Automatically Import and Process Mobile Images in Magnet Axiom from a Magnet Graykey & Magnet Verakey

To help you work as efficiently as possible when collecting and examining from mobile evidence sources, we’re excited to introduce our latest mobile integration: you can now initiate processing of all filesystem and other extractions with Magnet Axiom and Magnet Axiom Cyber directly from a Magnet Graykey or Verakey on the same network. This includes the decryption of keychain (iOS) and keystore (Android) data, providing access to additional device passwords and application data.

This feature will help to speed up your mobile workflows by eliminating previously required steps and manual touchpoints while helping you surface the most data and provide the best analysis and insights for your case.

For the purposes of this post, we will continue to reference Axiom and Graykey, but the same process also applies to our corporate customers using Axiom Cyber and Verakey devices.

Combining the Capabilities Magnet Axiom and Graykey

The combination of Axiom and Graykey gives you the most powerful and easiest to use end-to-end solution for investigations that involve evidence from mobile data sources.

Axiom was designed to support the most in-depth analysis of mobile devices—including uncovering and parsing data from Graykey extractions. Axiom’s powerful image processing, advanced mobile artifact coverage, and built-in analytics features like Connections, Timeline, Media Explorer, Cloud Insights Dashboard, and Magnet.AI can help you quickly get the evidence you need and automatically generate insights that could lead to important breakthroughs in your case.

Graykey is the leading mobile data access and extraction tool, offering same-day extractions on locked and unlocked iOS and leading Android devices. Graykey’s comprehensive mobile device coverage and powerful extraction capabilities help you quickly get the most data from your mobile sources, irrespective of the device state.

The benefits that come from combining these two industry leading solutions, include:

• A complete end-to-end solution for mobile investigations
• Acquire the most mobile evidence possible, including deleted data, with industry-leading access, extraction, parsing and carving
• Expedite your investigations with features that mitigate manual processes and streamline your investigative workflow
• Combine mobile data with computer, vehicle, and cloud sources for review, analysis, and reporting, all in one platform

Now that we’ve officially joined forces, we’ve been hard at work adding even more valuable new functionality between our products to help you to streamline your mobile workflows even further!

How to Enable the Graykey to Axiom Integration

To start this integration, a one-time configuration must first be completed in Axiom. To access the configuration settings, make sure to download or update to the latest versions of both Axiom and Graykey.  Both the Graykey and Axiom instance will need to be on the same subnetwork to configure and use this integration.

Open Axiom Process and navigate to Tools > Settings

Then scroll to the bottom of the settings page and select Graykey / Verakey Discovery

Once you have checked the Graykey / Verakey Discovery, configuration choices will be displayed.

You have the option to select the port number to be used, as well as location for the Acquired Evidence and Location for the Case Files that will be pulled from the associated Graykey or Verakey device.

You then need to click on the Start Service box. This will allow the connection between Axiom and the Graykey / Verakey unit.  You will see the red dot (not currently connected) change to a green dot (connected) successfully.

You can then scroll down a little further where you will be able to open a dashboard to view the integration status.  If you click on the Open Dashboard, it will take you to an Axiom Process Graykey / Verakey integration status page on your Graykey or Verakey device. This interface will allow you to see the Image Name, Image Type, Graykey Address, Start Date, Completed date, Status, and Description.

Now that this has been set up within Axiom, we can navigate to the associated Graykey or Verakey unit to start extracting mobile images and initiating processing in Axiom.

Launching an Extraction Directly from Graykey into Axiom

Once you have completed the setup in Axiom, all configured Axiom instances will display in the dropdown menu of the Graykey Interface. This allows you to stay in the Graykey interface and push extraction to Axiom workstations on your local network for processing.

Extractions can be sent automatically to Axiom during the initial access phase of the extraction or once the extraction has already been started via the “send automatically to Axiom” button in the Graykey interface.

You can monitor detailed progress status of the Axiom image processing through the new Graykey web dashboard.

Axiom automatically validates that the files were correctly loaded using the hashes. and will then process the case. Once processing has completed, you can then begin examining the mobile data via Axiom Examine using the built-in analytics features to quickly find the evidence you need for your investigation.

Learn More About Axiom and Graykey

Want to know more about how Graykey and Magnet Axiom can work together? Reach out to us at sales@magnetforensics.com for more information.

To experience the mobile image processing capabilities of Axiom or Axiom Cyber for yourself, update to the latest version over at the Customer Portal or request a free trial today!