Magnet Forensics Courses 2026

Facilitated locally by PCSS

Build Stronger Investigative Capabilities

Magnet Training provides comprehensive knowledge of Magnet Forensics products and advanced investigative techniques, covering examinations of various data sources including smartphones, computers, video, and cloud.

All courses will be held at the PCSS Satellite Office at Southpoint, Singapore.

AX320 · Intermediate

Axiom Internet & Cloud Investigations

22–25 September 2026

Four days
DV200 · Beginner

Witness Digital Video Investigations

7–9 October 2026

Three days
GK200 · Advanced

Graykey Examinations

12–15 October 2026

Four days · Law enforcement only
AX250 · Advanced

Axiom Advanced Computer Forensics

24–27 November 2026

Four days
Intermediate 4 days

AX320 Axiom Internet & Cloud Investigations

Expand your digital-forensics workflow into cloud services, social media and internet-based evidence.

Date
22 September 2026 – 25 September 2026
Venue
PCSS Satellite Office · 200 Cantonment Road, #11-02/03/04, Southpoint, Singapore 089763
Class time
9:00am – 5:00pm

Description

This course is an intermediate-level four-day training course, designed for participants who are somewhat familiar with the principles of digital forensics and who are seeking to expand their knowledge base into cloud-based and social media forensics including Google, Microsoft, Apple, Facebook, Twitter, Instagram, Dropbox, Box, and generic email services.

Students will learn multiple techniques in order to acquire data from these services including self-sign in, download your data, warrant returns, and API extractions with Magnet Axiom. This course will leverage Magnet Axiom as well as open-source tools and techniques to improve cloud-based acquisitions and investigations.

What to expect

Get trained and learn how the Axiom Internet & Cloud Investigations (AX320) course can help you dive deeper into cloud-based and social media forensics including Google, Microsoft, Apple, Facebook, Twitter, Instagram, Dropbox, Box, and generic email services. Plus, learn more about how you can achieve Magnet Certified Cloud Examiner (MCCE) certification after completing the course.

View the 12 course modules
  1. Cloud investigations: Identify cloud leads from browsers, email, applications and account sign-ins.
  2. OSINT investigations: Build a lawful workflow for gathering publicly available intelligence.
  3. Apple: Examine iCloud Drive, Photos, backups and Apple data exports.
  4. Google: Investigate Gmail, Drive, account activity and Google Takeout returns.
  5. Microsoft: Connect evidence from Windows accounts and OneDrive to Microsoft cloud data.
  6. Twitter/X: Collect public activity, account access information and private-message evidence where authorised.
  7. Facebook: Review device traces and acquire posts, contacts and Messenger data.
  8. Instagram: Collect public and account data, including photos and direct messages.
  9. Dropbox: Compare provider returns with direct account acquisitions in Axiom.
  10. Box: Understand available Box data and supported acquisition methods.
  11. Email: Acquire evidence from generic and lesser-known email services.
  12. Cumulative review: Apply the complete workflow to a cloud-based case scenario.

AX320 enquiries and registration

For enquiries and registration, please email enquiry@pcs-security.com or call +65 6692 7000 during office hours.

Price enquiry Register by email
Beginner 3 days

DV200 Witness Digital Video Investigations

Learn to recover, review and report digital video evidence from commercial recording systems.

Date
7 October 2026 – 9 October 2026
Venue
PCSS Satellite Office · 200 Cantonment Road, #11-02/03/04, Southpoint, Singapore 089763
Class time
9:00am – 5:00pm

Description

After completing the three-day course, participants will have the knowledge and skills to analyse video from various sources using Magnet Witness, as well as gain a basic understanding of how digital video is created. Students will learn the various ways to extract video evidence from DVR hard drives and load it into Witness for review, along with how to use Witness to provide video files and reports to others for case work.

View the 11 course modules
  1. Course introduction: Review the learning objectives, case scenario and expected outcomes.
  2. Software installation: Install, license and configure Magnet Witness and supporting video players.
  3. Digital imagery fundamentals: Understand image capture, transmission, storage, resolution and infrared colour effects.
  4. Digital-video codecs: Explore compression, containers, codecs and their impact on video quality.
  5. Anatomy of a DVR: Recognise recorder types and their major components.
  6. Scene response: Prepare for a DVR scene, document the system and create a forensic drive image.
  7. Witness case creation: Create a case and add evidence from different sources.
  8. Video review: Analyse footage, tag relevant video and select material for export.
  9. Exporting and reporting: Export evidence and create reports for case stakeholders.
  10. Extracted video: Consider appropriate workflows for post-export processing.
  11. Basic enhancements: Use visual tools such as histograms to understand common adjustments.

