Selecting artifacts to include in a search

Depending on your evidence sources and the type of license that you have, you might be able to search for computer artifacts, mobile artifacts, cloud artifacts, or a combination. If you've added custom artifacts in AXIOM Process or turned on searching for custom file type artifacts, you can also search for custom artifacts.

Note: Certain artifacts depend on Windows components to recognize artifact hits. If Windows updates are applied to your Forensic workstation you might see hit count differences when scanning previously processed evidence using the same version of Magnet AXIOM Cyber.

Select artifacts to include in your search

By default, AXIOM Process includes all available artifacts for your evidence sources in a search. You can select the specific artifacts or artifact categories that you want to include or exclude from your search.

  1. In AXIOM Process, click Artifact Details.
  2. Click Customize computer artifacts, Customize mobile artifacts, or Customize cloud artifacts.
  3. Select the specific artifacts or artifact categories that you want to include in your search.
  4. If necessary, configure the options for the artifacts that you want to include in your search.
  5. Continue setting up your case.

Search for custom artifact

You can search for custom artifacts if you've loaded custom artifacts in AXIOM Process or turned on searching for custom file type artifacts.

  1. In AXIOM Process, click Artifact details.
  2. Depending on what platform you specified for your custom artifact, click Customize computer artifacts, Customize mobile artifacts, or Customize cloud artifacts.
  3. On the Select artifacts to include in case screen, select the Custom artifacts option.
  4. Optionally, select or clear the check box for any specific custom artifacts.
  5. Continue setting up your case.

Decrypting artifacts

For some artifacts, you can provide potential passwords or decryption keys to try to decrypt the user's account or data.

If this option is available for a specific artifact, you'll find an Options link below the artifact name with the ability to provide a password or decryption key.