When we load data into AXIOM--
and I'm going to walk you through that here in a moment--
you're going to see the AXIOM Examine pops up.
When AXIOM Examine pops up, we have this first view over here
where it's called the Artifacts view.
If anyone has ever used Magnet IEF,
this is very similar to that Internet Evidence Finder.
When we switch to the File system view,
this is what you were seeing in the left-hand pane of Physical
Analyzer.
So here we can see that we actually
have a folder structure.
We can access files.
If you ever get lost, click the Home button.
That is something that has been consistent
so far in these tools.
If you get lost, you're not sure where you are,
click the Home button and it will take you back.
When we look across the top toolbar,
just as in the other tools, this is
where you're going to make decisions, filter, timeline,
and do additional steps within AXIOM.
If you can, follow along with me at this point.
If I go too quickly, just refer to Lab 1.2
for how I loaded this data.
I'm going to click on AXIOM Process.
AXIOM should be licensed at this point.
You should have done this in Lab 0
or by watching the beginning of this on-demand course.
If you missed it, make sure you grab the AXIOM license
and you grab the entire thing.
It's a pretty sizable chunk of a license.
Paste it into trial.
So you'll see Activation Code, enter here, and press OK.
All right, when AXIOM launches, I'm
going to select Create a New case.
Now for Case number, what I recommend
is that for case number and for folder name
and location of acquired evidence
is that you name it according to the lab
that we are currently working.
So I'm going to call this Lab 1.2.
You don't know anything about this case,
so just choose Other.
For Folder name, Lab 1.2.
And I'm going to browse to G: and put it
in a directory called AXIOM that I'm going to create.
Now, this is an important point--
do not save anything you're doing to the C drive in the VM.
G: is built to expand.
If you run out of space on C:, you
will have issues in your labs.
So I created Lab1.2 in G:AXIOM.
I'm going to call Location for acquired also Lab 1.2.
Now this is an important point.
We are going to be parsing an iOS backup extraction.
It's encrypted.
When AXIOM goes and decrypts it, it
would put it in the location for acquired evidence.
If you don't know where that is or if it's separated,
it could look weird.
We click on Go To Evidence Sources
and now we're choosing Mobile, iOS.
And this is where you're going to see
do you want to load evidence, do you want to acquire evidence,
or do you want to connect to Graykey?
We want to load evidence.
And typically, it would be an image file, forensic image.
But we have a backup, so that's considered a file.
I'm going to browse out to my folder in the G, Lab1.2,
and I'm going to point it to the backup file.
Now right away, AXIOM knows.
It scans this file and detects encryption.
I'm going to teach you in Section 3 and 4
how the tools know so quickly that this is actually
encrypted.
The password is in your lab, and it's Noble with a capital N--
N, o, b, l, e.
And you select Check.
Now it's going to check the pass code.
Once it accepts it, the light blue icon that says OK
will become bright blue.
If that does not work, it's going
to say incorrect passcode, and you're
going to have to enter the correct one in order
to progress.
If it turned bright blue, you press OK.
Now you could go in and add vehicle data, cloud data,
mobile, PC, whatever you want.
But we're going to say Go To Processing Details.
I'm going to walk you through this in detail right now.
Going forward, these same steps I'm about to show you
have been done in advance for you.
So under Add keywords, I'm going to change this to All content.
And what this is going to do is create an index.
Now it won't do anything if you don't add a keyword.
Down here and in the lab, it tells
you to add the keyword "bash," so I'm just going
to type bash and click Add.
It must look like this, as you're seeing on the screen,
or it will not work.
Now we're going to go to the next one.
We are not going to choose OCR.
I'm going to skip these for now.
They're not relevant to the course.
I like to have Calculate hash values checked.
This will be extremely helpful in the malware lab
that we'll do in Section 4.
We're not going to be dealing with anything that's
child abuse or child exploitation in nature
here, so I'm just going to select Next.
For the image categorization, we can do this later,
after the fact, which is what I recommend.
So we're not going to choose those right now.
Select Next until you get to this one, Dynamic App Finder.
This is coming up in the slides.
This is the equivalent of the AppGenie and fuzzy model
plugin in Physical Analyzer.
It's extremely important, and I do recommend
that you check this box.
Now we get to what do you want to parse.
I recommend that you always take a look at this.
So I'm going to click on Customize Mobile Artifacts.
What I typically do is do Clear All and then Select All.
Now something to keep in mind--
your number could be different than mine,
based upon versioning, based upon if you pre-process
any labs or you process data and you
tell it to keep the artifacts that it carved,
that will change your numbering that you will see.
So don't stress about that if yours is not the same.
The more you use AXIOM, these numbers may modify.
I'm going to choose Go To Analyze Evidence and Analyze
Evidence.
AXIOM will start going through, and you can see its decrypting
that iOS backup file right now.
So decryption is in progress.
Once that is done, it is going to start processing the data.
As soon as AXIOM has something to show you,
you will notice how it flips from AXIOM Process to AXIOM
Examine.
OK, I'm going to let this run, and we're
going to go back to the slides.
When our image is loaded, I'm going
to walk you through the Artifacts view versus the File
system view.