Magnet Cloud Forensics

AX320 is an intermediate-level, four-day training course, designed for participants who
are somewhat familiar with the principles of digital forensics and who are seeking to
expand their knowledge base into cloud-based and social media forensics. This course
will leverage Magnet AXIOM as well as open-source tools and techniques to improve
cloud-based acquisitions and investigations.

Magnet AXIOM Cloud Investigations (AX320) will give participants the knowledge and skills needed to
track, investigate, and acquire data from cloud-based solutions. As use of such technologies continue to
intreat into our daily lives, so do they of the modern end-user. Almost everyone in the world is connected
to either a social media or cloud-sharing platform. Investigations are being forced to deal with these
new technologies.

Students who attend the AX320 course will gain experience into multiple platforms that include cloudbased
data and social networks including Google, Microsoft, Apple, Facebook, Twitter, Instagram,
Dropbox, Box, and generic email services. Students will learn how to investigate the traces of these
programs/services, how they are used, and how they can store information. In addition, students will
learn multiple techniques in order to acquire data from these services including self sign-in, download
your data, warrant returns, and API extractions with Magnet AXIOM.

Open-source intelligence gathering techniques will also be covered to show students how to collect
information that is publicly available across multiple platforms. Students will also create accounts on
multiple services so they can ascertain what information can be gathered and stored in these platforms.
Multiple case studies and examples across the different platforms will be completed throughout the
course so that students get examples of multiple types of investigations.

Course Covers:

Students will learn how to track investigation points left behind on devices including web history, email, installed
applications, and sign-ins.

A workflow of using OSINT or Open-source intelligence gathering will be covered as well as proper techniques
and popular services to gather this information.

This module will cover iCloud Drive, iCloud Photos, iCloud Backups, and Apple’s “Download Your Data” information.

We will discuss several of the platforms available from this service including Gmail, Google Drive, and popular
data return services known as Google Takeout.

Learn how to investigate Microsoft accounts found on PCs and how to take that information to what is available
on Microsoft’s own servers.

Learn how to collect information from Twitter directly—including IP addresses where users have accessed
the platform, publicly available “tweets” and connected individuals, as well as retrieving private messages
using Magnet AXIOM Cloud.
This module will cover ways to find activities of Facebook usage on devices, what information can be gathered
from Facebook directly, and what information can be gathered from available web scraping through Magnet
AXIOM to download Facebook data—including wall posts, friends, and messages through Facebook Messenger.

This module will cover how to collect information that is both public and privately available from Instagram
as well as downloaded photos using both the Magnet AXIOM Cloud APIs and publicly available web scrapers.

We will discuss what information can be gathered from Dropbox directly, by requesting information from the
providers, and what information can be collected by directly downloading it using Magnet AXIOM.

Box, another popular cloud-storage platform, will be investigated. Examiners will walk investigators through
creating their own cloud accounts for this service, what is available, and how that data can be acquired using
tools like Magnet AXIOM.

What if the subject or target is running their own email server? Or, instead, is using a lesser known service that
isn’t covered by the ones mentioned above? In these cases, Magnet AXIOM can directly acquire data from generic
POP3 or SMTP services that will be covered in this module as well as how that information can be used in the
furtherance of other investigations.

Using the techniques and information gathered throughout the week, students will finish the investigation that has
been worked throughout each separate module. The final exercise will feature a scenario on how to investigate
cloud-based data utilizing only the information collected from the Cloud.


WHEN: 4/27-4/30/2021

COST: $1,495 US Dollars

Cancellation of this class may occur if there are insufficient students registered. In the event of a cancellation, personnel will typically be notified by email within 48 hours of the registration closure date. IACIS is not responsible for any individual expenses incurred as a result of a cancellation. The limit of IACIS financial liability is a full refund of the course fee.

Existing IACIS members simply log in with your credentials and go to the Products page to purchase and register for the course.

For non-IACIS members, the membership fee is waived with the purchase of the training course; however, to register for the course you must complete a membership application at the time of purchase. Purchase training course HERE.

****Payment MUST BE RECEIVED at least 45 days prior to the first day of class. Any payment arrangements other than payment through the website or payment via invoice must be approved by the IACIS Treasurer prior to admittance into the course. Please contact the treasurer for questions and approval (

Cancellations within 45 days from the start of class to 31 days from the start of class will be subject to a $150 cancellation fee. There will be no refunds within 30 days from the start of class.****

* On-Site Check-in Times (student pickup of equipment, ID card, IACIS info) are:

             Tuesday, April 27, 2021: 0700 – 0800

* Please make arrangements to arrive in time to check-in so that you may be in class promptly the first day.


Please read the following notes regarding this class:

  1. Classes begin at 8:00 AM ET and conclude at 5:00 PM ET, each day, with a one hour lunch break. Classes will end at 4:00 PM ET on the last day of class. Please do not arrange for departing flights prior to 7:00 PM ET to allow time for travel to the airport and any security clearances.
  2. The dress code for the conference is business casual (collared shirts and slacks).The wearing of shorts, flip flops, tank tops, etc. is not allowed in the classroom. Personal computers are not permitted in the classroom. Students are required to attend all classes to successfully complete the program. Students who fail to meet the attendance requirements will not be issued a certificate at the conclusion of the program.


The 2021 course will be taught at the Caribe Royale Hotel, 8101 World Center Drive, Orlando, Florida 32821 (USA).  This hotel is close to the Orlando International Airport, has a large pool, spacious workout facility and is very close to Disney World and Universal Studios.

BOOK HERE or via phone by calling the following numbers:

Reservations Toll Free: 1-800-823-8300 or our local number 407-238-8000.

Availability to book your stay is from 4/17/20 until 4/16/2021.

Dates of stay the rates are good for are: 4/16/2021 until 5/12/2021.


If IACIS is unable to hold their 2021 Orlando training event, then all students who have registered and paid, will have the option of a full refund or a reserved seat at the 2022 training event.  IACIS is not responsible for any outside expenses (e.g. travel and accommodation) in the event of the training event being cancelled. Anyone who paid for training will receive complimentary membership through the year that his/her training takes place.