Building a timeline with Magnet AXIOM
The Timeline Explorer within Magnet AXIOM gives the examiner a clear view of what's happening on a device at a certain point in time.
At the top of the view, an interactive graph visually displays time, allowing the examiner to identify spikes in device activity, focus on a specific time frame, and establish behavioral patterns. At the bottom of the screen, a table will list all the timestamped artifacts in chronological order.
The following screenshot shows what a timeline looks like:
Figure 12.10 – A timeline displayed in Magnet AXIOM
Before a timeline can be viewed, the tool will need to complete an indexing process that, in turn, generates the timeline. If default options are enabled, Magnet AXIOM will not automatically build the timeline, so the examiner will need to manually start the process by following these steps:
- From the AXIOM Examine main menu, choose Tools | Build timeline.
