Unlock faster mobile forensics with Magnet Axiom Express Extraction
As mobile evidence continues to grow in both data size and importance as a source of information in investigations, streamlining the investigative process is more critical than ever. To help you access mobile data faster, we’ve introduced a new extraction and processing option in Magnet Axiom Premier and Magnet Axiom Cyber for mobile devices accessed with Magnet Graykey and Magnet Verakey, called Express Extraction. This new workflow accelerates your mobile process by combining extraction and processing into one efficient step within Axiom.
The benefit of extraction using Axiom
The continued growth of the storage capacity of mobile devices results in longer extraction timelines, which can tie up the access device and lead to delays in accessing additional devices. With Express Extraction, Graykey is used for initial access to a mobile device, which can then be removed from Graykey and connected to a forensics workstation where data is acquired and processed in Axiom in one streamlined step. Similarly, a mobile device is first connected to Verakey to access and select the extraction type from an unlocked state.
By moving extractions over to dedicated forensics workstations, extraction speed is significantly faster, and Graykey is freed up to continue gaining access to additional devices. In an independent customer test comparing extraction speed on Graykey versus moving the extraction to a forensics workstation, the extraction of a 110GB phone was completed about 70% faster, finishing in 38 minutes on a workstation compared to 136 minutes on Graykey.
Streamlining extraction and processing
Running extractions on the same forensics workstation as Axiom streamlines your mobile workflow, combining extracting and processing into one easy step. This also gives you the ability to leverage Axiom’s advanced mobile processing capabilities and the option to apply custom processing settings to your extractions. This workflow also eliminates waiting for an extraction to complete before configuring the evidence processing in Axiom, saving you valuable time in your investigations.
By adding a cloud-hosted instance of Magnet Review to the mix, following initial access on Graykey, you can set up the extraction to run autonomously using Axiom and automatically send those results to Magnet Review. Results stream to Review as they are processed, providing an end-to-end workflow that helps deliver mobile insights to stakeholders as quickly and efficiently as possible.
Putting Express Extraction into practice in your lab: Criminal investigations
Consider this scenario: you’re just settling into your workday when the violent crime team arrives. There’s a new high-stakes case, and they’ve brought in a stack of phones that need to be processed.
As always, you want to get that information back to the investigators as quickly as possible to help uncover key insights for the case. In the past, you would’ve had an even longer day ahead of you, working into the evening, standing by to monitor the extractions so that as soon as a phone is ready (or as soon as you noticed it’s ready), you’d grab a drive and move the extraction over to your processing workstation.
But with Express Extraction, once you’ve gained initial access in just a few minutes, you simply move the phone over to your Axiom workstation. From there, extraction and processing run without any manual touchpoints, providing a complete digital workflow so that you come back ready to analyze data. Combined with a cloud-hosted instance of Magnet Review, you can even share the case directly to the investigator to monitor the results as they are processed.
With one device on its way and your Graykey freed up, you can immediately begin preparing the next phone which can then be extracted and processed on another Axiom workstation. This keeps your lab equipment running at its full capacity getting the evidence to your team faster and helping you avoid burning the midnight oil overseeing the extraction and processing workflow with manual prompts that add additional time and delays to obtaining critical insights.
Putting Express Extraction into practice in your lab: Internal investigations and eDiscovery
For those who perform mobile investigations in-house or as an external service provider, getting your clients or employees their devices back as soon as possible is crucial. Besides the fact that giving up a device for any length of time is an inconvenience, faster turnaround helps maintain employee productivity and reduce overall investigation costs.
By using the Express Extraction workflow, you’re able to reduce bottlenecks by moving extractions to your workstation instead of on the Verakey hardware and deliver critical evidence to your stakeholders faster—especially if you’re using Review where results can be immediately shared. With Express Extractions, you can exceed stakeholders’ expectations and get devices back in hand sooner.
Get started with Axiom Express Extractions today
If you are already using Axiom with a Premier license or Axiom Cyber and own a Graykey or Verakey, simply update to the latest version and check out our support article on setting up Express Extractions. If you aren’t already using Axiom or aren’t on an Axiom Premier License, you can request a trial to experience Express Extraction for yourself.