• /data/misc Storage area for logs such as the Wi-Fi profiles

• /data/user Listing of all users on the device

• /system/app-private Another storage area for pre-installed applications

20
20

• /system/app
8/
/2
x9

The Android device memory is divided into multiple partitions. There is no limit on how many partitions a
.m

device can have, and typically differs from device to device. The most common partitions found on a device are:
ks
si

•
en

Data (Userdata)
f or
dg

• System
@
er

• Recovery
vi
ja

• Cache

• Modem

• Boot

358 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

• Etc.

A physical image will typically attempt to capture the entire memory image which will include each of these
partitions. Magnet Acquire will obtain a single image file using the dd command which contains all the
partitions on the device.

DATA FROM OTHER SOURCES

Magnet AXIOM can accept image files from multiple mobile tools including Cellebrite UFED, XRY, Lantern,
MPE, and more. While the proprietary files can be selected, for best results, selecting the raw image files
such as .bin or .z01 files will yield the most data. AXIOM will be able to accept these images the same way
as if they were acquired using AXIOM Process, just by selecting the files from SELECT EVIDENCE SOURCE
→ MOBILE → [Operating System] → LOAD EVIDENCE → IMAGE.
In addition, other methods such as JTAG, Direct eMMC (ISP), or Chip-off extractions of Android or Windows
Phone devices can also be added as raw files for processing. AXIOM will fully process these data points as
well as give the examiner the ability to review the data in the File system explorer.
The Android operating system has similar offerings to iOS devices. Many of the same core artifact offerings
such as SMS/MMS, Call Logs, Contacts, Web History, and more is parsed, however, they come from different
sources. And while some applications are supported on both operating systems, their storage locations
and database schemas may differ widely. Even though the examiner will select iOS or Android for the
operating system, AXIOM Process will also scan the image to ensure that the right set of artifacts and
parsers for those artifacts are loaded.

RUNNING EXERCISE
20

ADDING DATA FROM OTHER SOURCES

20
8/

• Open the DashnerWin10PC case from the folder \AX200 Cases\ folder on the Desktop.
/2
x9
.m

• Within this case, press the explorer drop-down box and select File system.
ks
si
en

• Drop down the evidence for DashnerWin10PC.E01.

f or
dg

• Navigate to the folder:

@

/Users/dashner/AppData/Roaming/AppleComputer/MobileSync/Backup
er
vi
ja

• What is the name of the folder in this directory?

• identifier).

• In the EVIDENCE pane, right click on this folder and select Save file / folder to ZIP.

MAGNET AXIOM EXAMINATIONS (AX200) 359

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

• Name the file Dashner iOS backup and save to the Desktop.

• Open AXIOM Process and create a new case.

• In the LOCATION FOR CASE FILES, set the folder to be called \Dashner iOS\, and the
destination to be the Desktop.

• In the LOCATION FOR ACQUIRED EVIDENCE, set the folder to be called \Dashner iOS
Images\, and the destination to be the Desktop.

• Enter in the appropriate Case number and Scanned by, then, press the GO TO EVIDENCE
SOURCES button.

• From the SELECT EVIDENCE SOURCE, choose MOBILE.

• Select the IOS option, then LOAD EVIDENCE.

• Select IMAGE under SELECT EVIDENCE TO LOAD.

• Navigate to the Desktop, and select the *.zip file that was previous exported, then click Open.

• When prompted, enter .

• In the left window, jump to the entry for Find more artifacts.

• Press the check box to Allow AXIOM to find more artifacts by searching for additional
recoverable artifacts using Dynamic App Finder.

• In the left window, press the Mobile artifacts entry. Make sure that all artifacts are selected.

• Select the category for MEDIA. Press the OPTIONS button on Videos and select the checkbox
for Save videos up to then press OKAY .
20
20

•
8/

Press the ANALYZE EVIDENCE option in the left pane. Then, press the ANALYZE EVIDENCE
/2

button to begin the processing of the case.

x9
.m
ks
si
en
f or
dg
@
er
vi
ja

360 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 4 Mobile Artifact Analysis

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 361

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 4 Mobile Artifact Analysis

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

362 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

Module 5 Cloud
5

MODULE 5:
Cloud
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 363

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

364 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

LEARNING OBJECTIVES
In this lesson, students will take part in lecture, instructor-led exercises, and student practical exercises
to gain an understanding of AXIOM Cloud. Students will learn how it can assist in an investigation, how
to acquire data from the cloud, and learn some of the information/data that can be collected.

GOALS
At the conclusion of this lesson, students will be able to: discuss the circumstance when acquiring cloud
data should be considered; how to obtain data from the cloud; and how to add this acquired cloud evidence
to a case for review in AXIOM Examine.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 365

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

WHAT IS THE CLOUD?

ysterious at
all. Data that is coming from the cloud simply refers to information that is coming from server-stored
locations as opposed to data stored on a local dev

One of the fastest growing sources of data in forensic examinations is not on locally acquirable devices,
but rather is data stored on cloud servers. Many services that people use on a daily basis such as social
media, email, and remote storage, contain an incredible amount of information that can be critical to an
investigation of any type. While there are several litigation issues around these acquisition methods that
can impact your ability to acquire the data, even in consent cases alone the data available to an examiner
can justify the use of cloud acquisitions.
AXIOM has a specialized module that can be used to acquire and analyze data from a number of cloud
platforms including:

• Facebook

• Instagram

• Twitter

• Google

• Apple

• Microsoft / Office 365

• Dropbox

• Box
20

There are data points available from these acquisition sources that may not be available from any physical
20
8/

device, and if required for review during an investigation this information is only available from the cloud.
/2
x9

By combining the data from the cloud with data stored locally, missing pieces of the puzzle could suddenly
.m

come into focus.

ks
si
en
f or
dg
@
er
vi
ja

366 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

ACQUIRING DATA WITH AXIOM CLOUD

To acquire data from these cloud sources using AXIOM Cloud, an examiner must have a licence for AXIOM
Cloud installed which will enable the option to select CLOUD from the evidence source selection screen.

Figure 5.1 Select CLOUD from EVIDENCE SOURCES

After selecting the CLOUD option, the examiner is then given the choice of either acquiring new evidence
or loading previously acquired data.
20

Figure 5.2 ACQUIRE or LOAD Cloud Evidence

20
8/

If the examiner selects to ACQUIRE EVIDENCE all the available platforms currently supported by AXIOM
/2
x9

Cloud are displayed. The examiner can then select targeted information from each cloud platform using
.m

either a username/password combination or a recovered token for that specific cloud service.
ks
si
en

The LOAD EVIDENCE option allows the examiner to add data previously acquired using AXIOM Cloud,
or

or to add data from other sources such as Google Takeout a valuable source of cloud stored
f
dg
@

information.
er
vi

Once the examiner selects ACQUIRE EVIDENCE, a prompt is displayed asking the for confirmation that
ja

they have proper legal authority to use these acquisition techniques. Because laws and procedures differ
widely between regions and countries, this prompt simply reminds the examiner to ensure they have
proper authority from their area before using this option.

MAGNET AXIOM EXAMINATIONS (AX200) 367

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

Once the examiner confirms they have proper authority, a text box is displayed in which the Warrant
number Information can be added. This information is added to the Case Information.txt file and
will be included in any generated reports.
The available cloud platforms are then displayed below the warrant number field. Once a platform is
selected, services and options specific to that platform are displayed.

