Ingesting Web Page Saver Results into Magnet AXIOM
Hi! Jessica Hyde here to share with you about how to integrate results from the MAGNET Web Page Saver (WPS) tool into Magnet AXIOM. MAGNET Web Page Saver is a free stand-alone tool that allows you to navigate to webpages and save the results. You can learn more about MAGNET Web Page Saver in this Tips and Tricks session with our CTO and Founder, Jad Saliba.
Starting with AXIOM 4.4, you can bring your WPS results into AXIOM as a new source and have artifacts parsed from the results. This workflow is focused on ingesting exports from WPS. For details on exporting URLs from AXIOM for use with WPS check out the Exporting URLs from AXIOM for use with Web Page Saver blog.
Options in WPS
When using Web Page Saver with the intent of ingesting the results into AXIOM, you will want to utilize the SQLite capture format. AXIOM will then be able to parse the resultant SQLite Database. Before hitting Start, verify that the SQLite checkbox has been selected.
Now it is time to start the capture. Select Start with Automated Capture selected to begin the automated acquisition of all the webpages you requested.
Bringing WPS Results into AXIOM
AXIOM 4.4 introduces an artifact specific to parsing Web Page Saver results that were saved as a SQLite DB. You can introduce these results as a source to a new or existing case. Load this source as Computer > Windows > Load Evidence > Files and Folders > File Browser. Then select your SQLite DB. Once you get to artifact details, ensure you are using the MAGNET Web Page Saver artifact—this should be the only artifact necessary for processing this source.
Examine will then open and you will see your MAGNET Web Page Saver results in the Web Related artifacts in AXIOM. You will see three separate artifacts: MAGNET Web Page Saver Captured HTML, MAGNET Web Page Saver Captured Media, and MAGNET Web Page Saver Captured Webpages.
The MAGNET Web Page Saver Captured Webpages artifact will display the preview of the web page, extracted text, URL, and the Captured Date and Time. The capture date and time as well as the resultant MD5 hash may be valuable for the integrity of the data captured for the case.
Want to see WPS in action? Download MAGNET Web Page Saver for free and give it a try!
Looking for a more complete workflow where you discover URLs of interest in AXIOM, export them for capture in Web Page Saver and then bring those results back into AXIOM to complete reporting and analysis? Check out this video from Tarah Melton that walks through the entire workflow:
I hope this post is helpful in your analysis of URLs! How are you using MAGNET Web Page Saver in your investigations? Feel free to reach out and let me know at jessica.hyde@magnetforensics.com.