Learn more about how Magnet Forensics clears investigative barriers from first access to final verdicts.
The following transcript was generated by AI and may contain inaccuracies.
Jeff Rutherford: Hi everybody, and welcome to this webinar. Today we’re going to talk about end-to-end digital investigations: the process and the tools we’ve got. There have been some questions about how you get your evidence all the way through to review and then into court, and what tools we have to make that happen.
Digital evidence has been exploding over the past few years. It’s part of almost every crime; it’s now the backbone of evidence. And as this evidence has increased, what has happened to our digital investigative teams?
Well, they haven’t really grown. I remember when you’d see 16, 32, or even 64 GB phones. Now it wouldn’t be uncommon to find a 1 TB phone coming into your lab. The unfortunate truth is that it’s going to be difficult for labs to keep up.
How do we prevent our data from being stovepiped? When we use multiple tools, it’s easy to end up with multiple platforms we have to review in. How do we better enable our investigators, and especially our digital forensic examiners, to handle these increasing data volumes?
With media investigations in particular, which we’ll talk about, how do we deal with the legal restrictions? We’re being asked to do a lot more with about the same resources we already have. And especially if you have stovepiped data, how do you prevent missed evidence?
There are a lot of issues to deal with. But something we’ve talked about in the past, and which I think is still an important approach going forward, especially when it comes to validating our results, is that we need to take a toolbox approach.
It’s important that our software, our extractions and our results have some level of interoperability. This has been the direction for many years now: we have results, we need to be able to compare them, and we need tools that fit into multiple workflows.
The problem is that this can cause some of the issues we saw on that first slide: we end up with siloed data. How many times have we handed off evidence, especially to a non-technical reviewer, and given them several platforms to review their data in?
That can be challenging. Having a reviewer learn multiple platforms is difficult, no matter how simple those platforms may be. So in this webinar, we’re going to talk about how we can use the Magnet platform to go all the way from end to end: extracting our evidence, processing it, getting it to review, and then hopefully back to the examiner to validate and verify the results and produce a report that’s ready for use in court.
That’s the gist of end-to-end digital investigations. So how do we deal with these mounting challenges: security measures on mobile devices, overwhelming data volumes, and the need for rapid collaborative workflows? Magnet’s platform addresses these challenges by integrating multiple solutions together.
That’s GrayKey, GrayKey Fastrak, Magnet AXIOM, Magnet Verify, Griffeye and Magnet Witness, with Magnet One as the backbone, which includes tools like the SaaS-based Magnet Review. I’ll show you how each of these tools can integrate to give you end-to-end digital investigations, empowering your agencies to deliver timely, defensible results and enhancing public safety and outcomes.
That’s the overall picture. Let’s start at the very beginning, when you have your device, especially a mobile device. How do we get access? I’m going to use this quote and expand upon it: we have devices that are becoming increasingly difficult to access.
I think the smart people here at Magnet, our developers, have done a great job staying ahead of the curve, especially when it comes to after first unlock (AFU) devices. How do we gain access? How do we preserve that critical evidence?
And how do we get it through the process as fast as possible? I mentioned GrayKey and GrayKey Fastrak at the beginning, and I think there’s a little bit of confusion here, so hopefully I can clear that up. Fastrak is an add-on to your GrayKey, especially useful if you have multiple devices you’re processing at the same time.
Traditional GrayKey is able to get through, provide those encrypted files and give you access, and we’ve been able to provide that access very rapidly. But Fastrak further accelerates the process by allowing simultaneous extractions from multiple devices, addressing the challenges of growing data volumes and slow extraction speeds.
If anyone has heard from Chad Gish, who’s also on my team, he has some great case-based examples in separate webinars and documents he’s put out. They show how transformative it is to be able to hook up individual devices one at a time, get that initial access, then go over to the exam station and start the download.
You have the same extraction and the same basic access, but it allows you to push the data through, reduce that investigative bottleneck, reduce your backlog, and ensure timely access to crucial evidence.
As we’ve discussed, encryption has made data access more difficult. GrayKey is one of the industry leaders when it comes to gaining access and providing fast, secure evidence. In terms of access in particular, I do feel we’ve been the industry leader in releasing same-day or very rapid support updates that give us access to these phones as they become available.