Figure 5.3 Platform selection screen for acquiring Cloud Evidence

During the instructor-led and student exercises, use of several of these cloud platforms was identified
within the evidence of our case scenario. The next step is to establish if there is cloud data present, and
if so, should it and can it be acquired. Any additional information obtained from the cloud could help piece
together more of the data that we already have.
20
20

Once a platform is selected, the user is prompted to enter either the account credentials, such as
8/
/2

username and password, or use a previously acquired token, as shown in Figure 5.4.
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

368 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

Figure 5.4 Providing credentials to access the cloud platform

WHAT IS A TOKEN?
While the data can be accessed by entering the username and password combination of the account, this
information may not necessarily be available to an investigator. Instead, it may be possible to use
information, in the form of a key , that is stored on one of the local devices you already have in your
possession such as a mobile device. A token is part of a proc
Authenticatio -authenticate to a service
without the user constantly needing to enter their credentials over and over within the same session.
These tokens are not permanent, but can last for extended periods of time depending on the service. The
other benefit of using tokens is that it does not need Two-factor Authentication (2FA), nor does it rely on
security checks that could alert the end user when someone is accessing their data.
The token for each platform or service will differ in length, structure, and ability. Some tokens only
provide access to certain parts of a service and not the entire authentication model, whereas others
pro red content within that platform. Additionally, each token is generated
by that specific platform or service and how and where they choose to store it may differ. Most commonly,
20

ounts.db file or the iOS/macOS Keychain.

20
8/
/2
x9

APPLE
.m
ks
si
en

The AXIOM Cloud Apple platform allows the examiner to select information stored within the iCloud
or

service that relates to the Apple ID of a user. This Apple ID is the centralized login service for use on both
f
dg

iOS and macOS devices. It can contain data backed up from iOS devices including: full device backups;
@
er

photos; application data; e-

vi
ja

service.

AXIOM Process also supports sign in to the Apple iCloud using 2FA. Once the APPLE platform is selected,
a sign-in window is displayed, as shown in Figure 5.5, and the examiner can enter the credentials for the
account to be acquired.

MAGNET AXIOM EXAMINATIONS (AX200) 369

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

Figure 5.5 Entering the Apple ID credentials

If 2FA is activated on the account an addition window is displayed, as shown in Figure 5.6, and the
verification code must be entered before AXIOM Process can continue.

Figure 5.6 Verification code window if Two-factor Authentication is enabled by the user.
20
20
8/

Once authenticated, the services within the Apple platform are displayed, as shown in Figure 5.7, and
/2

the examiner can select which items they would like to acquire. The option to SELECT DATE RANGE
x9
.m

allows the examiner to restrict the data collected. This can be all data before or after a specified date, or
ks

it can be a custom range. By default, AXIOM Cloud collects all data in the service regardless of when it
si
en

was uploaded. Some services will display the last date there was activity on the account and possibly
or

the size of the account, but this is on a service-by-service basis and will not necessarily be displayed for
f
dg

all.
@
er
vi
ja

370 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

Figure 5.7 Services available for acquisition from the APPLE platform

If a service has options or settings that can be changed, EDIT is displayed in the CONTENT column when
the mouse is hovered over the entry. Once EDIT is selected, a dialog window is displayed containing the
options for that service. For example, if EDIT is selected for iCloud Backup all the iOS device backups
within iCloud are displayed and the examiner can select which backup(s) to acquire. Similarly, for iCloud
Drive Files the EDIT option displays a list of files and folders to individually select for acquisition, rather
than acquiring all content.
20
20

Once the examiner clicks NEXT , the Apple evidence source is added to the AXIOM Process acquisition
8/

queue.
/2
x9
.m
ks

FACEBOOK
si
en
f or
dg

The incredibly popular social media platform Facebook is available as a cloud service from which AXIOM
@

Process can acquire data. To authenticate to the FACEBOOK

er
vi

credentials or a previously acquired token are needed. If using the account credentials, AXIOM Cloud will
ja

open a webpage pop-up displaying the Facebook login page for the examiner to enter the username and
password information. Once authenticated, all the available services from Facebook are displayed.

MAGNET AXIOM EXAMINATIONS (AX200) 371

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

Figure 5.8 Services available for acquisition from the FACEBOOK platform

None of the Facebook services have editable options, but each of the services can be enabled or disabled
depending upon the scope of the investigation and what is requested. The Facebook acquisitions are

information is being stored. Messenger Messages and Friends can take several hours depending on how
many messages are being stored and how many friends the user is connected to.

DROPBOX
The Dropbox remote storage platform is used by millions of people worldwide. It is also seen in many
child exploitation and data exfiltration cases as a popular way to remotely hide, store, and share data
between individuals and computers. After selecting the DROPBOX platform and authenticating to the
account using either the account credentials or a previously acquired token, AXIOM Cloud displays a
20

service for the Cloud Dropbox Files of the account. As can be seem in Figure 5.9, the service also details
20

the date of the LAST ACTIVITY on the account and the current ACCOUNT SIZE.
8/
/2
x9
.m
ks
si
en
f or
dg
@

Figure 5.9 Services available for acquisition from the DROPBOX platform
er
vi
ja

Once again, selecting EDIT within the CONTENT column displays a files and folder selection window, as
shown in Figure 5.10, that allows the examiner to select which items to acquire from the Dropbox. This
will include files and folders that are contained within a different Dropbox account but are shared with
this Dropbox user, and those that the user is sharing with others.

372 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

Figure 5.10 ADD FILES AND FOLDERS selection option for Cloud Dropbox Files service

GOOGLE
The search engine and technology giant Google stores an incredible amount of information about its
users, most of which can be acquired using AXIOM Cloud. The volume of data stored will depend on the
number of Google services used. For example, if the user starts the Chrome browser and signs in to
Chrome using their Google account, information from that browser e.g. bookmarks and browsing history,
will be synced to the cloud. If the device in use is running an Android operating system there will be
additional information about the device and its activities logged by Google.
Google stores a token file on Android devices within the accounts.db database file. This token can be
used to access almost all the information stored by Google. Additionally, this token does not seem to
expire for an extended period of time so is a prime example of using a token to access information stored
20
20

in the cloud.
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 5.11 A Google toke in AXIOM Examine

MAGNET AXIOM EXAMINATIONS (AX200) 373

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

Once authenticated, the services available for acquisition within the GOOGLE platform are displayed.
Several of these services have further customization options. Hover over the service and if additional
options are available the EDIT button appears within the CONTENT column.

Figure 5.12 Services available for acquisition from the GOOGLE Platform

Selecting EDIT for the Google Account service displays several additional subservices, as shown in
Figure 5.13.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er

Figure 5.13 Google Account sub services

vi
ja

The Google Account subservices include: Google Activity (searches and browsing history), Google
Timeline Locations, Google Connected Apps, Recent Devices that have signed into the account,
and any saved Passwords stored in the cloud.

374 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

Selecting the EDIT option for Google Drive, as shown in Figure 5.12, launches an ADD FILES AND
FOLDERS window to select which areas of the Google Drive should be acquired. The Gmail Messages,
Google Photos, and Google Hangouts services do not have any configurable options and selecting
these services will acquire all the available content within the service including attachment files for
messages and mail.

