MAGNET Chromebook Acquisition Assistant™

Project Status: Complete

Project Stage: There is no active development on this project, and the tool is not actively supported due to changes in Google’s platform, rendering our acquisition method ineffective. MAGNET Chromebook Acquisition Assistant is no longer available to download.


MAGNET Chromebook Acquisition Assistant: What does it do? 

Note: Google no longer provides links to older recovery images for Chromebooks rendering the previous MAGNET Chromebook Acquisition Assistant (MCAA) instructions obsolete. Further, changes on Google’s platform have made other approaches ineffective.

MCAA 2.0 will help you acquire a logical image from a Chromebook when you have the username and password without requiring it to be in Developer Mode. Chromebook forensic images are acquired with a USB drive and the MCAA’s wizard style walkthrough will help you prepare the USB drive for image acquisition. The method in MCAA 2.0 is still based on the Daniel Dickerman Chromebook Forensic Acquisition method. 

Key Features:

  • Simple interface with wizard style walkthrough for acquisition
  • Makes preparing a USB drive for acquisition fast and easy
  • Extracted images can be processed and analyzed with Magnet AXIOM
  • No Linux skills required

Requirements:

  • Windows 7 or higher required.
  • USB drive that is at least 32GB or larger to be used for the extraction. 64GB+ is recommended if you have a Chromebook with a larger hard drive to acquire from.
  • Username/email address and password of the account used to log into the Chromebook.

Once you have acquired the image with MCAA, it can be ingested by Magnet AXIOM and Magnet AXIOM Cyber. Select the “Computer > Chromebook” evidence source options. This will scan the image, recover app data, and key artifacts

Both AXIOM and AXIOM CYBER have dedicated artifact support for Chromebooks including: 

  • Bookmarks 
  • Cache 
  • Cookies
  • Downloads 
  • Media History 
  • Web History 
  • And more!

Also, check out the resources below to support your analysis of Chromebooks: