{"id":4059,"date":"2018-04-29T10:46:42","date_gmt":"2018-04-29T14:46:42","guid":{"rendered":"https:\/\/www.digitalforensics.com\/blog\/?p=4059"},"modified":"2025-03-03T20:43:58","modified_gmt":"2025-03-03T20:43:58","slug":"axiom-v2-memory-forensics","status":"publish","type":"post","link":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/","title":{"rendered":"AXIOM V2: MEMORY FORENSICS"},"content":{"rendered":"<p>AXIOM is our one of the best tools. A few days ago Magnet Forensics has released AXIOM V2. Now AXIOM contains many features. We were especially delighted that the functional Volatility appeared in a new version of AXIOM. Volatility is the best tool for memory forensics. The combination of AXIOM and Volatility is clearly an excellent idea.\u00a0And of course we immediately started testing this functionality.<\/p>\n<p><!--more--><br \/>\nThe first thing the user sees in the main AXIOM window is adding the MEMORY button in the EVIDENCE SOURCES window.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4046 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/001-2.png\" alt=\"\" width=\"800\" height=\"265\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/001-2.png 800w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/001-2-300x99.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/001-2-768x254.png 768w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/001-2-512x170.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/001-2-16x5.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/001-2-32x11.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/001-2-28x9.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/001-2-56x19.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/001-2-64x21.png 64w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>If you click the MEMORY button, you will see the next EVIDENCE SOURCES screen with a single LOAD MEMORY DUMP FILE button.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4047 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/002-2.png\" alt=\"\" width=\"238\" height=\"265\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/002-2.png 238w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/002-2-14x16.png 14w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/002-2-29x32.png 29w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/002-2-25x28.png 25w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/002-2-50x56.png 50w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/002-2-57x64.png 57w\" sizes=\"auto, (max-width: 238px) 100vw, 238px\" \/><\/p>\n<p>It is not clear with what purpose this additional screen is made? Is this done to add the acquire memory dump button in the future? Setup file AXIOM has a size of more than 2GB. Therefore, it&#8217;s a bad idea to use AXIOM to create a memory dump. In addition, an examiner was offered two steps back to make a choice: LOAD EVIDENCE or ACQIURE EVIDENCE.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4048 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/003-2.png\" alt=\"\" width=\"314\" height=\"254\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/003-2.png 314w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/003-2-300x243.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/003-2-16x13.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/003-2-32x26.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/003-2-28x23.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/003-2-56x45.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/003-2-64x52.png 64w\" sizes=\"auto, (max-width: 314px) 100vw, 314px\" \/><\/p>\n<p>Okay. If you click the LOAD MEMORY DUMP FILE button, you will be prompted to choose a memory dump.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4049 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/004-3.png\" alt=\"\" width=\"404\" height=\"139\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/004-3.png 404w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/004-3-300x103.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/004-3-16x6.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/004-3-32x11.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/004-3-28x10.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/004-3-56x19.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/004-3-64x22.png 64w\" sizes=\"auto, (max-width: 404px) 100vw, 404px\" \/><\/p>\n<p>This is unusual, but AXIOM does not support memory dumps, which were created with FTK Imager. FTK Imager is a well-known and popular tool. And there is a version of FTK Imager Lite, which does not require installation.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4050 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/005-2.png\" alt=\"\" width=\"499\" height=\"250\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/005-2.png 499w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/005-2-300x150.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/005-2-16x8.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/005-2-32x16.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/005-2-28x14.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/005-2-56x28.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/005-2-64x32.png 64w\" sizes=\"auto, (max-width: 499px) 100vw, 499px\" \/><\/p>\n<p>The next window prompts you to select the operating system profile. The profile can be detected automatically using AXIOM or can be selected manually from the list of available profiles.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4051 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/006-1.png\" alt=\"\" width=\"307\" height=\"403\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/006-1.png 307w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/006-1-229x300.png 229w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/006-1-12x16.png 12w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/006-1-24x32.png 24w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/006-1-21x28.png 21w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/006-1-43x56.png 43w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/006-1-49x64.png 49w\" sizes=\"auto, (max-width: 307px) 100vw, 307px\" \/><br \/>\nWe opened Windows 10 Home memory dump (created with FTK Imager Lite) in AXIOM and waited for a long time for this tool to determine the profile of the operating system automatically. But it was unsuccessful. When we were tired of waiting, we canceled this process.<\/p>\n<p>After that, we set the operating system profile manually and started the process of an analysis.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4052 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/007-1.png\" alt=\"\" width=\"800\" height=\"350\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/007-1.png 800w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/007-1-300x131.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/007-1-768x336.png 768w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/007-1-512x224.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/007-1-16x7.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/007-1-32x14.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/007-1-28x12.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/007-1-56x25.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/007-1-64x28.png 64w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/p>\n<p style=\"text-align: center\">Categories of memory artifacts<\/p>\n<p>After the analysis, you will see a new window of the AXIOM interface &#8211; Case dashboard.<\/p>\n<p>In this window, there is a section called TOP ARTIFACT CATEGORIES. It is not clear why this is done. We can predict that the top category for memory dumps will always be Web Related. The operating System will always be the top category for Windows running PCs and laptops. Web Related or Chat will always be the top category for smartphones. Besides, the size of the top category is such that all other categories in the TOP ARTIFACT CATEGORIES section will not be informative.<\/p>\n<p style=\"text-align: center\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4053 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/008-memory-dump.png\" alt=\"\" width=\"755\" height=\"285\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/008-memory-dump.png 755w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/008-memory-dump-300x113.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/008-memory-dump-512x193.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/008-memory-dump-16x6.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/008-memory-dump-32x12.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/008-memory-dump-28x11.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/008-memory-dump-56x21.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/008-memory-dump-64x24.png 64w\" sizes=\"auto, (max-width: 755px) 100vw, 755px\" \/><br \/>\nCategories of a memory dump<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4054 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/009-a-full-dump-of-an-android-smartphone.png\" alt=\"\" width=\"756\" height=\"291\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/009-a-full-dump-of-an-android-smartphone.png 756w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/009-a-full-dump-of-an-android-smartphone-300x115.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/009-a-full-dump-of-an-android-smartphone-512x197.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/009-a-full-dump-of-an-android-smartphone-16x6.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/009-a-full-dump-of-an-android-smartphone-32x12.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/009-a-full-dump-of-an-android-smartphone-28x11.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/009-a-full-dump-of-an-android-smartphone-56x22.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/009-a-full-dump-of-an-android-smartphone-64x25.png 64w\" sizes=\"auto, (max-width: 756px) 100vw, 756px\" \/><br \/>\nCategories of a full dump of an android smartphone<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4055 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/010-windows-PC.png\" alt=\"\" width=\"757\" height=\"290\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/010-windows-PC.png 757w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/010-windows-PC-300x115.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/010-windows-PC-512x196.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/010-windows-PC-16x6.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/010-windows-PC-32x12.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/010-windows-PC-28x11.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/010-windows-PC-56x21.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/010-windows-PC-64x25.png 64w\" sizes=\"auto, (max-width: 757px) 100vw, 757px\" \/><\/p>\n<p style=\"text-align: center\">Categories of a Windows PC<\/p>\n<p>&nbsp;<\/p>\n<p>If you click the inscription VIEW ALL ARTIFACT CATEGORIES, we get into the familiar interface of AXIOM Examiner.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4056 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/011-1.png\" alt=\"\" width=\"308\" height=\"240\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/011-1.png 308w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/011-1-300x234.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/011-1-16x12.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/011-1-32x25.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/011-1-28x22.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/011-1-56x44.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/011-1-64x50.png 64w\" sizes=\"auto, (max-width: 308px) 100vw, 308px\" \/><\/p>\n<p>In addition to the known artifacts in AXIOM Examiner, there is a new category MEMORY, which contains a lot of new information about the analysis of the memory dump such as Active Network Info, Connection Scan, Files, Processes, Dynamically Loaded Libraries, etc.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4057 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/012-1.png\" alt=\"\" width=\"287\" height=\"548\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/012-1.png 287w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/012-1-157x300.png 157w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/012-1-8x16.png 8w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/012-1-17x32.png 17w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/012-1-15x28.png 15w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/012-1-29x56.png 29w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/012-1-34x64.png 34w\" sizes=\"auto, (max-width: 287px) 100vw, 287px\" \/><br \/>\nThe most interesting category in this list is Malware Finder, which contains information about the files that can be pieces of malware.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4058 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/013-1.png\" alt=\"\" width=\"792\" height=\"313\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/013-1.png 792w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/013-1-300x119.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/013-1-768x304.png 768w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/013-1-512x202.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/013-1-16x6.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/013-1-32x13.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/013-1-28x11.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/013-1-56x22.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/013-1-64x25.png 64w\" sizes=\"auto, (max-width: 792px) 100vw, 792px\" \/><\/p>\n<p>Unfortunately, these files and suspicious processes cannot be extracted from the memory dump for additional analysis. We hope that this functionality will appear in the new versions of AXIOM.<\/p>\n<p><strong>Conclusion<\/strong><\/p>\n<p>As you can see, the new version of AXIOM has the functionality to explore memory dumps. Memory dumps can be created by Magnet Forensics free tool &#8211; Magnet RAM Capturer and other utilities. Now using AXIOM from a memory dump, we can extract not only familiar artifacts (such as: Web History, Chats, Emails, etc.) but also memory artifacts (such as Active Network Info, Connection Scan, Files, Processes, Dynamically Loaded Libraries, etc.).<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Happy forensicating!<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>About the authors<br \/>\n<strong><a href=\"https:\/\/www.linkedin.com\/in\/oleg-skulkin\/\">Oleg Skulkin<\/a><\/strong>, GCFA, MCFE, ACE, is a DFIR enthusional (enthusiast + professional),\u00a0<a href=\"https:\/\/www.amazon.com\/Windows-Forensics-Cookbook-Oleg-Skulkin\/dp\/1784390496\"><strong>Windows Forensics Cookbook<\/strong><\/a>\u00a0and\u00a0<a href=\"https:\/\/www.amazon.com\/Practical-Mobile-Forensics-Rohit-Tamma\/dp\/1788839196\/\"><strong>Practical Mobile Forensics<\/strong><\/a>\u00a0co-author.<\/p>\n<p><strong><a href=\"https:\/\/www.linkedin.com\/in\/igormikhaylovcf\/\">Igor Mikhaylov<\/a><\/strong>, MCFE, EnCE, ACE, OSFCE, is a digital forensic examiner with more than 20 years of experience and\u00a0<a href=\"https:\/\/www.amazon.com\/Mobile-Forensics-Cookbook-Igor-Mikhaylov\/dp\/1785282050\/\"><strong>Mobile Forensics Cookbook<\/strong><\/a>\u00a0author.