Portable MAGNET AXIOM (x64)




The most comprehensive, integrated digital investigation platform. You need to recover evidence from the most sources and analyze all digital evidence in one case file to ensure that no correlations are missed. Magnet AXIOM is the only platform that captures and analyzes smartphone, cloud, computer, IoT, and third-party image data in a single case file.

AXIOM for Image Extraction
Devices in investigations are piling up. Use automation to queue multiple devices and device types for image acquisition.

AXIOM for Data Recovery
Artifacts hold the most relevant digital evidence. Find more artifact data from more sources.

AXIOM for Data Analysis
Increased data volume makes analysis cumbersome and time-consuming. Layer filters and use multiple views to surface the most relevant results.

AXIOM for Reporting
Share results that are easily understood by teams at any level of technical ability.

You need to efficiently recover the most data. The most relevant evidence is in the artifacts related to a user’s internet activity and communications. Use AXIOM to get the deepest artifact data and verify with integrated file system access.

You need to surface data quickly and make thorough, reliable, and fast decisions. Magnet.AI, an industry-first machine learning technology in AXIOM, searches content and suggests conversations that indicate potential child luring, quickly and credibly narrowing results.

You need to review digital evidence in multiple tools. AXIOM’s flexibility and platform-agnostic approach enables you to ingest nearly any computer, smartphone, or cloud image.

What’s NEW:

Support for FileVault2 and VeraCrypt Decryption
AXIOM now supports decrypting and scanning VeraCrypt and FileVault2 (HFS+ only) encrypted images with a known password.
For VeraCrypt, you will need to provide a Personal Iterations Multiplier (PIM) value with the password (both can be recovered using Passware Kit Forensic if not known) and FileVault2 will require the wipekey.plist file along with the password.

Box.com Administrator Access
AXIOM Cloud can now pull audit logs from a Box.com admin account with the provided credentials which can be used to assist corporate investigators looking into cases around IP theft, employee dismissal, or other insider threats.

Google Takeout, Windows 10 Timeline and GrayKey Support
In AXIOM 2.1, there are new artifacts available to ingest and analyze:

  • Google Takeout — You can now ingest and process a Google Takeout package in AXIOM Cloud to recover artifacts and information such as Chrome activity, Google Tasks, user activity on a Google account, Google Photos, and Google Keep. ​
  • Windows 10 – Timeline — Timeline is like a browser history, but for a whole computer. It provides a chronology which not only contains the websites visited, but documents edited, games played, images viewed or created, etc..
  • Keychain Data from GrayKey — With 2.0, AXIOM was a clear leader in the amount of artifacts recovered from iOS images acquired using GrayKey devices. In 2.1, we’ve made the two pieces work even better together by providing support for the unique format of keychain data that GreyKey generates.​

Changing Encoding on a Per-Attribute Basis
For examiners working in different territories around the world, it can be incredibly difficult to decode and read artifacts that are recovered from other parts of the world — since sometimes part of the hit is recovered in one encoding and the rest in another. ​
Now you have the capability to change the encoding on a per-attribute basis so you can decode specific columns of content — as needed — when a different encoding is applied.​