The Media Explorer in Magnet AXIOM
Investigations that center around media review and analysis often require additional examination time as lab personnel examine images and video found on devices. These investigations can range from ICAC to corporate investigators conducting searches for screenshots of potential intellectual property theft. In this blog we’ll highlight the new Media Explorer found within AXIOM and how examiners can use it within their examination workflows.
You can upgrade to AXIOM in-product or over at the Customer Portal.
If you haven’t tried AXIOM yet, request a free trial here.
Over the years we’ve worked hard to make media review improvements to AXIOM. In 2018 we expanded Magnet.AI capabilities beyond contextual chat analysis and added picture analysis for child exploitation, nudity, and potential screenshots. We also focused on improving Magnet.AI’s performance, adding additional support for NVIDIA GPU hardware to help with increasing image classifications speeds*. In 2019 we completely revamped our Project VIC support, providing faster JSON exports, as well as receiving VICS certification for AXIOM for use with Project VIC and CAID hash sets.
Getting Started with Media Explorer
After updating to AXIOM 5.0 or later, from the case dashboard navigation drop down will include the Media Explorer. In order to use Media Explorer you’ll need to process the media in addition to the artifact processing that has already been completed; similar to how post-processing is needed for Connections and Timeline viewing. Post-processing for the Media Explorer will initiate when you select Media from the navigation drop down, or if you rather have features such as Timeline, Connections, and Media Explorer automatically post-process, navigate to settings from within AXIOM Examine and select the Post Processing options you’d like run for your future cases.
Now that the Media Explorer has been built, let’s take a look at what all it has to offer examiners as they review images and videos within AXIOM. With Media Explorer, the goal is to aid in providing investigators easy and intuitive means for culling images as they work through investigations. As you see in the example, down the left-hand side of AXIOM we have various filters that can quickly be used for just that. Whether investigators are working from leads they have from sources such as when a suspected crime occurred, or a specific location we can use the various filters found under the Investigation Leads section to narrow the search.
Users can also filter based on items such as camera make, as well as camera and lens model and serial numbers. Attributes found within VICS hashsets such as Category and Categorization Source, VICS comments series, tags, Identified offenders and victims along with indicators for self generated and distributed media. Additionally, filters for skin tone %, file size, media attributes such a filtering by extension type, recovery method or even file attributes found on particular file system’s like APFS and MIME type can help narrow results for examiners. Video attributes such as carved video file size, container format, content format and media duration provide even more opportunities for focusing on media files pertinent to the examination.
Examiners can take advantage of AXIOM’s CBIR (Content Based Image Retrieval) feature in Media Explorer. By right clicking a picture of interest in the evidence pane and then “Select picture”, AXIOM will then search for pictures that are visually similar to the picture. The results will be displayed in the evidence pane for further review. To search for pictures similar to another, “Import picture” will browse to the file of interest.
Additionally, we’ve included a new Hit Stacking feature, which groups media containing the same data comparison parameters into a single item. Hit Stacking can be applied to files with the same hash value (MD5 or SHA1) or files using the same PhotoDNA delineation. Users will see numbers such as “1 of 5” with a stacked icon under each image within the media thumbnail view. In this example, there would be 5 copies of the same picture found in various locations within the evidence. Users can select the stack icon to reveal the matching hash and related information such as the locations the images were found.
Another welcomed addition to AXIOM is the ability to hover over image/video, which will provide a larger, higher resolution preview of the image or video. Users can also zoom and pan around an image within the preview. For videos you can use the mouse to quickly scroll through the contents of the video, which we refer to as Video Scrubbing. This feature can be toggled on / off in Settings (see above).
As we have in earlier releases of AXIOM includes purpose-built Officer Wellness features which can now be used while working within the Media Explorer. These include**:
- Block, blur, or view thumbnails of media that has been graded
- Mute sound when viewing videos
- Set reminders to take breaks from grading media or an alert to stop grading for the day
- Automatically apply categorization from known hash sets, like Project VIC or CAID, or from other known hash sets
- Clear indicators of categorization progress so you can immediately see how much media has been graded
We’re excited for customers to give AXIOM 5.0’s features a try. As always, don’t hesitate with to reach out if you need anything at trey.amick@magnetforensics.com.
* https://www.magnetforensics.com/blog/a-look-back-at-2018-resources-for-icac-investigations/