<\/p>\n","protected":false},"excerpt":{"rendered":"AXIOM is our one of the best tools. A few days ago Magnet Forensics has released AXIOM V2.&hellip;","protected":false},"author":126,"featured_media":4045,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"csco_display_header_overlay":false,"csco_singular_sidebar":"","csco_page_header_type":"","footnotes":""},"categories":[6],"tags":[],"class_list":{"0":"post-4059","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-software","8":"cs-entry"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v27.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Exploring AXIOM V2 for Memory Forensics: Key Features<\/title>\n<meta name=\"description\" content=\"Discover the new features of AXIOM V2, including memory forensics capabilities with Volatility integration. Learn how it enhances digital investigations.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AXIOM V2: MEMORY FORENSICS\" \/>\n<meta property=\"og:description\" content=\"Discover the new features of AXIOM V2, including memory forensics capabilities with Volatility integration. Learn how it enhances digital investigations.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/\" \/>\n<meta property=\"og:site_name\" content=\"Resources for Sextortion and Online Blackmail Victims\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DigitalForensicsCorp\/\" \/>\n<meta property=\"article:published_time\" content=\"2018-04-29T14:46:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-03-03T20:43:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/000-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"565\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Viktor Sobiecki\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ForensicsCorp\" \/>\n<meta name=\"twitter:site\" content=\"@ForensicsCorp\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Viktor Sobiecki\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/axiom-v2-memory-forensics\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/axiom-v2-memory-forensics\\\/\"},\"author\":{\"name\":\"Viktor Sobiecki\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#\\\/schema\\\/person\\\/db7b63895c111dc8ed48df38d20b84ce\"},\"headline\":\"AXIOM V2: MEMORY FORENSICS\",\"datePublished\":\"2018-04-29T14:46:42+00:00\",\"dateModified\":\"2025-03-03T20:43:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/axiom-v2-memory-forensics\\\/\"},\"wordCount\":683,\"publisher\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/axiom-v2-memory-forensics\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/000-1.png\",\"articleSection\":[\"Cybersecurity Tips, Services, and Key Resources for Cybercrime Victims\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/axiom-v2-memory-forensics\\\/\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/axiom-v2-memory-forensics\\\/\",\"name\":\"Exploring AXIOM V2 for Memory Forensics: Key Features\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/axiom-v2-memory-forensics\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/axiom-v2-memory-forensics\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/000-1.png\",\"datePublished\":\"2018-04-29T14:46:42+00:00\",\"dateModified\":\"2025-03-03T20:43:58+00:00\",\"description\":\"Discover the new features of AXIOM V2, including memory forensics capabilities with Volatility integration. Learn how it enhances digital investigations.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/axiom-v2-memory-forensics\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/axiom-v2-memory-forensics\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/axiom-v2-memory-forensics\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/000-1.png\",\"contentUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/000-1.png\",\"width\":800,\"height\":565},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/axiom-v2-memory-forensics\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity Tips, Services, and Key Resources for Cybercrime Victims\",\"item\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"AXIOM V2: MEMORY FORENSICS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/\",\"name\":\"Resources for Sextortion and Online Blackmail Victims\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#organization\",\"name\":\"Digital Defense Hub: Resources for Sextortion and Online Blackmail Victims\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/df-logo.png\",\"contentUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/df-logo.png\",\"width\":393,\"height\":343,\"caption\":\"Digital Defense Hub: Resources for Sextortion and Online Blackmail Victims\"},\"image\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/DigitalForensicsCorp\\\/\",\"https:\\\/\\\/x.com\\\/ForensicsCorp\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#\\\/schema\\\/person\\\/db7b63895c111dc8ed48df38d20b84ce\",\"name\":\"Viktor Sobiecki\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/viktor-sobiecki_avatar-96x96.jpg\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/viktor-sobiecki_avatar-96x96.jpg\",\"contentUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/viktor-sobiecki_avatar-96x96.jpg\",\"caption\":\"Viktor