CLOUD ARTIFACTS
Once each of the platforms to be acquired have been added to the case, AXIOM Process lists them as
Ready to image along with the account that will be used to acquire the content.

Figure 5.14 Cloud Platforms Ready to image

As of the writing of this manual, AXIOM can recognize and extract data from more than 70 different
cloud artifacts.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 5.15 CLOUD ARTIFACTS supported by AXIOM Process

MAGNET AXIOM EXAMINATIONS (AX200) 375

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

Because there are often files stored in cloud services such as photos, videos, documents, and even full
backups which could include SMS/MMS data and/or third-party application data, in addition to these 50
artifacts, AXIOM will also automatically select and search for all computer or mobile artifacts across the
cloud evidence added to the case.

RUNNING EXERCISE
ADDING CLOUD DATA
• With the Dashner Full case open in AXIOM Examine.

• From the Process Menu, select Add new evidence to case.

• Once AXIOM Process starts, select EVIDENCE SOURCES in the left pane.

• Click the CLOUD icon, then LOAD EVIDENCE, then AXIOM CLOUD IMAGE.

• Navigate to the folder \Desktop\Evidence\Cloud\ and select the file Dashner Cloud.zip.

• Repeat and , this time selecting the Neff Cloud.zip file.

• Select Cloud artifacts in the ARTIFACT DETAILS section and ensure all the artifacts are
selected.

• Click GO TO ANALYZE EVIDENCE.

• Then click ANALYZE EVIDENCE to process the data.

REVIEWING CLOUD DATA

20
20

Once the cloud evidence sources are acquired and/or loaded, AXIOM Process will parse and carve the
8/
/2

data for artifacts just as for computer and mobile evidence. AXIOM Examine is then used to review the
x9
.m

results. Analyzing acquired Cloud data in AXIOM Examine is no different to reviewing PC, RAM, or Mobile
ks

data.
si
en

In AXIOM Examine, the cloud specific artifacts are displayed in the CLOUD category. Any other artifacts
f or
dg

e.g. documents and pictures, are automatically placed into their respective category.
@
er
vi
ja

376 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

Figure 5.16 CLOUD data available for review in AXIOM Examine

CLOUD ACCOUNTS INFORMATION AND CLOUD PASSWORDS AND

TOKENS
AXIOM Cloud captures any username and password account credentials entered and/or any tokens used
20

to gain access to the platform or service. These passwords and tokens are then populated into their own
20

artifact category within AXIOM Examine Cloud Passwords and Tokens, as shown if Figure 5.17. If a
8/
/2

password was used to log into the account to acquire the data, the Password/Token field displays the
x9
.m

password entered. If the examiner accessed the service with a token, the Password/Token field does
ks
si

s password, but instead displays the content of the token. These password
en

credentials can be useful if an examiner needs to gain access to the account again at a later data to acquire
f or
dg

additional data. Additionally, many people are creatures of habit and use their passwords for multiple
@

accounts and/or files. Therefore, if any encrypted backups or files have been located within the case, it is
er
vi

prudent to check if the passwords contained within this category will open them.
ja

MAGNET AXIOM EXAMINATIONS (AX200) 377

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

Figure 5.17 Passwords and Tokens artifacts detailing stored credentials and tokens

The Cloud Passwords and Tokens artifact is actually a Refined Result but it is stored within the CLOUD
category. This category contains information from the Cloud Accounts Information category and other
sources such as the Android Accounts.db file. From within the Cloud Passwords and Tokens
category, the examiner can right-click an artifact and select Add new evidence using
passwords/tokens, as shown in Figure 5.18. This automatically launches AXIOM Process with the
artifact data pre-populated for the account. This streamlines the process of acquiring additional data from
cloud sources and prevents typographic errors when entering account credentials thereby removing the
risk of locking the account due to a mis-typed password by the examiner.
20
20
8/
/2
x9
.m
ks

Figure 5.18 Using the Cloud Passwords and Tokens artifact to streamline cloud collections
si
en
f or
dg

ICLOUD PHOTOS
@
er
vi

The Cloud iCloud Photos category contains photos and pictures that have been uploaded from iOS
ja

devices into iCloud and includes: .JPG; .PNG; .MOV; and .HEIC files. This includes photos and pictures that
were saved to the Camera Roll and not necessarily taken using the iOS device itself. The
ARTIFACT INFORMATION details the picture size, the date and time it was taken and added, any
captions, any albums it has been included in, and a rendered view of the picture is displayed in the

378 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

PREVIEW card of the DETAILS pane. This artifact category can include photos and pictures from multiple
iOS devices that are all using into the same iCloud account.

Figure 5.19 Cloud iCloud Photos artifacts

DROPBOX
The Cloud Dropbox Files category contains any files and folders that were captured from the acquired
Dropbox account. The ARTIFACT INFORMATION includes: the location of the file within the dropbox
account; a File ID; a File Version ID; the server and client last modified date and time; the original photo
timestamp if present; and a preview of the file content.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 5.20 Cloud Dropbox Files artifacts

MAGNET AXIOM EXAMINATIONS (AX200) 379

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

All the files/folders extracted from the Dropbox are also displayed in the File system explorer within the
.zip evidence file generated during acquisition, as shown in Figure 5.21.

Figure 5.21 Previewing the acquired Dropbox data within the File system explorer

As with other artifacts in AXIOM Examine, there may be connections available for the files obtained from
Dropbox e.g. the MD5 hash value. This can be used to ascertain if these cloud-stored files are also stored
on other devices such as hard disks, removable drives, or mobile devices.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 5.22 File acquired from Dropbox displaying Connections icon within the File system explorer

380 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

Figure 5.23 MD5 Connections of file acquired from Dropbox showing file also stored on local and
removable device

FACEBOOK
The Cloud Facebook Profile Info artifact includes a copy of the Facebook page of the account at the
time of acquisition. This is not a live stream of currently available data, but a scrape of the website that
saves the data as an encapsulation in time. This will include profile information about the user such as:

• Address

• Email Address(es)

• Phone Number

• Website
20
20

•
8/

Birthday
/2
x9

• Gender
.m
ks
si

• Etc.
en

AXIOM Cloud also captures and stores the raw HTML data from the page thereby making it searchable
f or
dg

within AXIOM Examine. A preview window is generated based on the captured data, allowing the
@

examiner to review the content as it would have appeared if they had logged into Facebook website on
er
vi

the day it was acquired.

ja

MAGNET AXIOM EXAMINATIONS (AX200) 381

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

Figure 5.24 PREVIEW card of a Cloud Facebook Profile Info artifact

The Cloud Facebook Friends artifact displays the Facebook users linked as friends to the acquired
account at the time of collection. The ARTIFACT INFORMATION includes: the name of the friend; how
many friends that person has; and a URL to the friends homepage. The PREVIEW card within the
DETAILS pane displays the profile photo of the user if available.
20
20
8/
/2
x9
.m

Figure 5.25 Cloud Facebook Friends artifacts

ks
si

The Facebook timeline includes information such as: status updates; tagged posts; check-ins; uploaded
en

photos; profile changes; and posts from other users on the timeline of the Facebook account. The Cloud
f or
dg

Facebook Timeline category displays this timeline data for the acquired Facebook account. The
@
er

ARTIFACT INFORMATION includes: the original Message ID used by Facebook; the name and
vi
ja

Facebook ID of the user making the post; the type of post; the text of the post; the permanent link of the
post; and when the post was created.