Then there are the additions like Fastrak, which can give you improved extraction times. Now that we’ve extracted our data, we’ve got evidence overload. Phones are getting tremendously larger.
I had many stops at the FBI before I retired, and one of them was the North Texas RCFL (Regional Computer Forensics Laboratory). I never had to handle a 1 TB phone, but the amount of data a device like that holds, and the difficulty of downloading and parsing it all, means evidence is overloading us.
We’re getting to a point where each case doesn’t just involve one device; it could involve multiple devices. We’ll talk about cloud evidence a bit later, but sometimes you’ll have a tablet, a phone, or even a cloud extraction, and we’re trying to process all of that evidence at the same time. That’s where we think of AXIOM as our flagship parsing software.
It allows you to take data from multiple sources and bring it together in one case. I was always a big proponent of timelining evidence. You have an incident, and you want to be able to timeline what happened before, what happened after, and what happened around it, or perhaps across multiple incidents.
Having confidence in the parsing and analysis of the data can definitely help you handle multiple devices and large volumes of data. So how do we prioritize, and how do we help our agencies focus? This next slide shows the timeline, and the timeline isn’t just for one piece of evidence.
You can timeline multiple pieces of evidence. Maybe you have a cloud extraction, a phone, a tablet and even an automotive extraction. I can show them all on this AXIOM screen and do my deep-dive forensic analysis. It gives you comprehensive artifact access and allows you to evaluate and process vast amounts of data to prevent those bottlenecks.
I can conduct my searches, my text searches and my connections analysis all on one screen and see all of my data at once, which streamlines your investigative workflow. But it goes further than that: if you’re only analyzing your phone data, you’re not getting all of the case data.
The ability to pull in cloud data, a warrant return or whatever else you need to analyze, preserve that data, and then put it in a format you can provide to, in this case, an ADA (assistant district attorney) is critical. Being able to provide it to your prosecutors is critical to the entire process.
But how does this fit into the ecosystem? We’ve talked about extracting our data and processing it. Now let’s take a look at how Automate and Review handle the back end. We’ve extracted our data, and we could have terabytes of it. How do we get that out to our examiners?
First of all, it starts with investigative backlogs. In many labs, phones, tablets and computers are all backing up. That’s where Magnet Automate comes in. From my own experience, if you had a hot rush case, you’d come into the lab at 7 p.m. to click a button, and then again at midnight to click a button.
Or at 5 a.m., simply to keep things moving. Is that really the work of a digital examiner? Our goal is to eliminate the tasks that fall outside the realm of digital forensics and let the human do the actual analysis work that we need.
You spend hundreds of hours gaining your certifications, but then so much of your time is spent pushing buttons. Let’s take those steps out and automate the process. In a slide or two, we’ll look at how Automate can take the initial evidence I’ve fed in and push it all the way through to review.
That’s especially important in cases where the examiner isn’t the reviewer, and an investigator has to do the first review before it comes back to the digital examiner. It’s critical to get the evidence to them as quickly as possible. To go back to Chad, he has an example where they were able to push evidence out through Review.
They were able to review the evidence so quickly that they discovered a critical item had been dropped in a dumpster. Had they not recovered that item from the dumpster before it was emptied, they would never have been able to see how it tied all of these individuals together in the crime.
The ability to collaborate in real time with both technical and non-technical stakeholders through Review and Automate definitely provides great collaboration. Here’s another great quote, from Nashville. It certainly does free up an examiner.
I think a lot of people are concerned about what this means for the job. But in my conversations with people in the field, there’s a need to refocus on actually identifying how a particular artifact got onto a device. If you’re spending your time pushing buttons to extract evidence, it’s difficult to come back and focus on that.
This platform allows us to automate that process and remove many of the tasks that create backlogs and cause so many of our issues. So let’s look a little more closely at Automate itself. Here I have a workflow that shows how the evidence flows through.
We start with an image, and it can even use other software that we have an API integration with to process that evidence and automate the process. That gives you additional analysis in case you need to do tool validation and verification of the results you’re seeing in AXIOM.
