Lab (Axiom): Full Case Process

In this running exercise, we will go through the steps to create and process a new case in Axiom.▶ Lab ResourcesPlease refer to the following reading material to assist you with completing the lab:Case Creation and Processing in AxiomActionsLab Instructions for Axiom: Full Case processActions▶ Lab Tasks: Follow all the steps to complete the labCreate a folder on your desktop named “Justine_Beaufort”Open AXIOM Process from the icon on the Desktop and click to Create New Case. If you are prompted to turn off antivirus, do so.Case number: 01_ JustineBeaufortCase.Case type: Major CrimesLOCATION FOR CASE FILESFolder name – Leave the default folder name.File path – This is the location where we want AXIOM to save all of our case files. Browse to the folder “Justine_Beaufort” on your desktop and click “Select Folder.”LOCATION FOR ACQUIRED EVIDENCEFolder Name – Leave this the default name.File Path – This is the location where we want AXIOM to save any image files that it creates during processing. Browse to the folder “Justine_Beaufort” on your desktop and click “Select Folder.”SCAN INFORMATIONScanned by – Enter your name.Description – Enter a description of the item. For this case, our first item of evidence is a computer hard drive. The description of the drive is, “WD hard drive of suspect, Justine Beaufort.”Press the “Go to Evidence Sources” button.SELECT EVIDENCE SOURCE: ComputerLOAD OR ACQUIRE: Load Evidence.SELECT EVIDENCE SOURCE: Image. Browse on your desktop to the folder “Lab Files” then select it. You will see all of the evidence folders for the different labs. Select the folder Lab – Full Case Process and Lab-Chat Image Files. Then select JustineBeaufort.E01(Remember if you have multiple E01’s from the same case, always point to the first one to read them all), select the image, and click Open.Make sure all the partitions are selected, then press NEXT.SELECT SEARCH TYPE: Partition 1 – Full. Unpartitioned space – Unpartitioned space. Click NEXT.EVIDENCE SOURCES ADDED TO CASE: Click on the name listed on the evidence. We want to rename it so that it is more descriptive. Rename each one, “Item 1: WD hard drive of suspect”. Once you type the new name, click SAVE to save the changes.Click GO TO PROCESSING DETAILSADD KEYWORDS TO SEARCHAdd the keyword list name owlKeywords.txt(Located in the Justine_Beaufort Folder). All of the keywords are then populated in the Keywords box.Click GO TO SEARCH ARCHIVES AND MOBILE BACKUPSEnsure that Search Archives and Search Mobile Backups are checked. When AXIOM finds any type of archive file (.zip, .tar, etc.), it will extract the data. If AXIOM finds a mobile backup, it will extract all of the data and process it using the Mobile Artifacts.Click GO TO CALCULATE HASH VALUESEnsure that the checkbox to calculate hash values is checked.IGNORE NON-RELEVANT FILES: Ensure that all three hash set lists are checked (if the non-relevant hash sets are loaded).Click GO TO CATEGORIZE CHATSNote that we can categorize for Grooming/Luring and Sex-related. For this case, we do not want to check either one.Click GO TO CATEGORIZE PICTURES AND VIDEOSNote the categories for Magnet.AI. We can also load hash sets from Project Vic or our own custom hash sets. For this case, we are not selecting any of these options.Click GO TO ADD CPS DATA TO SEARCHNote that we can add a CPS export file. We will discuss this further later in the course. For this case, we are not adding a CPS export file.Click GO TO FIND MORE ARTIFACTSEnsure that the checkbox for “Allow AXIOM to find more artifacts” is UNCHECKED. We will discuss this further later in the course.Click GO TO ARTIFACT DETAILSSince we loaded an item of computer evidence, the only option available to us is COMPUTER ARTIFACTS.Click CUSTOMIZE COMPUTER ARTIFACTS. Check all Computer Artifacts categories except for Custom Artifacts. Uncheck CUSTOM ARTIFACTS.Select the artifact category for Cloud. Select OPTIONS for Dropbox. If you have known user passwords, you can enter those here. For this case, we do not have any. Click OK to exit Dropbox Options.Click GO TO ANALYZE EVIDENCEThis provides the user with one final review of the SOURCES TO PROCESS.Click ANALYZE EVIDENCE (Process the case, the reading material says not to, but I want you to go ahead and process this case.)This will open Axiom Examine in a new window and the case will process. The processing for this case takes around 5 to 6 hours. Plan Accordingly on time.Paste a screenshot below showing the completed and processed case dashboard with the processing results updated after finishing processing the Justin_Beaufort Hard Drive Image:View RubricFull Case Process in Axiom RubricFull Case Process in Axiom RubricCriteriaRatingsPtsLab Task: Question 27view longer description100 ptsScreenshot fully processed and completeScreenshot shows case fully processed and completed as required.80 ptsScreenshot Correct but Not fully processedScreenshot of case, but not obvious that it was fully processed.60 ptsScreenshot Partially ProcessedScreenshot does not show that case was fully processed. So not sure if completed correctly.50 ptsScreenshot is incorrectEither Screenshot is incorrect, does not show case processed. Screenshot is of wrong item and is not helpful in determining if case was completely processed.0 ptsNo MarksNo answer, no screenshot given./ 100 ptsTotal Points: 0Choose a submission typeSubmission type Upload, currently selectedUploadMore submission optionsMoreSubmit file using Webcam PhotoWebcam PhotoSubmit file using Canvas FilesCanvas Filesor Drag a file here, or click to select a file to upload

"Looking for a Similar Assignment? Order now and Get 15% Discount! Use Code "FIRST15"