Media Triage in Magnet Graykey now integrated with Magnet Griffeye®
WHAT’S NEW
- Media Triage lets you scan mobile device files against known hash sets to quickly flag devices of interest.
- Connects to the agency’s Magnet Griffeye® Intelligence Database (GID), enabling investigators to identify known media on mobile device.
- The same GID can be used in Graykey, Griffeye, and Axiom, enabling shared intelligence that strengthens media categorization and consistency across investigations.
The volume of media stored on mobile devices can be overwhelming but even a single image can be the turning point in a case, especially when there is reason to believe a device contains Child Sexual Abuse Materials (CSAM).
To help quickly prioritize mobile devices and determine investigative escalations, we have added Media Triage integrated with the Magnet Griffeye® Intelligence Database (GID) to Graykey. This new triage capacity lets you quickly scan mobile devices against known media files — helping you identify which devices warrant further investigation and prioritize action, especially when a seizure involves multiple devices.
Quickly scanning the media on mobile devices
Media Triage in Graykey provides a fast, hash-based scan of media files that can be completed following initial access. This rapid triage scans thousands of files in just minutes and can be used to identify known CSAM using your agency’s GID.
Media Triage results are provided as the number of matches by category — the actual files are not shown in the Graykey interface, minimizing officer exposure to potentially harmful material. The triage results can also be exported as a CSV file that lists the matched media files for inclusion in the case report.
Applications of Media Triage in Graykey
This powerful addition to Graykey can have several material impacts on investigations and workflows for investigative teams:
Prioritizing devices and workflows
If several devices are suspected to contain CSAM, Media Triage can be used to quicky scan the devices for positive hits. This triage helps put devices into the proper workflow where the data can be directed to dedicated Internet Crimes Against Children (ICAC) teams through controlled systems to protect team members from CSAM exposure.
Informing the investigation
Media Triage can be used in the field to identify the presence of CSAM and provide the grounds to proceed with an arrest. In investigative interviews that involve seized or provided mobile devices, a positive hit can inform questioning or expansion of warrant conditions.
Paving the way for more cloud capabilities
This new capability in Graykey can also contribute to an agency’s use of cloud processing and sharing tools, like Magnet One Case Stream. By triaging a device against the most comprehensive child exploitation hash sets available, such as Project VIC and NCMEC, examiners can demonstrate that they have assessed the device to determine if there was known CSAM on a device before uploading any data to the cloud.
Adding the power of Griffeye’s Intelligence Database to Graykey
The hash sets used for Media Triage are powered by our industry-leading Griffeye Intelligence Database, the cornerstone of Griffeye’s powerful media analysis capabilities. Designed to make information sharing a seamless process, GID allows multiple users from different teams, regions, or even countries to build on each other’s casework. The result is stronger collaborations and increased efficiency when cutting through vast amounts of digital media.
In tandem with this development, we have also created a new standalone hash sets management application called the Magnet GID Manager, which was previously found within Griffeye.
Note: If your agency isn’t currently using a GID, you’ll need to download and install the Magnet GID Manager to store and manage the hash sets used for Media Triage.
In addition to Graykey, the new GID Manager has also been integrated into Magnet Axiom, providing a seamless, interconnected workflow that compounds intelligence across the investigation for the most consistent and comprehensive media categorization.
To learn more about how GID is integrated within Axiom, read What’s new in Magnet Axiom 10.0: smarter artifacts, faster insight, and stronger intelligence
Learn more about Graykey and Media Triage
Graykey users can access these updates by upgrading to the latest version of AppLogic. Check out the knowledge base article on the customer support portal (customer credentials required): Magnet Graykey’s Media Triage feature
To learn more about Media Triage or Magnet GID Manager, contact sales@magnetforensics.com.