The Type field displays whether the artifact relates to a post to the timeline, a photo or video uploaded
to the timeline, status updates, or generic timeline updates such as job or profile changes. Attachments
to the post are also captured and displayed within AXIOM Examine for the examiner to review. These

382 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

attachments can be reviewed in the File system explorer as well as the Artifact explorer allowing the
examiner to quickly review any attachments that were captured by the cloud acquisition.
AXIOM Examine also renders the captured HTML data from each timeline posting and displays it in the
PREVIEW card of the DETAILS pane. The rendered view includes some of the comments, and names of
people who have interacted with the post on the Facebook website.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 5.26 PREVIEW card of a Cloud Facebook Timeline artifact

The Cloud Facebook Messenger Messages category includes any message data associated with the
Facebook account that was acquired. It also includes any attachments or links that were shared using
the Messenger service. In addition to displaying each individual message, the PREVIEW card in the

MAGNET AXIOM EXAMINATIONS (AX200) 383

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

DETAILS pane displays a chat threaded view allowing the examiner to review the information in a back-
and-forth manner just like chat data from other platforms.

Figure 5.27 Cloud Facebook Messenger Messages artifacts

The Cloud Facebook Messenger Messages captured by AXIOM Cloud are processed the same as chat
messages sourced from other platforms. Identifiers are extracted and compiled into the REFINED
RESULTS → Identifiers category, Connections are created to map links between individuals, and the
content can be displayed in Conversation view to quickly review threaded conversations including chats
categorized by Magnet.AI.
20
20
8/
/2
x9
.m

Figure 5.28 Cloud Facebook Messenger Messages displayed in Conversation view

ks
si
en
or

GOOGLE
f
dg
@
er

Artifacts acquired from the Google platform contain some of the most useful information due to the sheer
vi
ja

volume and type of information Google stores about its users. A good starting point when reviewing cloud
data is the Cloud Google Passwords artifacts as it can contain passwords for many other cloud
accounts that have been accessed by the user.

384 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

Figure 5.29 Artifacts extracted from the cloud capture of a Google account

The Cloud Google Recent Devices artifact details other devices used to access the Google account,
and therefore identifies other relevant devices to seize and acquire as part of the forensic investigation.
This artifact also records the location of the device and when that device last utilized the synced services.

The Cloud Google Connected Apps artifact details any additional applications that have access to the
Google account.
NOTE: There will always be at least one entry present . This artifact
relates to the AXIOM Cloud application used to capture the data.
If the user signs in to their Google account from an Android device or utilizes Google location services
e.g. Google Maps or location-based searching, any information recorded by Google will be located in the
Cloud Google Timeline Locations category. These timeline locations help establish places the user
has either visited or passed through, or locations the user has searched for. Depending on the platform,
the time and date of this activity might also be available. While not necessarily a direct map of where the
user was at a specific point, these artifacts can demonstrate that the user was in a geographic region on
or around a specific date and time. Due to the way in which Google passes this information from a mobile
e locations are often logged without any outside action by the user.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 5.30 World Map view of Cloud Google Timeline Locations showing when a device passed a
location

MAGNET AXIOM EXAMINATIONS (AX200) 385

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

When a user accesses one of the services within the Google platform while logged into their Google
account, a large amount of data is recorded and stored. The user can review this stored information from
Cloud Google Activity
category. It includes: internet browsing history and searches; YouTube search and watch history;
searches for locations or directions; Google Assistant activity from Google Home devices; and, if the
device is running the Android OS, applications that were downloaded and used. Many of these actions
include date and timestamps, and in some cases geolocation data detailing where the device was when
the activity occurred.

Figure 5.31 Cloud Google Activity artifacts showing user activity across multiple services

The Cloud Google Drive Files

Google Drive account. These files can be viewed from the Artifact explorer, or the entire file/folder
structure of the acquired data can be reviewed from the File system explorer. Within the File system
explorer these files are stored within the folder \Google\Drive Files\Attachments\.
20

The Cloud Google Photos category contains any photos or pictures that have been uploaded to the
20
8/

. These photos and pictures may, or may not,

/2
x9

Google Drive, dependent on the account settings. Many Android devices will
.m

automatically stream photos

ks

information such as when the photo was taken, when the photo or picture was uploaded, the make and
si
en

model of the device used to take the picture, and any geolocation data are also uploaded with the file if
f or

available. The artifact displayed in AXIOM Examine also details which photo album the pictures were
dg
@

stored in.
er
vi
ja

386 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

Figure 5.32 DETAILS card of a Cloud Google Photos artifact

The Cloud Gmail Messages category contains any emails acquired from the Gmail account mailbox. If
a date and time filter was applied at the time of acquisition, this category might not include all the
messages that were stored in the mailbox at the time of collection. AXIOM Cloud retains any status flags
applied to the messages and when the artifacts are reviewed in AXIOM Examine this information is
recorded in the Label field e.g. UNREAD, IMPORTANT, etc. Like other email artifacts in AXIOM Examine,
Cloud Gmail Messages artifacts include: who the email was sent to and from; any cc or bcc information;
the message subject; and a rendering of the email content.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 5.33 PREVIEW card of a Cloud Gmail Messages artifact

MAGNET AXIOM EXAMINATIONS (AX200) 387

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

Any attachments to Cloud Gmail Messages are listed in the ATTACHMENTS card on the DETAILS
pane. If the content can be displayed within AXIOM Examine e.g. pictures and documents, the attachment
name is a hyperlink, as shown in Figure 5.34. Selecting the link opens an embedded PREVIEW card
displaying the content of the attachment file. Additionally, any attachments are parsed into their
respective categories within AXIOM Examine and they can be reviewed from the artifact category based
on the attachment file type e.g. PDF Documents, as shown in Figure 5.35.

Figure 5.34 Cloud Gmail Message artifact with attachments

Figure 5.35 Cloud Gmail Message attachments also contained within the respective artifact category

RUNNING EXERCISE
REVIEWING CLOUD ARTIFACTS
20

• Ensure the Processing complete message has appeared in the bottom left corner of the AXIOM
20
8/

Examine interface and click OKAY.

/2
x9

• On the FILTERS bar, use the Evidence drop-down to display just the two newly added cloud
.m
ks

evidence items.
si
en

• Select the CLOUD → Cloud Accounts Information category, and sort by the Platform.
f or
dg
@

• The passwords and tokens used to acquire the data from each platform are listed.
er
vi

•
ja

Neff uses the same password for both her Google and Facebook accounts.

• Switch to the CLOUD → Cloud Dropbox Files category.

• Most of these files have been identified and reviewed in previous lessons.

• Switch to the CLOUD → Cloud Gmail Messages category and sort by Attachments.

388 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

• Most of these attachments have also been reviewed during the email lesson.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 389

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

MODULE REVIEW
In this module the following topics were covered:
• A review of the cloud platforms that AXIOM can collect and process date from.
• Understanding how to use AXIOM Cloud to collect cloud data using passwords or tokens.
• What data is recovered from popular cloud platforms such as Google, iCloud, and Dropbox

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

390 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

REVIEW QUESTIONS
To help reinforce the learning objectives for this module, the following review questions have been
provided:
1. List some of the cloud platforms that AXIOM Cloud can collect data from.