DV200 enquiries and registration

For enquiries and registration, please email enquiry@pcs-security.com or call +65 6692 7000 during office hours.

Price enquiry Register by email
Advanced 4 days Law enforcement only

GK200 Graykey Examinations

Develop an end-to-end workflow for secured iOS, Android and supported vehicle examinations.

Date
12 October 2026 – 15 October 2026
Venue
PCSS Satellite Office · 200 Cantonment Road, #11-02/03/04, Southpoint, Singapore 089763
Class time
9:00am – 5:00pm

Description

GK200 is an advanced-level, four-day training course designed for participants who are familiar with the principles of digital forensics and are looking to extend their capability into iOS, Android, and vehicle examinations using Magnet Graykey. Students must be part of a law enforcement agency and must be cleared in advance to attend this course.

Across four days of instruction and hands-on exercises, students will build a practical workflow for handling iOS and Android devices in the field and in the lab, and learn to operate Graykey end-to-end to extract data from locked and secured mobile devices. The course also introduces Magnet Autokey, Magnet’s vehicle acquisition solution, which extends the Graykey workflow to supported modern vehicles and is currently available to US law enforcement as an add-on to Graykey Premier licences.

Magnet Axiom is used throughout the course to explore how mobile file systems are structured and how to locate the data that matters most. Students will study the artefacts specific to Graykey’s extraction outputs and the different levels of data protection implemented on modern mobile devices. From Keychain and Keystore analysis to the advanced methodologies needed to uncover operating system artefacts, students leave the course able to deal effectively and efficiently with data from mobile devices—regardless of extraction level or device state.

Students must be part of a law enforcement agency and must own a Magnet Graykey.

What to expect

Get equipped with the skills to strengthen your mobile investigations, including Core Mobile Acquisition & Analysis (AX150), Axiom Advanced Mobile Forensics (AX300), and Graykey Examinations (GK200).

View the 10 course modules
  1. Course introduction: Review the course structure and the case scenario used throughout.
  2. Graykey overview: Understand hardware, licensing, settings and operational capabilities.
  3. iOS fundamentals: Examine APFS, Secure Enclave, protection classes, passcodes and USB restrictions.
  4. iOS acquisitions: Practise preservation and supported BFU, AFU, filesystem and Logical+ workflows; explore Autokey concepts.
  5. Android fundamentals: Review Android structures, encryption, passcodes and vendor-specific security features.
  6. Android anti-forensics: Recognise privacy-focused systems and apps, including seizure considerations.
  7. Android acquisitions: Apply supported acquisition workflows, device modes and passcode techniques.
  8. Graykey outputs and Axiom: Understand extraction outputs and load them into Axiom for analysis.
  9. Analysing iOS extractions: Locate key artefacts available at different iOS extraction levels.
  10. Analysing Android extractions: Examine BFU and full-filesystem data, including protected user spaces.

GK200 enquiries and registration

For enquiries and registration, please email enquiry@pcs-security.com or call +65 6692 7000 during office hours.

Price enquiry Register by email
Advanced 4 days

AX250 Axiom Advanced Computer Forensics

Advanced Windows investigations with Magnet Axiom, combining instructor-led learning, practical exercises and scenario-based assessment.

Date
24 November 2026 – 27 November 2026
Venue
PCSS Satellite Office · 200 Cantonment Road, #11-02/03/04, Southpoint, Singapore 089763
Class time
9:00am – 5:00pm

Description

AX250 is an advanced level course designed for students who are familiar with the principles of digital forensics and use Magnet Axiom in Windows investigations.

The course is divided into learning modules, each with a similar structure that includes identified learning objectives. Module content is presented using open discussion, demonstration, and practical exercises that are both instructor-led and performed by students on their own. Review questions also appear in various locations to check learning of key concepts.

Modules often conclude with a scenario-based exercise designed to test students’ understanding and application of what they’ve learned.

Course prerequisites

Because AX250 is an expert-level course, it is recommended that students first complete AX100 Forensic Fundamentals, which teaches the fundamentals of digital forensic investigation, and AX200 Magnet Axiom Examinations, which provides a thorough understanding of Axiom.