Sobiecki\"},\"description\":\"Dr. Viktor Sobiecki currently serves as the Chief Technology Officer (CTO) at Digital Forensics Corporation, where responsibilities span the leadership of advanced cybersecurity initiatives, data breach incident responses, and corporate strategic planning. Professional career has been driven by the intersection of innovation and practical application, particularly in the domains of cybersecurity and cyber crime investigations. He holds a Ph.D. in Computer Science and has contributed extensively to academic and industry advancements through publications, patents, and technological solutions addressing complex real-world challenges. As a professional with over 25 years of experience in the fields of cybersecurity, artificial intelligence, and digital forensics his career spans roles in academic research, software development, corporate leadership, and expert consulting, giving me a comprehensive understanding of the technical, strategic, and practical dimensions of projects. Expertise spans a wide range of technical domains, including: \u2022 Data Breach Incident Response: Managing immediate responses to cybersecurity crises, including the containment and mitigation of threats \u2022 Corporate Strategy Development: Designing long-term strategies to enhance organizational resilience against emerging cyber threats. \u2022 Expert Testimony: Providing legal and technical expertise in high-profile cybersecurity cases. \u2022 Artificial Intelligence and Machine Learning: Designing and implementing algorithms for data analysis, pattern recognition, and anomaly detection. \u2022 Network Security and Data Integrity: Developing solutions to protect critical systems from cyber threats, including encryption protocols and intrusion detection systems. \u2022 Cloud Computing and Hybrid Infrastructures: Creating scalable, resilient architectures for data storage, processing, and security.\",\"sameAs\":[\"https:\\\/\\\/www.digitalforensics.com\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/viktor-sobiecki\\\/\"],\"honorificPrefix\":\"Dr\",\"jobTitle\":\"Chief Technology Officer (CTO)\",\"worksFor\":\"Digital Forensics Corporation\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/author\\\/visor\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Exploring AXIOM V2 for Memory Forensics: Key Features","description":"Discover the new features of AXIOM V2, including memory forensics capabilities with Volatility integration. Learn how it enhances digital investigations.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/","og_locale":"en_US","og_type":"article","og_title":"AXIOM V2: MEMORY FORENSICS","og_description":"Discover the new features of AXIOM V2, including memory forensics capabilities with Volatility integration. Learn how it enhances digital investigations.","og_url":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/","og_site_name":"Resources for Sextortion and Online Blackmail Victims","article_publisher":"https:\/\/www.facebook.com\/DigitalForensicsCorp\/","article_published_time":"2018-04-29T14:46:42+00:00","article_modified_time":"2025-03-03T20:43:58+00:00","og_image":[{"width":800,"height":565,"url":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/000-1.png","type":"image\/png"}],"author":"Viktor Sobiecki","twitter_card":"summary_large_image","twitter_creator":"@ForensicsCorp","twitter_site":"@ForensicsCorp","twitter_misc":{"Written by":"Viktor Sobiecki","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/#article","isPartOf":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/"},"author":{"name":"Viktor Sobiecki","@id":"https:\/\/www.digitalforensics.com\/blog\/#\/schema\/person\/db7b63895c111dc8ed48df38d20b84ce"},"headline":"AXIOM V2: MEMORY FORENSICS","datePublished":"2018-04-29T14:46:42+00:00","dateModified":"2025-03-03T20:43:58+00:00","mainEntityOfPage":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/"},"wordCount":683,"publisher":{"@id":"https:\/\/www.digitalforensics.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/#primaryimage"},"thumbnailUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/000-1.png","articleSection":["Cybersecurity Tips, Services, and Key Resources for Cybercrime Victims"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/","url":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/","name":"Exploring AXIOM V2 for Memory Forensics: Key Features","isPartOf":{"@id":"https:\/\/www.digitalforensics.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/#primaryimage"},"image":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/#primaryimage"},"thumbnailUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/000-1.png","datePublished":"2018-04-29T14:46:42+00:00","dateModified":"2025-03-03T20:43:58+00:00","description":"Discover the new features of AXIOM V2, including memory forensics capabilities with Volatility integration. Learn how it enhances digital investigations.","breadcrumb":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/#primaryimage","url":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/000-1.png","contentUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/000-1.png","width":800,"height":565},{"@type":"BreadcrumbList","@id":"https:\/\/www.digitalforensics.com\/blog\/software\/axiom-v2-memory-forensics\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.digitalforensics.