The more you feed into Automate, the more it pushes cases all the way through. And especially if you’re using the Review platform, you can get things to the reviewer much, much faster. That provides efficiency gains, reduces backlogs, and gives the examiner and the reviewer a way to communicate by giving them a platform they can both review from.
Another tool that can help here is Mobile Case Streams, which is a new feature. We all remember the days of producing USBs and then physically waiting for the investigator to receive them or come in and collect them from you.
With Mobile Case Streams, you do your extraction on GrayKey, and let me show you the graphic here, which may help. Through my setup with Magnet One and Mobile Case Streams, GrayKey automatically starts sending artifacts up to Magnet One as they’re being extracted. Then, as they’re parsed, they’re pushed directly into Review.
So it doesn’t wait for parsing to finish before pushing the evidence over to Review. As soon as an artifact is parsed and ready for review, it’s made available instantly. Within just a couple of minutes, you’re able to provide reviewable data to an examiner or a non-technical stakeholder.
They can review it immediately. I remember cases I worked that involved a command post, where you had a whole room full of people waiting for the digital forensic evidence, waiting for me to push that button so they could review it.
Being able to provide that evidence immediately would have been an amazing workflow improvement. Back then, I had to wait until the entire phone had been downloaded, then wait for it to be fully processed, then produce multiple copies of physical media.
Then I’d run them down to the command post so the evidence could be reviewed. With this, I could have had it immediately, and anyone with a web browser could have started reviewing it straight away. And that’s not just stakeholders in your office or region.
Anywhere you can provide access, anywhere in the world, you can give people access to the secure platform. They’re reviewing the evidence as it’s being parsed, within minutes, as opposed to the old system, which took hours or even until the next day.
Magnet One allows your examiners and investigators to monitor the progress of the Mobile Case Stream and easily share the case with other team members. It frees up that bottleneck and reduces manual tasks. Here are a couple of quotes from early adopters in our early access program.
Again, this is very new, but in cases where multiple stakeholders need evidence immediately, you can see the benefit of pushing it all the way through the process as quickly as possible. So on the Review end, we’ve now pushed our evidence through Mobile Case Streams out to Review.
So what is Review? It’s our secure, cloud-based platform where your evidence can be reviewed by an examiner, your investigator, whoever it may be, even your legal staff. It’s real-time information sharing. As people go in and add tags or comments, that information is instantly shared with everyone else.
The platform allows you to provide access to a great number of people, as this slide shows. In collaborative cases, whether it’s your office, your region or whoever it may be, you can provide instantaneous access to whatever has gone through that process.
Whether it’s an extraction from GrayKey processed by Automate, a cloud download or a warrant return, all of it can be pushed up into the Review platform. This graphic shows that you have access to the data wherever you need it.
Whether it comes from your computer, your platform, your [unclear – “Outlook return” in original; warrant return?] or wherever your data comes from, you can now feed it all into this main source and review it all under the Magnet One umbrella that sits over the top of everything.
So how does this help your investigators? Let’s look at some of the people involved. In Review and Magnet One, you have case management features: you can see who has accessed a case, whether processing has been completed, and how you can collaborate on the evidence, all within the process.
One of the overall benefits is that it eliminates button-pushing for investigators. Now they can securely collaborate with their digital forensic examiner. In the days of physical media, you’d generate your tags and hand the media back to your digital examiner, and everything depended on that media actually being returned, which, speaking from experience, didn’t always happen.
With a platform like this, the examiner can see which items the investigator has tagged. As an investigator, I can look in Magnet One and check the status of the device I’ve submitted. And as soon as it’s done processing and parsing, I can go in and review the data myself.
The same is true for other people, like prosecutors. They can see what’s been tagged in real time, be given access to the review case file, and see everything in one platform. And for management, it reduces backlogs.
It can help speed up cases and surface evidence that, as in the example I mentioned earlier, you might not have found if all of your evidence hadn’t been in one place and provided in a timely manner. And with backlogs, by the time six months or a year has passed, however long your backlog is, some of these digital pieces of evidence lose their value as they sit there and go cold.
So immediacy can be very critical. What else can it do? There are the benefits of cloud storage: putting your evidence in the cloud, safely and securely sharing and providing access, and integrating with all of these tools, from access to review to storage.
