The different views-- and this is so important.
If you're taking notes right now,
make sure you just write down "Make
sure I do not get stuck in Conversation View or World Map
View," and this will make sense as I start showing you.
The views-- if you say Conversation View,
the results are only going to show you
anything that is considered a conversation that
can essentially be shown in these bubbles.
If it does not fit that requirement,
it will be excluded from your results.
So think about this-- if you're in Conversation View
and you keyword search for a keyword of interest,
it is only providing hits that fit
what is considered a chat or something that falls
into a conversation category.
All right, let's take a look at a few things here.
At the bottom, down here where my magnifier is coming,
it says it's processed 59.9%, Load New Results.
You can keep clicking Load New Results
and that data will change.
See how drastic that difference became?
Do not perform any keyword searches
or anything that's really in-depth until processing
is complete.
But I want to show you a few of the different views here.
So we can switch to Timeline view here.
We could switch to File system.
We'll talk more about connections
as the class goes on.
So I'm going to switch to File system,
and what we can see here is we actually
have AXIOM Lab 1.2 decrypted.
I recommend you function in decrypted
because that's the data that the tool understands.
And we can see we have all these databases,
all of these apps of interest.
So this is essentially your File system view.
If you want to go back, you could either
hit the Home button or you can hit Artifacts.
The other view I just mentioned is right here.
Conversation view and World map view seem to cause people
the most issues when they get stuck.
So we switch to conversation view.
And again, I can do Load New Results,
and it will add more information as it can.
Conversation view-- and it's taking a second to render this
because it's still processing.
OK, so I want to show you this is still running.
Look at this bottom part right here.
If your numbers don't match mine-- so if I go back,
if I switch Conversation view just to regular Column view--
if your numbers over here do not match mine,
it's because you see this message on here,
"Process requires your attention."
You have to actually go back in the process,
and it's saying, hey, I recovered
all of these custom artifacts.
What do you want to do?
And you can enable these.
When you enable these, it means it's going to go
and it is going to parse those going forward.
That is what will change your numbers inside of your VM.
So then you can say Close Without Saving.
And close without saving means, please don't remember these.
Just show me those results.
And then we click Close, Load New Evidence.
And what you should find is that you see Custom at the bottom.
You won't see Custom if process requires your attention.
So let's go back now into Conversation view.
And now that's done processing, it's happier with us.
So here we can see Conversation view.
Where people get stuck most often when we filter in AXIOM,
it will change this toolbar a different color up here.
But we're only in Conversation view.
So let me show you an example.
If I search for "hank" and press Enter,
you're going to see that it turns yellow.
So now we know, hey, there is a filter.
That's a good clue that a filter is there.
If you clear filters, it's not going
to clear conversation view.
So if you wanted to keyword search
for "hank" against everything, you
would have to go back to your original view
and then search for "hank," and you
will see that we had 13 hits versus 1 hit.
So just make sure you always look for the yellow banner
and that you always, always know which view you are in.