View the full 13-module course outline
  1. Course scenario and Windows overview
    • Build upon knowledge of the Windows registry by learning how to track down operating system installation upgrade history.
    • Learn more about Windows recovery and how to leverage it in forensic analysis.
    • Expand knowledge of local and internet accounts, combined with Windows user authentication.
    • Learn more in-depth Windows topics, including Taskbar pinned apps, WER, and wireless artifacts.
  2. Tracking down volume serial numbers
    • Interpret volume serial numbers and their importance to an investigation.
    • Use volume serial numbers to track down volumes using LNK files and Windows Event Logs.
    • Using volume serial numbers as filter searches, learn how to track down additional volumes including virtual machines.
  3. Missing files and folders
    • Track down information concerning items that are not present among the evidence sources they have.
    • Understand Microsoft’s Program Compatibility Assistant and how to leverage the Application Compatibility Cache.
    • Investigate AmCache and Shellbags.
  4. Investigating prefetched data
    • Find out more about what Windows Prefetch is and what it does.
    • Understand the forensic implications and advantages of using Prefetch information in their investigations.
    • Further learn how to correlate the information using other artifacts and verify those artifacts using external tools.
  5. Investigating suspicious documents
    • Identify and examine suspicious documents.
    • Learn how to correctly interpret MRU artifacts and verify their interpretations using the registry.
    • Further learn about Microsoft 365 including its unique MRU artifacts and registry locations that are better investigated manually.
    • Find out how to recover previous versions of PDF documents from embedded file data and how to compare those versions to detect malicious or historical activity.
  6. Memory investigations
    • Capture and process active memory from a running Windows computer using Magnet Forensics Comae Toolkit.
    • Add new RAM evidence to an existing Axiom case and process it with Axiom Process.
    • Gain further experience using Axiom Examine to apply analysis techniques to identify information of interest and artifacts pertinent to your investigation.
  7. Tracking down shared files
    • Learn how comprehensive cross-device sharing via Microsoft Cloud services can be.
    • Dive deeper into OneDrive in particular, including source evidence information locations, tracing file and folder sharing, recovering deleted OneDrive files, analyzing OneDrive URLs, and determining sync status.
    • Gain further insight into cloud data syncing as it pertains to Microsoft Edge, Wi-Fi profiles, and other general items.
  8. iOS backups in Windows
    • Reinforce prior learning concerning mobile backups found on Windows systems with the focus being Apple devices.
    • Learn about iOS encryption and how to use an index attack to gain access to encrypted iOS backups.
    • Explore artifact results in Axiom with particular attention paid to Microsoft 365 document and Apple keychain artifacts.
  9. Windows encryption and passwords
    • Learn more about Windows credential security and storage, focusing on user account passwords.
    • Understand how to recover Windows user and BitLocker passwords and do this in practical exercises.
    • Bypass application encryption for the Signal Messenger desktop app within a practical exercise.
  10. Investigating Google Drive
    • Explore advanced knowledge and concepts pertaining to Google Drive for desktop, building on their prior learning from basic Windows forensic courses.
    • Understand the difference between metadata and mirror-tracking databases and the purposes of each.
    • Learn about some highly valuable forensic data and their implications in forensic investigation that they can look out for in the future.
    • Get opportunities for hands-on practice deriving the secrets Google Drive may hold.
  11. Investigating Windows backups
    • Learn about Microsoft backup features for Windows with specific attention paid to File History.
    • Explore user settings, access to backups, and restoration.
    • Go deeper into File History internals, learning how it works and how to understand it forensically.
    • Find out about additional investigative techniques and the use of Event Logs to further the investigation.
  12. Windows apps overview
    • Get introduced to Windows apps and the Microsoft Store.
    • Explore important considerations for investigating Windows apps usage and focus on three example apps—iTunes, Windows Subsystem for Linux, and Photos.
  13. File system logging
    • Learn more about Microsoft’s New Technology File System logging and how to take advantage of it in their investigations.
    • Understand the $ObjId/$40 attribute to identify MAC addresses and other information.
    • Explore the $Secure, $UsnJrnl, and $LogFile metafiles to gather even more information about New Technology File System object owners and actions, including information from removable devices.

AX250 enquiries and registration

For enquiries and registration, please email enquiry@pcs-security.com or call +65 6692 7000 during office hours.

Price enquiry Register by email

Course fees and registration enquiries

Contact us during office hours and mention the relevant course code.

+65 6692 7000 Email us