In this post we explore several views of the data that Magnet AXIOM offers examiners and investigators, and provide tips and tricks on how to get the most out of AXIOM’s Centralized Views.
Depending on the type of data you’re looking at, the presentation can really help with your analysis. Some views work really well with large datasets, while others work well with smaller datasets. Some work well when all the data being compared is the same, while others can assist with different types of artifacts being shown. The best views for examiners to use vary from case to case and the type of data being analyzed.This is why we’ve added a number of different views to Magnet AXIOM. Some will be familiar to Magnet IEF users while others will be completely new. The best way to maximize views for your analysis, is to understand how each view works best.
As we go over the different views available in AXIOM, you’ll see that some are better suited for multi-artifact view, where others are more suitable for focusing on a single artifact.
Multi-Artifact vs. Single Artifact
One of the new features we added in AXIOM is the ability to view and compare different artifacts in the same pane (or all the artifacts in a case for that matter). This can be useful when you want to compare data from different artifacts that may have some common data between them, but not everything is identical. For example, if you want to view the web history between Chrome, Firefox, and IE, previously you would have had to look at each of them individually, but now you can view them all together at the same time.
In AXIOM, we don’t list every column for all the artifacts you have selected in multi-artifact view (this would potentially give you hundreds of columns and is certainly not manageable), but we do present some common columns that might be important for the given artifact (including a timestamp, if one is available).
To read more about other views: Column View, Classic View, Chat Threading View, Row View, Histogram View, Thumbnail View, World Map View, and Timeline View, click here.
