AX400 Advanced Mobile Data Analysis

Magnet Forensics products including Magnet Axiom, Magnet Graykey and Magnet Verakey are extremely valuable tools for mobile acquisition, deep analysis of data, and being able to report findings for stakeholders—saving you time and allowing you to solve cases in a more efficient manner.  

If you haven’t already, it is strongly encouraged to complete the Magnet Axiom Advanced Mobile Forensics (AX300) course which will familiarize yourself with even more file types found within mobile operating systems. From an acquisition perspective, you may want to consider taking either the GK200 course for GrayKey (law enforcement only) or VK200 for Verakey (private sector). These two courses will give you hands-on experience with mobile device acquisition.

While Axiom is equipped to navigate evidence derived on mobile devices, it will be impossible for any tool to have native, first-party support for every single application on the app stores. Learning to write custom artifacts derived from unsupported applications allows the examiner to tailor their Axiom experience, providing a method to examine unsupported data in a tool they’re already familiar with.

Before writing a custom artifact, examiners should have an understanding of the underlying file types and how data can be stored within mobile file systems. Students in the course will explore mobile operating system file types even deeper, with data extraction from existing file types, like SQLite databases.

This course will go even further by decompiling APKs from Android apps, helping examiners understand how encryption might come into play with applications, and potentially understand just how the application is using particular.

Our world-class trainers will bring their years of practical and research expertise to the classroom and share the latest trends that examiners need to be aware of, keeping them one step ahead in their investigations. Magnet Forensics Trainers have had active experience in investigation and forensics, bringing with them a wealth of knowledge to the classroom experience. The classroom experience will bring together tips and tricks, deep analysis, and the latest research into a training scenario using some of the latest mobile operating systems and popular applications. This, combined with the opportunity to ask questions and collaborate with our trainers and other attendees, is invaluable.  

Course Highlights

When students attend the AX400 course, they receive a dedicated two-day course that will utilize instructor-led scenario-based experience to reinforce the learning objectives of the specific learning modules. It will further enhance your understanding of unsupported data of both iOS and Android devices, discussing the latest changes of the operating systems whilst also learning to confidently evaluate and validate unsupported data types for stakeholders.

Course modules

Module 1: Course introduction and environment setup

Students will begin by exploring the course outline and meeting their instructor and fellow students. Students will gain an understanding of the course's depth and focus while preparing the necessary software and tools for success. By the end of this module, students will have a clear understanding of the data structure types to be explored and a fully prepared classroom environment.

Module 2: Extraction and analysis of mobile data structures

The structure and forensic significance of a variety of different data structures including Property Lists (PLists) Protobufs and XML will be examined in this module. Students will decode ABX files and binary PLists, explore NSKeyedArchiverPLists, and analyse Protobufs used in serialised data storage. Students will gain the ability to decode complex data structures, analyse embedded artifacts, and understand the forensic implications of application intents and serialised data within mobile devices.

Module 3: Creating custom artifacts

In this module, students will learn to navigate unsupported third-party applications and create custom artifacts to meet investigative needs. Students will load these artifacts into Magnet Axiom for processing and leverage the Dynamic App Finder to identify and process unsupported SQLite databases. By the end of this module, students will understand the importance of custom artifacts and how to utilise them effectively to extract critical data.

Module 4: Advanced artifact customization

Students will learn how to further customize artifacts for unsupported applications using Magnet Custom Artifact Generator (MCAG) in this module. The opportunity to learn how to leverage SQLite to generate queries and further customise artifacts for unsupported applications will be presented. After the module is completed, students will understand how to effectively utilise the Magnet Custom Artifact Generator and SQLite queries to maximise evidence collection from mobile applications.

Module 5: Understanding and decrypting encrypted applications

In this module, students will dive into mobile device encryption, focusing on key elements like the Android Keystore. Students will decrypt previously discovered encrypted files and learn how to decompile Android application APKs for investigative purposes. By the end of this module, students will understand encryption methodologies, the role of the Android Keystore, and how to decrypt an encrypted database using tools such as JadX and DB Browser for SQLite.