AX220 Mobile Filesystem Analysis

Course Modules

Module 1: Course introduction and Magnet Axiom installation
• In this introductory module, the learning objectives will be presented along with the expected outcomes for the two-day training event and all related course materials.
• The module will conclude with a hands-on exercise during which students will install Magnet Axiom and learn about its associated components: Axiom Process and Axiom Examine.

Module 2: Evidence processing and case creation
• This module of instruction will focus on the many features available in Axiom Process.
• Students will be shown how to successfully acquire forensic images from various evidence sources, configure case-specific and global settings in Axiom Process for the recovery of key artefacts, and create a case for analysis in Axiom Examine.
• After the creation of the case, the Axiom Examine interface will be introduced.
• This module includes an instructor-led exercise to reinforce the learning objectives.

Module 3: Mobile device security, device states, and acquisition types
• This module will focus on the current state of mobile device security with a focus on best practices for handling, preserving, and acquiring the data contained within.
• Students will be given an overview of mobile device security, acquisition types available for specific device states and scenarios, and a basic understanding of mobile device file systems for both iOS and Android devices.

Module 4: User attribution
• Students will learn about the core artefacts for determining user attribution in this module.
• These artefacts enable the examiner to determine identifying information about the device, its software (including operating system and installed applications), and user accounts associated with the device.

Module 5: Communications
• In this module, students will learn about the Communications category of Magnet Axiom for mobile devices including how to use the Conversation View, threaded chats, and filtering of data in order to understand and parse conversation data.
• Artefacts for this section include iOS iMessage/SMS/MMS, Android SMS/MMS and RCS messages for third-party applications.

Module 6: Web related
• Students will explore web-related categories including iOS Safari and the Chrome, Samsung, Brave, and DuckDuckGo browsers on Android.
• From there, they will learn how these browsers store their data and how Axiom parses URL and other information for review.

Module 7: Refined results
• Designed to instruct students on how to use Refined Results in Magnet Axiom in mobile examinations, this module will also help them to understand Magnet Axiom Examine’s basic functionalities including filtering and searching.
• Students will break down what Refined Results are within Axiom and how to properly utilise them.

Module 8: Media
• In this module, students will explore the Media category for artefacts including pictures, videos, and audio files.
• Students will learn how to visualise the data using the built-in Preview cards, how to filter on data within the Artifact Explorer and how to direct a filter from the File System Explorer.
• Students will develop a workflow for dealing with media data in mobile devices.

Module 9: Pattern-of-life artefacts
• In this final module, students will explore the pattern-of-life artefacts which contain data about the device’s power, network, and application usage, as well as location information.
• For iOS devices, students will learn about artefacts from Biomes and KnowledgeC, Significant Locations, Apple Maps and FindMy.
• For Android devices, students will learn about artefacts from Samsung Digital Wellbeing and Android Usage History.