2. What two authentication methods can AXIOM Cloud use to access data from a cloud account?

3. When collecting Facebook data, are the messages sent via Facebook Messenger available for
review?

4. If, when obtaining data from a Google account the Gmail Messages were collected, are any message
attachments available to be viewed?
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 391

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

STUDENT EXERCISE
This exercise is based on the Dashner case scenario detailed on page 38 of the manual.

• On the FILTERS bar, use the Evidence dropdown to filter just the Neff Cloud data.

• Select the CLOUD → Cloud Google Activity category.

• List three applications that Monica Neff used:

_____________________________________________________________________
_____________________________________________________________________
_____________________________________________________________________

• List three things Neff searched for:

_____________________________________________________________________
_____________________________________________________________________
_____________________________________________________________________

• Select the CLOUD → Cloud Google Photos category.

•
phone? _____________________________________________________

• Select the CLOUD → Cloud Facebook Messenger Messages artifact.

• Tag all the messages between Monica and Dashner.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

392 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 5 Cloud

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 393

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 5 Cloud

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

394 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 6 Reporting

Module 6 Reporting
6

MODULE 6:
Reporting
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 395

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 6 Reporting

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

396 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 6 Reporting

LEARNING OBJECTIVES
In this lesson, students will take part in a lecture, instructor-led exercises, and student practical exercises
to gain an understanding of the capabilities of Magnet AXIOM to export key artifacts for additional
analysis. Students will create and manage portable cases for stakeholder review and collaboration, and
generate a final report with all investigative results.

GOALS
At the conclusion of this lesson, students will be able to extract key artifacts and create a portable case
for additional analysis by the case investigating officer or legal counsel and subsequently author a final
report using the tags discussed in previous lessons.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 397

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 6 Reporting

EXPORTING ARTIFACTS VIEW

Throughout an investigation, there may be times when an examiner needs to export key artifacts from
the case. The reasons for exporting the artifacts will be unique for each case but may include additional
analysis requirements, legal process directives, prosecution requests for supporting exhibits during
preliminary hearings, collaborating and reviewing key evidence with case stakeholders, or providing key
intelligence during open/active investigations. Regardless of the necessity, AXIOM Examine allows
investigators to save the actual artifact or export attributes and details from the artifacts, as displayed
within the EVIDENCE pane.
To understand the exporting feature of AXIOM Examine, it is important to note the distinction between
s
formats, which contains attributes or details about the artifact, as parsed and displayed within the
EVIDENCE and DETAILS panes of AXIOM Examine. For example, right-clicking on a picture displayed in
the EVIDENCE pane, with the Column view selected, will create an output file containing the column
values rather than the actual picture. However, selecting the Save artifact to option, from the right-click
menu, will save a copy of the picture to a location specified by the user.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 6.1 Different methods to Create report / export artifacts

398 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 6 Reporting

EXPORTING PORTABLE CASE

From the File menu, the Create portable case option allows for the exporting of artifact details from
the column values in the EVIDENCE pane. When selected, a Create report / export popup window
appears. Within the window, users have the option of selecting the output file path, the output file type,
and the items to be included in the export. By default, AXIOM will label the output file with th
prefix and an extension based on the file type selected, such as export.csv. Once the export is complete,
the file name can be changed to be more intuitive for the examiner and stakeholders who may receive
the export.

Figure 6.2 Exporting a portable case

20
20

orting
8/

artifact details to a file, an option was displayed in the export window to change the columns to be
/2
x9

included in the export operation. However, in AXIOM, the columns included in the export operation are
.m

only those currently displayed in the EVIDENCE pane. Prior to creating the export, examiners can hide
ks
si

or reorder the columns from the EVIDENCE pane. When the export is complete, the resulting file will
en
f or
dg
@

Portable cases can be created for several types of uses. Similar to the requirements for exporting
er

artifacts and saving files, the need for a portable case can include responding to legal process directives,
vi
ja

such as a discovery order; managing larger case data sets by assigning smaller artifact analysis duties
to other examiners; providing training to new members of the examination team; collaborating and
reviewing case evidence with other stakeholders; or allowing investigators without an AXIOM license, but
with the most knowledge about the case, to perform the analysis. Regardless of the reasons, examiners
can use the Create portable case option from the File menu in AXIOM Examine to create and manage
custom case data sets within the overall investigative workflow. Portable cases can be accessed by both

MAGNET AXIOM EXAMINATIONS (AX200) 399

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 6 Reporting

licensed and non- M Examine

to work with the portable case, a non-licensed user will not have access to the following features: File
system explorer, Registry explorer, TEXT AND HEX card, DECODE card, Create portable case, and
Merge portable case.

The Create portable case option, from the File menu, opens the Create report / export window,
which is also used for the exporting operations. The Export type drop-down menu is what allows the
examiner to create the portable case data set. By default, the ITEMS TO INCLUDE option is set to Items
in the current view. So, prior to creating the portable case, the examiner must determine which artifacts
they wish to have included in the resulting data set.

Other options which can be selected include Tagged items and All Evidence. If the All Evidence option is
selected, AXIOM will create a portable case containing the same categories and artifacts that were part of
the in AXIOM Examine.
20
20

Figure 6.3 Create a portable case

8/
/2

The portable case folder will contain two database files. One file, with a hash-like file name and
x9

.attachments extension, will contain data pointers and other details about the artifacts within the case.
.m
ks

The second file, which is the larger of the two, is the main case database and the file that AXIOM Examine
si
en

(for a licensed user) or the OpenCase.bat file (for a non-licensed user) will use to display the case data
f or

in AXIOM Examine. If a licensed user of AXIOM wishes to open a portable case, they can navigate to the
dg

portable case folder from the Open option of the File menu and use the Select folder option to open the
@
er

case. Or, double-clicking the Case.mfdb file will also open the portable case in AXIOM Examine. For a non-
vi
ja

licensed user, double-clicking the OpenCase.bat file will automatically open the Case.mfdb file in the
lightweight version of AXIOM Examine.

400 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 6 Reporting

Figure 6.4 Folder structure with .bat file and portable case folder contents

MERGING PORTABLE CASES

After they have been processed by another examiner or stakeholder, portable cases can be merged back
into the parent case itself. An example of this scenario might be when a case is too large for one examiner
to process in a timely manner. The lead examiner can create smaller portable cases containing specific
artifact categories, which can then be assigned to other members of the forensics team for processing.
After the team member has completed their analysis, they can return the portable case to the lead
examiner for merging into the parent case.

From the File menu, the Merge portable case option begins the process. Next, the examiner needs to
navigate to and select the Portable Case sub folder within the main portable case folder itself.
20
20
8/
/2
x9
.m
ks
si
en

Figure 6.5 Merge portable case options

f or
dg
@
er

MERGING PORTABLE CASES TAGS

vi
ja

During the merge process, examiners have the option to include all Tags, Comments, and Profiles
(default), or to select which case attributes they want to include in the merging process. If Tags are
selected, AXIOM will display the tags from both the original (parent) case and the portable case, and list
what the result of the tag merge process will include. AXIOM, by default, will also have the Show

MAGNET AXIOM EXAMINATIONS (AX200) 401

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 6 Reporting

conflicts only option checked. If there are no conflicting tag names, the Merge Tags window will be
empty. If the option is unchecked, AXIOM will display all tags that will be part of the merge process,
regardless of conflicts. If there are conflicts, AXIOM gives the examiner the option of renaming the tags
prior to the merge.

