GO200 Griffeye Operations

Module 1: Course introduction

This module introduces the structure, objectives, and scope of the Magnet Griffeye Operations course.

Students are oriented to how Griffeye Operations supports large-scale media investigations and how categorization and intelligence contribute to effective, defensible workflows.

The module explains the Griffeye Operations architecture, including client-server design and intelligence databases, and establishes the investigative scenario used throughout the course.

Students also complete the initial environment and classroom setup to ensure they are prepared for all subsequent hands-on exercises.

Module 2: Navigating Griffeye Operations

This module introduces the core Griffeye Operations interface and foundational concepts required to work confidently within a case.

Students learn how to navigate dashboards and case workspaces, understand how organizational settings influence investigations, and apply consistent tagging and bookmarking practices.

The module establishes essential categorization and intelligence concepts, including how files are classified, counted, and de-duplicated, ensuring students can accurately interpret case data before progressing to case processing and workflow management.

Module 3: Case processing with Operations

This module focuses on how intelligence databases and case processing workflows work together within Magnet Griffeye Operations.

Students learn how Griffeye Intelligence Databases (GIDs) are managed and applied during evidence import to support known-file matching, automated categorization, and efficient triage.

The module also introduces structured case creation and case-opening options, ensuring students understand how configuration and opening criteria influence collaboration, workload distribution, and what material is presented for review within the workspace.

Module 4: The Workflow Checklist and wellbeing features

This module introduces the features within Magnet Griffeye Operations that support structured, consistent, and wellbeing-focused investigations.

Students learn how the Workflow Checklist is used to guide investigators through an organization-approved sequence of tasks and how it supports consistent workflows across cases and teams.

The module also emphasizes examiner wellbeing by introducing visual and time-based wellbeing features designed to reduce the impact of reviewing high-harm media and promote sustainable working practices.

By the end of this module, students understand how to configure and use these tools to support both investigative quality and examiner safety before beginning detailed categorization work.

Module 5: Filtering and inaccessible files

This module focuses on how structured filtering and accessibility concepts are used within Magnet Griffeye Operations to support efficient triage and informed investigative decision-making.

Students learn how to apply and manage filters to reduce large or complex datasets into meaningful, reviewable subsets and how advanced filtering techniques can surface high-value forensic leads.

The module also introduces the distinction between accessible and inaccessible files, explaining how accessibility status is determined, reviewed, and incorporated into filtering strategies to ensure examination accuracy, reporting integrity, and a clear understanding of user-attributed activity.

Module 6: Searching techniques

This module introduces the full range of searching and analysis capabilities within Magnet Griffeye Operations and demonstrates how different search methods can be applied to efficiently examine large or complex datasets.

Students learn how text-based, metadata-driven, visual, facial, and video searching techniques support investigative objectives and enable targeted analysis.

The module emphasizes how combining multiple search approaches allows investigators to rapidly surface relevant material, identify patterns, and focus review efforts on high-value evidence while maintaining efficiency and control over large result sets.

Module 7: Utilizing apps

This module introduces the intelligence applications and services available within Magnet Griffeye Operations and explains how they enhance analysis, triage, and review of digital media.

Students learn how application-based intelligence can be used to surface high-risk material, identify geographic and platform-related indicators, assess media provenance, and apply advanced AI-driven classification.

The module emphasizes how these apps support informed investigative decision-making by adding contextual intelligence, improving prioritization, and reducing manual review effort when working with large or complex datasets.

Module 8: Reporting and updating the GID

This module completes the investigative workflow in Magnet Griffeye Operations by focusing on exporting results, producing reports, and promoting finalized intelligence for future use.

Students learn how different export and reporting options support investigative, disclosure, and collaboration requirements, and how structured reporting presents findings clearly and defensibly.

The module also introduces the process of updating Griffeye Intelligence Databases (GIDs), emphasizing how reviewed and categorized material can be promoted to shared intelligence repositories to support consistent matching and improved efficiency in future investigations.

‍