REVIEW: Magnet Forensics - AX301: Magnet AXIOM + GrayKey Examinations


"You don't know what you don't know." - Chris Vance

Hey. Guy. Hey. Guess what!? I just got back from Magnet Forensics AX301: Magnet + GrayKey and I just couldn't wait to write up this blog.  Literally... my wife is glaring at me as we speak, but I want to get my thoughts uploaded to the internet of things before I forget what I wanted to say about this course.  Seriously guys, I feel like I have transcended to another plane of existence.  Thankfully I had a 2 1/2 hour drive for my brain to reboot and parse out all of the information that I learned over the last 4 days.

First of all we all learned about that super secret box that everybody knows exists, but nobody ever really talks about.  I'll give you a hint, it rhymes with "Hey Free!" but it's far from free so don't get your hopes up.  This little box we'll call GK (if you don't know what I'm talking about yet, you obviously didn't read the title), and this little box should have been called Pandora's Box because it opens up all sorts of good things, and a lot of stuff you wish didn't exist (because it's a vast amount of information to comb through).

Our adventurer first travels to the great kingdom of Frankfort, KY where he meets up with mighty warriors from the Kentucky State Police.  What an awesome group of guys.  They were very inviting, and great hosts.  I made sure to get their contact information because I'm a firm believer in networking.  If I ever need to know something, it's nice knowing that I have allies in the field to bounce questions off of.


Our instructor Chris Vance is smarter than your average bear.  I mean this guy writes a LOT of the curriculum for Magnet Forensics.  He TRIES not to talk over students' heads, but you can definitely tell this guy is a Subject Matter Expert on the material.  If you ever have a class with Chris, consider yourself in the presence of the right hand of God.

Day 1 is a down and dirty introduction to GK.  Chris explains how the box should work, and we experience (on occasion) how the box is NOT supposed to work.  Let me tell you, I love real world situations in training.  If everything was 100% smooth sailing we wouldn't learn anything,  You learn what all of the doo-hickeys do.  I'm trying to be selective about information I pass along people, just accept the terminology.  You learn how GK "works" or more accurately, how GK's makers tell us it works.  There is a lot of hands on training, which I love.  Most importantly, you learn about how Apple sets their security.

Day 2 is more training on GK, but you learn how the help boost the possibility of getting into Apple's super secure mobile device (I tried typing that with a straight face).  You learn about the different states of an iPhone/iPad and what that means to you as the examiner.  You learn what state's provided what information, and let me tell you, I'm readjusting my iPhone settings after publishing this entry.

Day 3 come with an empty stomach, because you're about to blast off on an adventure about as fun as drinking water from a fire hydrant.  We start talking about EXAMINING the information from GK.  To do this we use Magnet's AXIOM Forensic Tool.  (NOTE: Magnet AXIOM is the only tool that can import a GK extraction directly from GK which means ZERO (0) data loss.)  The amount of information that GK and AXIOM can get when used in conjunction with one another is mind blowing.

Day 4 is when you're brain melts, and you want to cry for your mommy.  As if Day 3 didn't throw enough at you, Day 4 will make it feel as if you brain is playing 52 card pickup with itself.  There is so MUCH involved in the last day that I honestly wish I could rewind like in that Adam Sandler movie about Christopher Walken's sex dungeon in the back of Bed, Bath, and Beyond.  The big takeaway I got from this course is that Apple keeps a plethora of information about our day to day lives.  It's seriously super scary, but not as scary as Android, or as I like to call it, Terrance and Phillip's green cousin.

Honestly, I think Days 3 and 4 could be restructured as a week long course by themselves, especially with Chris Vance in the driver's seat.  I'm not saying this as a bad thing.  I honestly think that Chris is at a disadvantage because you can tell that he really knows his stuff and has to give students the crash course.  So if you're reading this Magnet... expand on these two days!

Overall I would have to rate this course as the pinnacle of my training thus far.  Honestly, given the chance, I would take this course again just because there is so much information and picking Chris' brain helped to connect the dots.  Having a manual is great, and having a PDF copy of the manual is better, but Chris Vance is the walking manual you wish worked in your lab.  Period.  End of story.  10/10 would recommend.

CPE: 32 Hours
Total Cost: $3,199.00 excl. Tax or FREE with Magnet TAP (Training Access Pass)