The days of USBs and sneakernet may be over, along with the cost of all that media you had to hand out that never made its way back to the lab. Now you get cost-effective data storage with no surprises and regular billing, which enables you to accurately predict and budget for storage without hidden costs from case spikes or from maintaining your own hardware.
We’ve talked about how all of these products fit together. GrayKey and AXIOM already provide leading mobile investigative solutions, with leading iOS and Android support. With Fastrak, you can access and download not just one device, but multiple devices at the same time.
Automate interconnects these, allowing you to take your data and push it into any of the other tools: process it in AXIOM, push it into Griffeye or into Review, whatever it may be. All of these tools synchronize your case data across the entire platform, providing case progress and real-time collaboration.
That helps deal with the challenges we’ve covered, but media-heavy cases can present very difficult, unique challenges of their own. In CSAM investigations, for example, there’s a heavy volume of media, and identifying and reviewing these difficult-to-view items can be hard and cause burnout.
So tools designed with investigator wellness in mind are critical to success. We also have media tools like Verify and Witness that can help analyze your CCTV footage or authenticate media.
Let’s spend a little time on investigator wellness, because I think it’s something we don’t talk about enough. I’ve seen many studies recently on secondary traumatic stress and vicarious trauma, whatever term you prefer. There are features within Griffeye that I’ll leave for another presentation, but here’s one example: if a difficult-to-view item appears 20 times in your evidence, digital stacking means I can tag it once rather than reviewing and tagging it 20 times.
Or by using known hash sets, I can identify known CSAM that has already been identified by other agencies, so I don’t have to review it again. That can certainly help mental health. Then there’s the take-a-break timer in Griffeye.
It runs in the background, and if you’ve been reviewing CSAM or other difficult images for too long, it tells you, “Look, you probably need a break. Get up from your keyboard, walk away and come back.” I think these are critical features for media review. Another issue is media evidence that needs to be validated.
I was talking to one customer who needed to validate a video downloaded from a body cam. In that case, there had been an accusation of some kind of alteration. They were able to use Verify, one of our new media authentication tools.
Being able to show that the last thing to touch the file was the Axon downloader was critical to their case, and Verify does exactly that. Digital media plays a critical role in modern investigations; it’s a huge part of them. And in this growing context, verifying the authenticity of media has become increasingly difficult, and a lot of the tools and analysis involved are very challenging to understand.
Verify uses a patented analysis of how the file structure has been put together. Has it been altered? Is there a history of changes? Even altering the package or container the file came in can matter. You can’t simply rely on the metadata.
Metadata can be altered. So Verify takes a different approach, looking at exactly how the data was structured and put together. Was it tampered with? Was it altered? Is it missing critical metadata? If you’re relying on other methods to establish the authenticity of your media, you may be missing things.
Verify fits into the toolkit we discussed at the very beginning. We can use Automate to push data into Verify, but we can also use it as a standalone tool within our toolkit. Either way, it can be very helpful in authenticating media and establishing source provenance.
A lot of the time you can identify the specific device. I’ve seen this in our test data, where it showed a file came from a particular iPhone or Android device, and perhaps that device was seized as one of your evidentiary items. It can even potentially identify the software that was used to encode the file.
Tracking that generational history, identifying the camera model, the device type and the encoding software can help establish legitimacy for your legal proceedings. This has been used and proven in court, and we have a lot of great presentations on Verify.
If you’re interested in learning more, our AI Unpacked series takes a deep dive into deepfakes and media validation. It’s certainly worth a look if you’re interested. Thank you for attending. Hopefully this gives you an idea of how, while we need to be careful to keep our toolkit approach, the ability to bring our data onto a platform and push it all the way to the reviewer cuts down time, reduces backlogs and gets you to your evidence faster.
It also provides other benefits along the way, such as being able to establish the provenance of your video files. You can push data to other tools to help with tool validation and verification. But we can’t forget to close the loop.
Being able to provide all of this back to your examiner within the same platform, so they can prove the details needed for your case, is essential, and it’s a capability across all of these tools. If you have any questions, please reach out to us. Here’s a final look at the Magnet Forensics platform. Thank you, everyone.