Figure 6.6 Options for merging a portable case back into the full axiom case

MANAGING PORTABLE CASES COMMENTS

20
20
8/

If Comments are included as part of the merge process, AXIOM will allow the examiner to apply a unique
/2
x9

User ID to the comments from the portable case. After the merge process is completed, the User ID is
.m
ks

applied to all the comments from the portable case in order to identify the user who applied the artifact
si
en

comments. Tags and/or comments for both the original and portable cases can be managed from the
or

Tags and comments drop-down on the FILTERS bar, further assisting the examiner with their case
f
dg
@

evidence management.
er
vi
ja

402 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 6 Reporting

Figure 6.7 MERGE COMMENTS User ID option

RUNNING EXERCISE
EXPORTING FROM THE FILE MENU
• From the FILTERS bar, open the Artifacts drop-down menu.

• Check the Chrome Downloads, Firefox Downloads, and Internet Explorer 10-11
Downloads categories.

• Open the File menu and select Create portable case.

• In the Create report / export window, click BROWSE next to the File Path and create a new
folder on the desktop called \Dashner Case Exports\.

• For the Export type, select HTML.

• For the ITEMS TO INCLUDE, select Items in current view (default) and click CREATE . When
complete, click OPEN from the Status Bar to view the export folder and files. Launch the export
report using the index.html file.
20
20

EXPORTING FROM THE EVIDENCE PANE

8/
/2
x9

• Return to AXIOM Examine and clear any filter conditions.

.m
ks

Select Outlook Emails from the NAVIGATION pane.

si

•
en
or

• In the EVIDENCE pane, sort by the Attachments column.

f
dg
@
er

• Select only the 9 emails with attachments.

vi
ja

• From the File menu, select Create portable case

• The portable case cannot be created for just the selected items.

• Cancel the Create portable case window.

MAGNET AXIOM EXAMINATIONS (AX200) 403

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 6 Reporting

• From the EVIDENCE pane, right-click the highlighted artifacts.

• Select Create report / export

• Create a new folder in the Dashner Case Exports folder called \Outlook Email with
Attachments\.

• View the index.html when complete to confirm the export.

EXPORTING FROM THE FILE SYSTEM EXPLORER

• Switch to the File system explorer.

• Navigate to the \Users\dashner\Documents\Work\Chemistry\ folder.

• In the EVIDENCE pane, right-click the Drugs List.docx file and select Export details.

• Select the \Dashner Case Exports\ as the destination. Create a new sub folder called
\Dashner Documents\. Note the *.csv format is the only option available, and the default
file name of export.csv.

• Open the export when complete, and change the file name to Drugs List MS Word.csv.

SAVING FILES FROM THE ARTIFACTS EXPLORER

• Return to the Artifacts explorer in AXIOM Examine.

• Select the PDF Documents category.

• In the EVIDENCE pane, sort by the Filename column.

20
20

• Right-click the anarchistcookbook2000.pdf file and select Save artifact to.

8/
/2
x9

• Select the \Dashner Documents\ folder as the destination folder.

.m
ks

•
si

When complete, select OPEN from the Status bar.

en
or

• AXIOM creates an \Attachments\ folder within the destination and places the exported file.
f
dg
@
er
vi

SAVING FILES FROM THE FILE SYSTEM EXPLORER

ja

• Click the Source link in the DETAILS pane for the anarchistcookbook2000.pdf file, to
vie File system Explorer.

• From the EVIDENCE pane, right-click the file and select Save file / folder to ZIP.

404 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 6 Reporting

• Select the \Dashner Documents\ folder for the export, and label the *.zip file with the file
name of the *.pdf.

• When complete select OPEN from the Status Bar to confirm the export.

CREATING A PORTABLE CASE

• Return to the Artifacts explorer in AXIOM Examine.

• From the Artifacts drop-down menu in the FILTERS bar, check all the Skype artifacts.

• From the File menu, select Create portable case.

• For the File path, create a new folder on the desktop for \Dashner Skype Artifacts\.

• For the Export type, select Portable case.

• For the ITEMS TO INCLUDE, select Items in current view.

• When complete, open the destination folder and view the contents.

• Return to AXIOM Examine.

• From the File menu, select Open and navigate to the \Dashner Skype Artifacts\ folder.

• Highlight the \PortableCase\ folder and choose Select Folder to open the portable case in
AXIOM Examine.

• From the NAVIGATION pane, select the Skype Accounts category.

• ut use your initials in front

20
20
8/
/2
x9

• Create a new tag for the Skype

.m

name.
ks
si
en

•
or

the tag name.

f
dg
@
er
vi

MERGING A PORTABLE CASE

ja

• Return to the parent Dashner case.

• From the File menu, select Merge portable case.

• Navigate to the \PortableCase\ folder and select the folder for the merge operation.

MAGNET AXIOM EXAMINATIONS (AX200) 405

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 6 Reporting

• In the MERGE TAGS window, uncheck the option for Show conflicts only.

• Note the tags to be added from the Portable case with the unique names (initials).

• In the MERGE COMMENTS window, enter your initials and the date into the User ID field e.g.
RM113016.

• Complete the merge operation.

• From the NAVIGATION pane, select the Skype Accounts category.

• In the EVIDENCE pane, select the Dashner Skype account entry.

• Open the TAGS, COMMENTS & PROFILES pane.

• The User ID has been applied to the comment during the merge operation.

SPECIAL EXPORTS PROJECT VIC

For the Pictures and Videos artifacts in AXIOM Examine, the option of creating a Project Vic 1.2 or 1.3
data set is available from the Artifacts and File system explorers. When selected, AXIOM will create an
Open Data (OData) javascript object notation (*.JSON) file formatted for a Project Vic data set, which
contains details for the creation of a special export file format.
Project Vic is spearheaded by the International Center for Missing and Exploited Children (ICMEC) and the
Department of Homeland Security (DHS) and is an initiative to create a standardized, shared, central hash
database that investigators can use to locate and/or categorize child exploitation images. The Project Vic
ing
between domestic and international law enforcement agencies all working on crimes facilitated against
children and the sexual exploitatio http://www.projectvic.org, Feb 2017). In AXIOM
20
20

Process, Project Vic *.JSON data sets can be imported and used in the CATAGORIZE PICTURES function
8/
/2

for identifying pictures and videos from the case with hash values that match those from the Project Vic
x9

data. In addition, using the Create report / export feature in AXIOM Examine, investigators can create
.m
ks

a custom Project Vic (1.2/1.3) data set from picture and video artifacts in the case. The exported Project
si
en

Vic data set (*.JSON) can be used in 3rd party media analysis tools, such as Griffeye Analyze DI, or
or

provided to other users of Magnet IEF and AXIOM, who can import the exported .JSON Project Vic file,
f
dg

and take advantage of the media hash comparison capabilities of both tools.
@
er
vi
ja

406 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 6 Reporting

Figure 6.8 Export of images to a report in Project Vic format

SPECIAL EXPORTS IDENTIFIERS

Another special export available in AXIOM Examine is the option to export the Identifiers from the case.
AXIOM parses the Identifiers artifacts from across the evidence sources when the case is created. The
Identifiers can include unique biographical information for the user; system level identifiers, such as
SIDs; chat client screen names; email addresses; and any value that uniquely identifies a given user on
the system. When the Identifiers option is selected as the Export type, AXIOM will create a *.JSON file
which can be shared between installations of AXIOM for the purposes of comparing identifiers between
cases. The Create report / export dialog window allows the examiner to include information about their
agency, which the recipient of the exported identifiers can use to contact the agency, should they need
additional assistance, or wish to collaborate on any matching identifiers.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 6.9 Create report / export for Identifiers

MAGNET AXIOM EXAMINATIONS (AX200) 407

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 6 Reporting

EXPORTING FILE SYSTEM EXPLORER

Using the right-click Create report / export option in the File system explorer only allows for the
creation of a *.csv format for the export operation. In addition, unlike the export option from the File
menu, which gives the examiner several choices in the ITEMS TO INCLUDE section of the export
window, the right-click export option limits the export operation to Selected items only. So, prior to
using the right-click menu option, the examiner should select all artifacts that they wish to include in the
export.

