Better Case Starting Points with Magnet AXIOM’s New Case Dashboard

All data is not equal in a forensic examination—and the more data that’s available, the more difficult it is to organize and prioritize. As data volumes grow and users struggle to find the meaning across large swaths of evidence, the need for better digital evidence organization has continued to resonate.

Magnet AXIOM’s new Case Dashboard, available as of v2.0, responds to that need. Your new “in-app” home screen for each case you work in AXIOM Examine, the Case Dashboard takes AXIOM’s data categorization up a notch by focusing on actionable insights, immediately filtering case information to avoid clutter.

This way, it helps you to kick off investigations with a better starting point, as well as to collect summary details for reports. Here’s how we do it:

A Left-to-Right Informational Funnel

The new AXIOM Case Dashboard is designed similarly to the existing Artifact Explorer: it layers, or funnels, results from the highest level on the left to more detailed information on the right. (However, it doesn’t replace the Artifact Explorer—it just helps you decide where to explore first.) As we show in the video:

• The left “Case Overview” column contains top-level case details, a space for you to enter case summary notes, and quick access to logging, as well as your case info file.
• The middle “Evidence Overview” column contains details specific to the evidence sources in your case. Here, you can see an overview of your computer, mobile, and cloud sources
• The right “Places to Start” column gives you a place to immediately jump into specific areas of interest. Top artifact categories in your case, tags and comments—including Magnet.AI results—keyword matches, any cloud passwords and tokens, a media categorization summary, and even suspect and victim profiles can be found here.

A Shorter Time to Actionable Insights

With AXIOM’s Case Dashboard, we wanted to address the continuing challenge that many forensic examiners encounter: interpreting the evidence in a way that will be useful to the investigator, without needing to know all the case intricacies.

In other words, investigators may only provide the highest level of information about what kind of case they’re working, what evidence they think might be relevant, and/or what their search warrant covers. The Case Dashboard shows whether their estimates are correct, as well as identifying whether there might be additional data that’s relevant within, say, a certain date and time range.

In this way, it offers a strong starting point regardless of how much information you’re starting with. By collecting high-level summary details and their context, the Case Dashboard organizes data so that you can get to what you—and/or anyone else—need much more quickly. For example:

• While executing a search warrant for suspected sharing of child abuse material, a law enforcement investigator seizes or images four smartphones and one laptop. After loading all the images into AXIOM, the forensic examiner uses the Case Dashboard to quickly review Magnet.AI results related to child abuse image detection. Magnet.AI also reveals that luring and sexual conversations have taken place.
• A corporate investigator acquires and processes the computer of an employee suspected of stealing intellectual property. The Case Dashboard provides computer and cloud (Microsoft® Office365®) evidence summaries, along with keywords related to the investigation. Examiners immediately review all evidence related to the keywords and follow the trail of evidence to determine what content was taken, who accessed it, and where it was sent to.

In both of these scenarios, data is acquired in what can be very time-sensitive situations. That’s what good dashboards accomplish: they can make all the difference in how quickly you find data that’s relevant to your case. If you’d like to see AXIOM 2.0’s Case Dashboard in action, contact us for a free demo.