Earlier this year, we introduced a new artifact category, volatile artifacts, which allows you to remotely collect live system information. Volatile artifacts are an especially important element of incident response investigations as they can provide unique insights into malware behavior and malicious activities that don’t leave easily detectable evidence trails.
Cellebrite images are quite popular, as the tool supports many different devices and extraction types. Because of this, you may get several different image types depending on the device and the type of extraction done. Often, I will get questions on how to load Cellebrite images into Magnet AXIOM and while it’s quite easy, it’s not always straightforward.
As part of the Comae beta program (currently open in Magnet Idea Lab), we are regularly introducing new features for the community of testers to provide feedback on.
With Apple’s announcement of iOS 16’s official launch date, as well as providing their latest “gold master” build, we wanted to take a dive into iOS 16 and see what all was going to be new from an analysis and acquisition perspective.
We’re excited to be bringing back Magnet Virtual Summit to DFIR experts and newcomers alike from February 21-March 2, 2023!
MRU artifacts, or Most Recently Used are a variety of artifacts tracked by modern Windows operating systems that provide crucial details regarding the user’s interaction with files, folders, and programs that may have been executed using the Windows Run utility. This is fortunate for examiners, because profiling user activity is something digital forensic examiners are often tasked with to corroborate what we believe happened on a computer. It is a method for supporting our theory of the user’s behavior on a system.
Sometimes the tools that have been put in place to protect our data can actually become roadblocks in our forensic investigations.
Magnet AXIOM 6.5 is now available with new enhancements for Timeline and Media Explorer so you can uncover and manage your case evidence with ease.
The latest release of AXIOM Cyber – version 6.5 introduces several new and exciting features including: support for Dell Data Protection Encryption (DDPE), new remote volatile artifacts, added evidence sources and features for Email Explorer, and additional artifact details in Timeline view.
When you need to quickly narrow the scope of your investigation to analyze the data related to a crime or activity that occurred at a specific time, the Timeline explorer in Magnet AXIOM & Magnet AXIOM Cyber offers you an intuitive interface that surfaces time relevant evidence in a visual manner.
