VK200 Verakey Examinations

Course Modules

Module 1: Course introduction

• Meet the instructor and other students while seeing what’s expected for the week.
• Install Magnet Axiom Cyber and other open-source tools and files that are needed for the course completion.
• A discussion of mobile evidence handling considerations within investigations, including the current state of mobile forensics and how that impacts enterprise devices.

 Module 2: Ios device security within enterprise environments

• Understand the encryption methodologies used by Apple within their mobile operating systems and how they impact the collection of data from devices.
• Gain insight into Apple’s File Data Protection system, including hardware such as the Secure Enclave.
• Learn how iOS/iPadOS devices with an MDM (Mobile Device Management) profile can be configured and how this forensically impacts the data available from managed devices.

 Module 3: Android device security within enterprise environments

• Gain an understanding of the encryption methodologies used by Android devices and how this impacts the collection of data from devices.
• Understand the fragmentation of Android devices and the implementation of an open-source operating system amongst a wide variety of different hardware.
• Learn how Android devices with an MDM (Mobile Device Management) profile can be configured and how this forensically impacts the data available from managed devices.

 Module 4: Verakey introduction and settings

• Learn how to set up and configure the Verakey.
• Understand the settings of the Verakey and how they can be configured for different types of investigations.
• Gain an understanding of how the Verakey software and hardware is managed. 

Module 5: Verakey acquisitions, outputs, & stored results

• Understand the different types of consent-based extractions available with Verakey.
• Gain an understanding of the different workflow options with Verakey.
• Learn and understand about Verakey support and how to interpret the support matrices.
• Learn how to access and extract data from iOS and Android devices, including those enrolled with an MDM (Mobile Device Management) profile.
• Understand the results that Verakey outputs, including progress reports and stored results.

 Module 6: Processing Verakey outputs with Magnet Axiom Cyber

• Understand best practices for transporting data from the Verakey
• Learn how to correctly process data extracted by Verakey in Axiom Cyber.
• Students will learn how to connect a Verakey unit into the Magnet Forensics suite of products.
• Students will gain an understanding of the different settings with Axiom Cyber Process and how they impact the processing of data.
• Learn how to process file types that are not natively supported by Axiom Cyber.

 Module 7: Axiom Cyber—operating system analysis

• Understand core operating system artifacts from both iOS and Android devices. 
• Learn how to make use of tools such as the Mobile View and Timeline explorer within Axiom Cyber.
• Students will learn how specific artifacts relating to iOS and Android devices can be applied to investigations such as theft, data exfiltration, and extortion.

 Module 8: Axiom Cyber—pattern of life and log analysis

• Understand the different types of logs that are available from iOS devices, such as Unified Logs and File System Events. 
• Understand the different types of logs that are available from Android devices. 
• Learn about pattern of life analysis when examining mobile devices and how they can be interpreted and interrogated by Axiom Cyber.
• Students will gain an understanding of how different tools within Axiom Cyber including Route View and Connections, can be used to investigate a wide range of case types including compromised devices and asset misuse.

 Module 9: Axiom Cyber—communications & email analysis

• This module will focus on communications and email data available from iOS and Android devices.
• Students will gain an understanding of tools such as Conversation View and the Email Explorer within Axiom Cyber.
• Understand the different types of web analysis artifacts available within Axiom Cyber, and how they can be applied to a range of investigation types including phishing and insider trading.

Module 10: Axiom Cyber—reporting

• This module will focus on best practices to enable users to report on findings within Axiom Cyber.
• Students will gain an understanding of the different types of exports available within Axiom Cyber, including Portable Case management.
• Learn how to enable better reporting from Axiom Cyber using Magnet Exhibit Builder.