Working with Magnet AXIOM

Magnet AXIOM is one of the most popular tools for digital forensics. It supports both computer forensics and mobile forensics, with complete support for almost all Android and iOS devices. The software has two modules, AXIOM Process and AXIOM Examine. The first module is responsible for acquiring evidence from a device or loading an existing extraction, and performs data parsing and decoding. When the decoding process is done, you can use AXIOM Examine to review all recovered artifacts and analyze the data.

Loading evidence and on-the-fly processing

One of the key features of Magnet AXIOM is that it allows investigators to start analyzing artifacts while the data is being processed. This is a life-saving feature in all those circumstances where time is a critical factor and evidence needs to be reviewed as soon as possible.

In the following example, we'll learn how to load an existing filesystem extraction from an iOS device into AXIOM Process...