Lab (Axiom): Full Case Process

by


 

In this running exercise, we will go through the steps to create and process a new case in Axiom.

▶ Lab Resources

Please refer to the following reading material to assist you with completing the lab:

Case Creation and Processing in Axiom

Actions

Lab Instructions for Axiom: Full Case process

Actions

▶ Lab Tasks: Follow all the steps to complete the lab

  1. Create a folder on your desktop named “Justine_Beaufort”
  2. Open AXIOM Process from the icon on the Desktop and click to Create New Case. If you are prompted to turn off antivirus, do so.
  3. Case number: 01_ JustineBeaufortCase.
  4. Case type: Major Crimes
  5. LOCATION FOR CASE FILES
  • Folder name – Leave the default folder name.
  • File path – This is the location where we want AXIOM to save all of our case files. Browse to the folder “Justine_Beaufort” on your desktop and click “Select Folder.”
  1. LOCATION FOR ACQUIRED EVIDENCE
  • Folder Name – Leave this the default name.
  • File Path – This is the location where we want AXIOM to save any image files that it creates during processing. Browse to the folder “Justine_Beaufort” on your desktop and click “Select Folder.”
  1. SCAN INFORMATION
  • Scanned by – Enter your name.
  • Description – Enter a description of the item. For this case, our first item of evidence is a computer hard drive. The description of the drive is, “WD hard drive of suspect, Justine Beaufort.”
  1. Press the “Go to Evidence Sources” button.
  2. SELECT EVIDENCE SOURCE: Computer
  3. LOAD OR ACQUIRE: Load Evidence.
  4. SELECT EVIDENCE SOURCE: Image. Browse on your desktop to the folder “Lab Files” then select it. You will see all of the evidence folders for the different labs. Select the folder Lab – Full Case Process and Lab-Chat Image Files. Then select JustineBeaufort.E01(Remember if you have multiple E01’s from the same case, always point to the first one to read them all), select the image, and click Open.
  5. Make sure all the partitions are selected, then press NEXT.
  6. SELECT SEARCH TYPE: Partition 1 – Full. Unpartitioned space – Unpartitioned space. Click NEXT.
  7. EVIDENCE SOURCES ADDED TO CASE: Click on the name listed on the evidence. We want to rename it so that it is more descriptive. Rename each one, “Item 1: WD hard drive of suspect”. Once you type the new name, click SAVE to save the changes.
  8. Click GO TO PROCESSING DETAILS
  9. ADD KEYWORDS TO SEARCH
  • Add the keyword list name owlKeywords.txt(Located in the Justine_Beaufort Folder). All of the keywords are then populated in the Keywords box.
  1. Click GO TO SEARCH ARCHIVES AND MOBILE BACKUPS
  • Ensure that Search Archives and Search Mobile Backups are checked. When AXIOM finds any type of archive file (.zip, .tar, etc.), it will extract the data. If AXIOM finds a mobile backup, it will extract all of the data and process it using the Mobile Artifacts.
  1. Click GO TO CALCULATE HASH VALUES
  • Ensure that the checkbox to calculate hash values is checked.
  • IGNORE NON-RELEVANT FILES: Ensure that all three hash set lists are checked (if the non-relevant hash sets are loaded).
  1. Click GO TO CATEGORIZE CHATS
  • Note that we can categorize for Grooming/Luring and Sex-related. For this case, we do not want to check either one.
  1. Click GO TO CATEGORIZE PICTURES AND VIDEOS
  • Note the categories for Magnet.AI. We can also load hash sets from Project Vic or our own custom hash sets. For this case, we are not selecting any of these options.
  1. Click GO TO ADD CPS DATA TO SEARCH
  • Note that we can add a CPS export file. We will discuss this further later in the course. For this case, we are not adding a CPS export file.
  1. Click GO TO FIND MORE ARTIFACTS
  • Ensure that the checkbox for “Allow AXIOM to find more artifacts” is UNCHECKED. We will discuss this further later in the course.
  1. Click GO TO ARTIFACT DETAILS
  • Since we loaded an item of computer evidence, the only option available to us is COMPUTER ARTIFACTS.
  • Click CUSTOMIZE COMPUTER ARTIFACTS. Check all Computer Artifacts categories except for Custom Artifacts. Uncheck CUSTOM ARTIFACTS.
  1. Select the artifact category for Cloud. Select OPTIONS for Dropbox. If you have known user passwords, you can enter those here. For this case, we do not have any. Click OK to exit Dropbox Options.
  2. Click GO TO ANALYZE EVIDENCE
  • This provides the user with one final review of the SOURCES TO PROCESS.
  1. Click ANALYZE EVIDENCE (Process the case, the reading material says not to, but I want you to go ahead and process this case.)
  • This will open Axiom Examine in a new window and the case will process. The processing for this case takes around 5 to 6 hours. Plan Accordingly on time.
  1. Paste a screenshot below showing the completed and processed case dashboard with the processing results updated after finishing processing the Justin_Beaufort Hard Drive Image:

View RubricFull Case Process in Axiom RubricFull Case Process in Axiom RubricCriteriaRatingsPtsLab Task: Question 27view longer description100 ptsScreenshot fully processed and completeScreenshot shows case fully processed and completed as required.80 ptsScreenshot Correct but Not fully processedScreenshot of case, but not obvious that it was fully processed.60 ptsScreenshot Partially ProcessedScreenshot does not show that case was fully processed. So not sure if completed correctly.50 ptsScreenshot is incorrectEither Screenshot is incorrect, does not show case processed. Screenshot is of wrong item and is not helpful in determining if case was completely processed.0 ptsNo MarksNo answer, no screenshot given./ 100 ptsTotal Points: 0

Choose a submission type

Submission type Upload, currently selectedUploadMore submission optionsMoreTake a Photo via WebcamSubmit file using Webcam PhotoWebcam PhotoSubmit file using Canvas FilesCanvas Filesor Drag a file here, or click to select a file to upload