SAVING FILES ARTIFACT AND FILE SYSTEM EXPLORERS

The files themselves can also be saved out of the case for additional analysis or collaboration and review
with other stakeholders. In the Artifacts explorer, the Save artifact to option is only available by right-
clicking on an artifact within the EVIDENCE pane. In addition, the save option only applies to artifacts
that are actual files, rather than those representing the attributes or details of an actual file. A similar
operation for saving files from the case is available from within the File system explorer in AXIOM
Examine. From the File system explorer, when a file is selected, and the right-click menu is opened,
Save file / folder to and Save file / folder to ZIP options are presented to the examiner. The Save
file / folder to copies the file from the case to a directory location specified by the examiner. During this
operation, the original file type of the artifact is retained, such as *.jpg or *.pdf. The Save file / folder
to ZIP adds the selected files to a *.zip archive instead.

Note: When using the Save file / folder to option, the saved files are listed with the local machine
MAC timestamps. The Save files / folders to ZIP option will retain the timestamps from the
evidence for the files within the *.zip file and will not apply local MAC timestamps until the
20

files are extracted.

20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 6.10 Save artifact to option Figure 6.11 Save file / folder to ZIP and Export details

408 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 6 Reporting

CASE REPORTING
Once the investigation with AXIOM has been completed, the examiner may need to generate a final case
report. When generating the case report, it is important for the examiner to create a format which not
only identifies the key artifacts that are relevant to the investigation, but also presents the artifacts in a
manner that is easy to understand and interpret by both technical and non-technical recipients. From the
File menu in AXIOM Examine, the Create report / export menu option can also be used to create the
case report. Once the Create report / export window opens, the examiner has the option of selecting
the output format from the Export type drop-down menu. The HTML format is probably one of the most
common, but other formats available include CSV, PDF, XML, and XML with external files. Similar to
the export operation, the examiner also has the same three choices available under the ITEMS TO
INCLUDE section of the export window when creating the case report. The default is Items in the
current view (EVIDENCE pane), but can be changed to Tagged items or All evidence items. The
LEVEL OF DETAIL option is what that enables the examiner to further decide whether they would like
the report to be one single report from beginning to end, or an individual report for each artifact type.
20
20
8/
/2
x9
.m
ks
si
en
or

Figure 6.12 Create report / export options

f
dg

Once generated, the report folder can contain the following files and folders: front.html, index.html,
@
er

nav.html, \Attachments\, \ChatThreads\ (if present in the exported artifacts), \resources\, and
vi
ja

\webpages\. The front.html and nav.html files are used to aid in the report header and artifact
category panes as viewed from the index.html file, while the \resources\ folder contains the *.css,
*.js, and images used to create the structure and format of the report.

MAGNET AXIOM EXAMINATIONS (AX200) 409

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 6 Reporting

Figure 6.13 Contents of folder containing exported case

CASE REPORTING FINAL REPORT

The \Attachments\ folder contains supporting files and artifacts linked to the index.html file. The
\webpages\ folder contains the *.html files representing each of the artifact categories included in the
report and linked to the index.html file. Finally, the \ChatThreads\ folder, if chat conversations were
included in the report, will contain *.html files for each rethreaded message. They are not linked within
the index.html file but can be included as supplemental materials in support of the case report or
submitted as stand-alone chat conversations relevant to the investigation.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

Figure 6.14 Final report format

From within the report view, individual column headers can be sorted by numerical order, alphabetical
order, or timestamp. In addition, a filter option also exists for each column, which allows the viewer to
enter a keyword and filter on the column values. This can be especially useful for report categories with

410 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 6 Reporting

large numbers of associated artifacts, such as Windows Event Logs, email messages, or chat
conversations.

Figure 6.15 Final report filters within browser

RUNNING EXERCISE
CREATING A CASE REPORT ARTIFACT CATEGORIES
From the Artifacts drop-down menu in the FILTERS bar, check all Skype categories.

• From the File menu, select Create portable case.

• For the File path, create a new folder on the desktop called \Dashner Skype Report\.

• For the File type, select HTML.

• Leave the ITEMS TO INCLUDE set to Items in the current view and create the report.

• AXIOM Examine performs two operations, an HTML for the report items in the EVIDENCE pane
as well as an HTML for each rethreaded chat conversation. These are stored separately within
the destination folder.

• When complete, open the \Report\ folder and view the index.html file.
20
20

• Open the \ChatThreads\ folder and view one of the *.html files for a rethreaded chat
8/

conversation.
/2
x9
.m
ks

CREATING A CASE REPORT TAGGED ITEMS

si
en
or

• Return to AXIOM Examine and clear any filter conditions.

f
dg
@

• From the File menu, select Create portable case.

er
vi
ja

• In the File path, create a new folder called \Dashner Case Report\ on the desktop.

• For the File type, select HTML.

• In the ITEMS TO INCLUDE section, choose All tagged items.

MAGNET AXIOM EXAMINATIONS (AX200) 411

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 6 Reporting

• Create the report.

• When complete, view the index.html file.

• Note the column sorting options and filtering options available within the report.

• Create another case report, using PDF as the output format.

• Open the report folder and view the PDF version of the report for comparison.

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

412 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 6 Reporting

REVIEW QUESTIONS
To help reinforce the learning objectives for this module, the following review questions have been
provided:

1. True/False. Exporting in AXIOM can be performed from the Registry view?

2. What option from the File menu allows a user to export artifact details from the case?

3. What is the file format for a Project VIC 1.2/1.3 export?

4. When exporting from the File system explorer in AXIOM Examine, the File menu or a right-click
menu option is available. Using the right-click menu option, what is the available file type for the
export?

5. Using the File menu and the Create portable case option, the File types for the export operation
include Project Vic, Portable case, XML, XML with external files, Identifiers, and what
additional file types?

6. From the File system explorer, what are the options available for saving files from the case?
20
20
8/
/2
x9

7. When a non-license user wants to open a portable case, what file can they use to launch the case
.m
ks

in AXIOM Examine?
si
en
f or
dg

8. What three case attributes are included by default when a portable case is merged back into its
@

parent case?
er
vi
ja

9. What is the name of the HTML file that will launch the case report?

MAGNET AXIOM EXAMINATIONS (AX200) 413

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 6 Reporting

10. In the HTML version of the case report, what two features can assist the viewer in managing the
listed artifacts?

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

414 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 6 Reporting

STUDENT EXERCISE
This exercise is based on the Dashner case scenario detailed on page 38 of the manual.

