Exporting specialized outputs

Export evidence that is in a different language

If you want to share evidence that’s in a different language, export it to an Excel, HTML, or PDF file. Excel spreadsheets, HTML files, and PDF files support multi-line UTF-8 encoded text (for example, chat messages in different languages), so you won’t see display errors that are common in other types of exports (like .csv files).

1. In AXIOM Examine, select and right-click an artifact group or items that you want to export.
2. Click Create export / report.
3. Under Export / report format, click Excel, HTML, or PDF.
4. Follow the instructions to customize and create your export.

Export a chat thread

When you save a chat thread to your case, the file is named with the name of the chat application and the date and time stamp of the last message in the thread. For example, "Skype Chat Messages - 7_05_2016 3_09_04 PM."

1. In AXIOM Examine, in the Conversation view, right click the chat thread that you want to export.
2. Click Create report / export.
3. In the Export type drop-down list, select HTML or PDF.
4. Next to the File path field, click Browse and select where you want to save the export. Click Select folder.
5. In Items to include, select the chat threads that you want to export.
6. In Level of detail, complete one of the following options:
   • To save the information to one report, select High-level information
   • To create individual reports for each artifact type (for example, one report for Skype Chat Messages and another for GoogleTalk messages), select Detailed information .
7. Click Create.

Export metadata

In the File system explorer, you can export the metadata associated with files or folders to a .csv file. By default, AXIOM Examine saves exported metadata to your case folder.

1. In AXIOM Examine, in the File system view, browse to the file or folder of interest.
2. In Evidence, right-click the item you want to export metadata for. To select multiple items, press CTRL and click the items. Then, right-click one of the highlighted items.
3. Click Export details.
4. Click Browse to location and select the location where you want to save the export. Enter a file name.
5. Click Save file.

Export timeline data

If you want to share evidence from the timeline, export it to a .csv file.

1. In AXIOM Examine, in the Timeline explorer, select and right-click items that you want to export.
2. Click Create report / export.
3. In the Export type drop-down list, click CSV.
4. Next to the File path field, click Browse and select the location you want to save the export. Click Select folder.
5. Click Create.

Export memory artifacts

You can use AXIOM Examine to export memory artifacts from your case to import into other tools. You can choose to export files based on their type:

• Process executable files (procdump)
• Dynamic link library files loaded by the process (dlldump)
• Memory associated with a particular process (memdump)
• Open files in memory (dumpfiles)
• Range of pages described by a VAD node (vaddump)

To export memory artifacts, complete the following steps:

1. In AXIOM Examine, right-click the memory artifact you want to export, and then click Export memory items.
2. In the Export memory items dialog, complete the following actions:
   1. In Export details, provide the Folder name and File path that you want to use.
   2. In Items to include, select the memory items that you want to export.
3. Click Export.

Print or export a connections map as a PDF

If you want to include a map of connections in your report, you can print it to paper or PDF. When you print a map, the primary node and focus nodes get included.

1. In AXIOM Examine, in the Connections explorer, right-click a node.
2. Click Print.
3. Follow the instructions on screen to print the map.