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity Tips, Services, and Key Resources for Cybercrime Victims","item":"https:\/\/www.digitalforensics.com\/blog\/software\/"},{"@type":"ListItem","position":3,"name":"AXIOM V2: MEMORY FORENSICS"}]},{"@type":"WebSite","@id":"https:\/\/www.digitalforensics.com\/blog\/#website","url":"https:\/\/www.digitalforensics.com\/blog\/","name":"Resources for Sextortion and Online Blackmail Victims","description":"","publisher":{"@id":"https:\/\/www.digitalforensics.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.digitalforensics.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.digitalforensics.com\/blog\/#organization","name":"Digital Defense Hub: Resources for Sextortion and Online Blackmail Victims","url":"https:\/\/www.digitalforensics.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digitalforensics.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2024\/12\/df-logo.png","contentUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2024\/12\/df-logo.png","width":393,"height":343,"caption":"Digital Defense Hub: Resources for Sextortion and Online Blackmail Victims"},"image":{"@id":"https:\/\/www.digitalforensics.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DigitalForensicsCorp\/","https:\/\/x.com\/ForensicsCorp"]},{"@type":"Person","@id":"https:\/\/www.digitalforensics.com\/blog\/#\/schema\/person\/db7b63895c111dc8ed48df38d20b84ce","name":"Viktor Sobiecki","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2025\/07\/viktor-sobiecki_avatar-96x96.jpg","url":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2025\/07\/viktor-sobiecki_avatar-96x96.jpg","contentUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2025\/07\/viktor-sobiecki_avatar-96x96.jpg","caption":"Viktor Sobiecki"},"description":"Dr. Viktor Sobiecki currently serves as the Chief Technology Officer (CTO) at Digital Forensics Corporation, where responsibilities span the leadership of advanced cybersecurity initiatives, data breach incident responses, and corporate strategic planning. Professional career has been driven by the intersection of innovation and practical application, particularly in the domains of cybersecurity and cyber crime investigations. He holds a Ph.D. in Computer Science and has contributed extensively to academic and industry advancements through publications, patents, and technological solutions addressing complex real-world challenges. As a professional with over 25 years of experience in the fields of cybersecurity, artificial intelligence, and digital forensics his career spans roles in academic research, software development, corporate leadership, and expert consulting, giving me a comprehensive understanding of the technical, strategic, and practical dimensions of projects. Expertise spans a wide range of technical domains, including: \u2022 Data Breach Incident Response: Managing immediate responses to cybersecurity crises, including the containment and mitigation of threats \u2022 Corporate Strategy Development: Designing long-term strategies to enhance organizational resilience against emerging cyber threats. \u2022 Expert Testimony: Providing legal and technical expertise in high-profile cybersecurity cases. \u2022 Artificial Intelligence and Machine Learning: Designing and implementing algorithms for data analysis, pattern recognition, and anomaly detection. \u2022 Network Security and Data Integrity: Developing solutions to protect critical systems from cyber threats, including encryption protocols and intrusion detection systems. \u2022 Cloud Computing and Hybrid Infrastructures: Creating scalable, resilient architectures for data storage, processing, and security.","sameAs":["https:\/\/www.digitalforensics.com\/","https:\/\/www.linkedin.com\/in\/viktor-sobiecki\/"],"honorificPrefix":"Dr","jobTitle":"Chief Technology Officer (CTO)","worksFor":"Digital Forensics Corporation","url":"https:\/\/www.digitalforensics.com\/blog\/author\/visor\/"}]}},"_links":{"self":[{"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/posts\/4059","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/users\/126"}],"replies":[{"embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/comments?post=4059"}],"version-history":[{"count":1,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/posts\/4059\/revisions"}],"predecessor-version":[{"id":8033,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/posts\/4059\/revisions\/8033"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/media\/4045"}],"wp:attachment":[{"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/media?parent=4059"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/categories?post=4059"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/tags?post=4059"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}