• Create a *.csv file containing all the iPhone 5S images.

• Export the iPhone 5S images from the case, for additional processing or review with
investigators.

• Export the wrestling video

• Create an *.html report for all

• Create a Project VIC 1.3 export for all drive.

• Create a portable case containing just the Skype artifacts, which can be provided to the
investigator for additional review.

• Open the portable case.

• Create a tag for all the Skype conversation between Dashner and Riddle on 10/7/2016.

• Create a tag for the Skype chat from Felix, asking Dashner to add him as a contact, include the
authorization from Dashner.

• Merge the portable case into the Dashner parent case. Add a unique identifier for Officer Riddle.

• Create an HTML case report which includes only the tags, and comments from the student
exercises.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 415

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 6 Reporting

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

Notes

416 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 6 Reporting

____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20
8/

____________________________________________________________________________________
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

Notes
____________________________________________________________________________________
____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 417

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 6 Reporting

____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20
8/

____________________________________________________________________________________
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg
@
er
vi
ja

418 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 7 Cumulative Review Exercise

Module 7 Cumulative Review Exercise

7

MODULE 7:
Cumulative Review Exercise
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 419

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 7 Cumulative Review Exercise

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

420 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 7 Cumulative Review Exercise

JACK WATERS CASE SCENARIO

Jack Waters works in the printing department of a publishing company that produces training materials
for a variety of vendors. As an employee within the printing department, Jack is responsible for producing
the finished training manuals, and other supporting materials for the clients. The content for the manuals
is
presentations, Excel spreadsheets, Text (*.TXT) files, Portable Document Format (*.PDF), and other
orm, using the files provided by the
clients.
-disclosure agreement (NDA) on file for each of their clients. The NDA clearly
prohibits the company, and its employees, from possessing, sharing, reproducing, or otherwise
distributing the intellectual property (training materials) of the client, except for the purposes of creating
the finished training materials for shipment. Violations of the NDA could subject the company to civil
penalties, and employees to potential criminal charges.
When Jack was hired, he was issued a laptop computer by the IT staff of his company. Jack was assigned
the Administrator user account for the computer. As part of his employment, Jack was required to sign
an Acceptable Use Policy (AUP), along with the NDA. The policy prohibits employees from using the
company-issued computer for: personal use e.g. accessing social networking sites, using chat clients,
and conducting inappropriate Internet searches; installing unauthorized software e.g. encryption
applications; and accessing non-company wireless networks. The policy also states that the company IT
staff can, and will, conduct periodic random inspections of employee computers, for possible violations
of the AUP and NDA.
During a recent inspection mputer, several violations of the AUP were identified. These
included: the installation of unauthorized software, chat client activity (Skype), social network activity,
ilities. It also
appeared that Jack was potentially in violation of the NDA he signed preventing the unauthorized
possession and use of intellectual pro
20
20

During this exercise you will be conducting an analysis of the evidence recovered from the computer
8/

issued to Jack Waters. The exercise is designed to help reinforce the learning concepts and practical
/2
x9

application skills presented throughout this course.

.m
ks

Using Magnet AXIOM Examine, open the Jack Waters Win 7 PC case, and complete the following tasks.
si
en

When requested, create an appropriate tag for any artifacts that should be included in a final investigative
or

case report.
f
dg
@

At the conclusion of the exercise the instructor will review the results with the class.
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 421

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 7 Cumulative Review Exercise

You have 60 minutes to complete the exercise.

You can use all your training materials and notes to assist you.
It is recommended that you work on your own, but you can ask the instructor for assistance if necessary.

CUMULATIVE EXERCISE
• Create a tag ystem Info identify the following:

• The Windows user account used for Jack Waters.

• The time zone settings for the computer.

• The operating system installed on the computer.

• Any Volume Boot Record information.

• Tag any evidence of access to online dating sites during normal business hours in April of 2014.

• Tag any evidence of access to Facebook during normal business hours in April of 2014.

• Tag any evidence that Waters searched the internet for marijuana.
What browser was used to conduct these searches?
__________________________________________________________________________

• Tag any evidence of Skype activity that identifies the following:

• The user profile linked to Jack Waters.

• Contact details for Rufio Sanchez.

20

• Phone calls made to/from Jack Waters.

20
8/

• Chat conversations between Jack Waters and Rufio Sanchez.

/2
x9
.m

• Private IP addresses assigned to Jack Waters.

ks
si
en

• Tag any Yahoo emails between Jack Waters and Rufio Sanchez.
f or
dg

• Tag any evidence indicating Jack Waters used an unauthorized chat client to send/receive video
@

chat messages.
er
vi
ja

• Tag any photos that were taken using an iPhone and contain GPS coordinates.

• Tag any photos of marijuana that have a skin tone of 80% or higher and are stored within the
Administrator folder.

• Tag any evidence indicating Jack Waters downloaded a pirated movie from a Torrent site.

422 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 7 Cumulative Review Exercise

• Tag any evidence that Jack Waters played video files on his company computer.

• Tag any evidence that Jack Waters used the Chrome browser to search for, and possibly
download, files relating to learning how to grow marijuana.

• Tag any evidence that Jack Waters possessed proprietary materials relating to IEF from the
company Magnet Forensics, Inc. Restrict your search to: PowerPoint files, Word documents, and
Product license keys (plain text format).

• Tag any evidence indicating Jack Waters accessed intellectual property belonging to Magnet
Forensics from a logical volume other than the C:\ drive.

• Tag any evidence indicating Jack Waters connected his computer to a wireless network
belonging to a neighbouring business

• Tag any evidence indicating Jack Waters searched for, installed, and used the TrueCrypt
encryption application on his company computer.

• Tag any evidence indicating a possible drive letter associated with a TrueCrypt encrypted volume
mounted .

• Create a final investigative report (*.html) for the tagged evidence items.
20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 423

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 7 Cumulative Review Exercise

Notes
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20

____________________________________________________________________________________
8/
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

____________________________________________________________________________________
____________________________________________________________________________________

Notes

424 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 7 Cumulative Review Exercise

____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20
8/

____________________________________________________________________________________
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg

____________________________________________________________________________________
@
er

____________________________________________________________________________________
vi
ja

Notes
____________________________________________________________________________________
____________________________________________________________________________________

MAGNET AXIOM EXAMINATIONS (AX200) 425

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
Module 7 Cumulative Review Exercise

____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
20

____________________________________________________________________________________
20
8/

____________________________________________________________________________________
/2
x9

____________________________________________________________________________________
.m
ks

____________________________________________________________________________________
si
en

____________________________________________________________________________________
f or
dg
@
er
vi
ja

426 MAGNET AXIOM EXAMINATIONS (AX200)

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.
 Module 7 Cumulative Review Exercise

____________________________________________________________________________________
____________________________________________________________________________________

20
20
8/
/2
x9
.m
ks
si
en
f or
dg
@
er
vi
ja

MAGNET AXIOM EXAMINATIONS (AX200) 427

© 2019 Magnet Forensics Inc. All rights reserved. May not be copied or reproduced without the written permission of Magnet Forensics Inc.