Using the Geolocation Data Filter in Magnet AXIOM & AXIOM Cyber

Hi, all. This is Jessica Hyde with Magnet Forensics. I am really excited about a new filter available in AXIOM and AXIOM Cyber 4.8 that allows you to filter on data that has geolocation. This can be very useful if you want to specifically look at content that contains geolocation and sort and filter on other columns in the Artifact Explorer.

In previous versions, you could filter on items with geolocation data by selecting World Map View. However, this new filter allows for additional functionality to look at artifacts that contain geolocations with a combination of other filters and keywords as well as other views such as Column View and Thumbnail View.

In previous versions of AXIOM, you could accomplish these same filters by going to the Map View, tagging all the content there with a custom tag, and then using that tag as a filter in Artifact View. The new “Items with geolocation data” enables that same process with one click. You now have a filter with your content in your column view in artifacts where you can easily keyword search, stack additional filters, and sort on columns.

To use the new filter, go to “Content types” in the FILTERS bar at the top of the screen and select “Items with geolocation data”. Your data will then be filtered data that contains geolocation artifacts. In the example below that results in 3,710 artifacts out of 187,202.

Seeing all your artifact results with geolocation for a particular timeframe in column view can be quite powerful. In the example below, there are several geolocation artifacts that were captured on 3/6/2020 within the 7:55 PM minute. These include a picture, as well as Google Location data that includes information about the likelihood that the person is standing still. These separate artifacts can be used to demonstrate that not only does the photo EXIF data contain this location, there is also data about where the device is at the same time.

This can be powerful when just looking at pictures alone. For example, below both a keyword and timestamp filter have been applied to this data with the results in Thumbnail View. As seen in the screenshot below, additional sorting and filtering by EXIF data and others, such as skin tone percentage, cand be applied in Thumbnail View. Additionally, these filters can be narrowed with Magnet.AI findings.

As always, switching to World Map View will automatically show artifacts with geolocation data. You can use this view to drill down using Google Maps from within AXIOM. Additionally, you can create a KML export of all artifacts with geolocation data. To learn more about KML exports to use in other mapping tools, check out Tarah Melton’s video here:

We are really excited about the extra flexibility this new filter will bring to the analysis of your investigations. To see the filter in action, check out Tarah Melton’s video here. If you have any questions or comments about this or any other feature, please reach out to me at jessica.hyde@magnetforenics.com.