USER GUIDE CONTENTS What's new 4 About Magnet OUTRIDER 5 Getting started with Magnet OUTRIDER 6 System requirements 6 Use Magnet OUTRIDER on a dongle 6 Use a trial license of Magnet OUTRIDER 6 Understanding changes made to the system 7 Detecting Bitlocker encrypted drives 8 Scanning a target 9 Scan a computer 9 Encryption screening 9 Scan an external drive 10 Scan a folder 10 Configuring scan options 11 Locate files and apps settings 11 Collect artifacts and scan browser history settings 13 CSAM Detection Technology settings 14 Scan options 15 Reporting options 16 Miscellaneous options 16 Adding keywords and NCMEC report data to a search 17 Import a keyword list or NCMEC report data 17 View a keyword list or NCMEC report data 17 Export a keyword list or NCMEC report data 18 Reviewing scan results 19 Mark a CRC CSAM hit as a false positive 19 Starting a new scan 20 Supported application categories 20 Viewing and exporting scan reports 22 View scan reports 22 Navigating your scan report folder 22 Contents of scan reports 23 View and export an error list 23 Exporting filename keyword hits and CRC CSAM hits 25 Export filename keyword hits or CRC CSAM hits 25 Export a list of saved hits 25 Updating Magnet OUTRIDER 27 Update Magnet OUTRIDER manually 27 Automatically check for updates 27 User Guide WHAT'S NEW VERSION DESCRIPTION 2.1.0 l Updated Configuring scan options with information about scanning connected networks, new supported operating system artifacts, and customizing case and report locations. 2.0.0 l Updated Reviewing scan results with information about new supported apps. l Updated Scanning a target with information about scanning specific folders. l Updated Adding keywords and NCMEC report data to a search with information about regex keywords and NCMEC report data. l Updated Reviewing scan results with information about reporting false positive hits using CRC CSAM detection technology. l Updated Viewing and exporting scan reports with information about new features in scan reports. l Updated and reorganized Configuring scan optionswith information about new con- figuration options. l Updated Getting started with Magnet OUTRIDER with current system requirements. 1.5.0 l Initial version 4 User Guide ABOUT MAGNET OUTRIDER Use Magnet OUTRIDER at the beginning of your investigation to quickly assess your potential evidence sources, including computers, drives, and specific folders, and determine which computers to prioritize in your investigation. Rather than performing an in-depth search of a drive, which can be time-consuming, Magnet OUTRIDER helps triage and preview content by quickly scanning target devices for contraband con- tent and applications. Magnet OUTRIDER scans the file names on a target for potential dark web, P2P, cloud storage, encryption, anti-forensics, gaming, messaging, virtual machine, VPN, and cryptocurrency apps and files. You can view the list of supported apps and files in Magnet OUTRIDER. Magnet OUTRIDER also scans file names for keyword matches using keyword and regex keyword lists. Depending on the keyword list you use, Magnet OUTRIDER can help identify files that contain CSAM or other flagged content. A keyword list with CSAM-related keywords is included in Magnet OUTRIDER for law enforcement agencies. You can also import NCMEC CyberTip reports to use URLs, file names, and IP addresses from the reports as keywords for locating files or matching on browser history. For scans of live systems, Magnet OUTRIDER can collect operating system artifacts, capture RAM, take a screenshot of the desktop, and obtain the external IP address for the system. Law enforcement customers can also use technology from the Child Rescue Coalition (CRC) in Magnet OUTRIDERto quickly identify known CSAM content even if no keyword hits were found in file names. This technology analyzes all of the files scanned by Magnet OUTRIDER (not including files found in ZIP files) using hashes from law enforcement CSAM databases in the United States and Canada. After a scan completes, you can review the items of interest in the app, export evidence, and view a sum- mary report generated by the app. Note: If Magnet OUTRIDER returns a result of No hits found, the drive isn't necessarily clear of relevant apps, keyword matches, or CSAM content. Some users are capable of hiding files from the application. However, using Magnet OUTRIDER's quick scanning capabilities can help to prioritize between multiple target devices. 5 User Guide GETTING STARTED WITH MAGNET OUTRIDER If your organziation has purchased Magnet OUTRIDER, you'll receive a USB dongle that you can take with you on your investigations to use Magnet OUTRIDER on a computer. If you're using a trial license of Magnet OUTRIDER, you'll receive a an installation file and license key in an email from Magnet Forensics. System requirements You can run Magnet OUTRIDER on a computer as long as it meets the following requirements. ITEM MINIMUM REQUIREMENT Operating system Windows 7 or later Software framework Microsoft .NET Framework 3.5 or later Memory 2 GB RAM Use Magnet OUTRIDER on a dongle Take the USB dongle that you received from Magnet Forensics on your investigations so that you can use Magnet OUTRIDER on a computer. The first time you use Magnet OUTRIDER, you'll be asked if you agree to send diagnostic data to Magnet Forensics and to confirm your agreement with the End User License Agree- ment. 1. Connect the Magnet OUTRIDER dongle to a computer. 2. In the File Explorer, browse to the USB drive and double-click Start Magnet Outrider.bat. 3. If a dialog appears asking if Magnet OUTRIDER can make changes to the device, click Yes. Use a trial license of Magnet OUTRIDER If you've signed up for a trial license of Magnet OUTRIDER, you'll need to install the application on a USB drive that you provide or on a computer. Once you've installed Magnet OUTRIDER, activate the trial license that you received from Magnet Forensics. 6 User Guide Install a trial version of Magnet OUTRIDER 1. Open the email that you received from Magnet Forensics and save the MagnetOUTRIDER_Setup_ vXXX.exe installation file to your computer or to your USB drive. 2. In your File Explorer, browse to the installation file and double-click it. 3. In the Setup window, accept the End User License Agreement and click Next. 4. On the Destination Location screen, click Browse... and select the USB drive as the installation loc- ation. 5. Click Next, and then click Install. Register a trial version of Magnet OUTRIDER 1. After the installation completes, select the option to Launch Magnet OUTRIDER, and then click Finish. 2. If a dialog appears asking if Magnet OUTRIDER can make changes to your device, click Yes. 3. In the Register Magnet OUTRIDER dialog, paste the license key from the email. 4. If you want to send diagnostic data for Magnet Forensics to use to improve the application, select Help improve Magnet Outrider by opting in to send diagnostic data. 5. Select the option to agree to the End User License Agreement (EULA). 6. Click Register. Take the USB dongle that you installed Magnet OUTRIDER on to your investigations so that you can use Mag- net OUTRIDER on a computer. Understanding changes made to the system To maintain the integrity of forensic evidence, Magnet OUTRIDER does not modify or create any files on the system where it is run. However, a few files will be created automatically by the Windows system. If you run Magnet OUTRIDER on a system and then examine evidence from the system more closely using a forensic tool such as Magnet AXIOM, you'll find registry keys and prefetch files in the evidence that were created when you connected the USB drive and ran Magnet OUTRIDER. 7 User Guide ITEM DESCRIPTION Registry keys When you connect your Magnet OUTRIDER USB dongle to a target's computer, some registry keys will be created. These registry keys will match the hard- ware ID of the USB drive that you connected. Prefetch files When you run Magnet OUTRIDER on a computer, Prefetch files are created by Windows. The following Prefetch files can be found at C:\Local Disk\Win- dows\Prefetch. l Each time you open the program, a file will be created whose file name begins with "MAGNETOUTRIDER.VXXX.EXE". l If encryption is detected on the computer, a file will be created whose file name begins with "EDD.EXE". Detecting Bitlocker encrypted drives When you open Magnet OUTRIDER, the application automatically checks the computer and its attached drives for Bitlocker encryption. If Magnet OUTRIDER detects a drive that has been encrypted and password- locked using Bitlocker, you'll be notified of which drive has been detected as a Bitlocker locked drive. A drive cannot be scanned if it is encrypted using Bitlocker. If the Bitlocker pop-up window appears before your scan, choose one of the following options. l If you know the drive password, click Yes. In the Bitlocker window that appears, provide the pass- word and click Unlock. l If you don't know the drive password, click No to skip that drive in your scan. 8 User Guide SCANNING A TARGET Use Magnet OUTRIDER to scan computers, external drives, and specific folders. You can narrow or broaden the range of your scan by configuring scan options or adding keywords, regex keywords, or NCMEC report data to your search. If necessary, you can stop a scan at any time. When you stop a scan, Magnet OUTRIDER generates scan reports based on the evidence that it has already scanned and saves these reports to the case folder. For more information, see Viewing and exporting scan reports.