Exporting evidence using the exporting wizard

Use the exporting wizard to create and customize exports and reports in AXIOM Examine. When you create an export, the wizard walks you through a series of steps that are customized to the type of export you're creating.

First, you can choose the type of export / report you want to create. You can share evidence in many formats, including Excel, XML, HTML, PST, PDF, and more.

Next, you can choose which items you want to include in your export / report (such as tagged items, Case dashboard cards, etc.), or you can choose to use a template. When you use a template, the export / report options are automatically configured based on the settings in your template—so you can either proceed right to building your report, or you can modify the settings during the rest of the workflow.

Depending on the export type, you can also select which summary information from your case dashboard to include in your export. You can also select this information in your templates.

Depending on the export type, you can also choose which artifact categories (or specific artifacts) you want to include, configure additional artifact details, configure columns to include or use column configurations, customize the title page, and customize formatting options.

Finally, you can preview the names and sizes of all the files that will be included in your export.

Create an export

In AXIOM Examine, click File > Create export / report. Or, if you want to export a specific selection in the current view, select and right-click an artifact group or specific evidence items, then click Create export / report.
Under Export / report format, click a format and then click Next.
In Items to include, select what you want to export and then click Next.
If applicable to your export type, Select artifacts or artifact categories you want to include and then click Next.
If applicable to your export type, Configure the artifact details and then click Next.
If applicable to your export type, follow the steps to Customize title page, Customize formatting options, and Provide additional information, then click Next.
On the Preview and save screen, click Browse and select the location where you want to save the export. Click Select folder.
On the Preview and save screen, click Save.

Note: AXIOM Examine saves exports to your case folder, with a UTC time stamp. Depending on the archive explorer you use to view the exported .zip file, the times of the artifacts might be converted to your local time. You can use tools such as 7-Zip to convert the artifact times back to what you see in AXIOM Examine.

Export types

You can create exports and reports that include different types of evidence, details, attachments, and more. AXIOM Examine supports ten different export formats that are useful in different situations. The table below describes each export type, some possible use cases, and possible limitations that you should keep in mind.

Export type	Description and use cases
CSV	This option exports evidence, including timeline data, to a comma-separated value (CSV) file that you can open in text editor or spreadsheet applications. As the name suggests, each fragment in an artifact is separated by a comma. This option does not include any attachments with the export. Use this export type to export metadata and timeline data, for example. This export is not recommended for exports that include chat messages in a different language than the UI, or other multiline UTF-8 encoded text (Excel exports are a recommended alternative to CSV in these instances).
Excel	This option exports evidence to an .xlsx file. Use this export type to prevent display errors that are common in .csv file exports of multiline UTF-8 encoded text (for example, chat messages in a different language than the UI).
HTML	This option exports evidence to a package of user-friendly HTML files with built-in navigation and includes attachments. You can also select which summary information to include from the case dashboard. Double-click the Report.html file to open the export in a web browser. Use this export type to export chat threads, connections maps (from the Connections explorer), case dashboard cards, and evidence in a different language than the UI.
KML	This option exports GPS coordinates from the evidence to plot on a map browser.
Load Files	This option exports data from Magnet AXIOM Cyber for use with eDiscovery platforms that support .dat files, such as Relativity. A load file export includes the following files: Load File.dat: The main file that you can load into an eDiscovery platform. The load file is a plain text delimited file with a .dat extension. Native folder: Contains the native files for each document in the load file. Text folder: Contains the text files for each document in the load file. You can include all artifacts in the .dat file. Native files are included for the following artifacts: Email (includes a .msg file for each email) User created content including pictures, video, audio, and documents (the original file) Chat messages from any source (an HTML chat thread is generated for each chat message based on how you configure chat message previews) Examiner-defined and custom artifacts (the original file) The .dat file uses the following Relativity/Concordance default delimiters: Column: ASCII 020 Quote: ASCII 254 Newline: ASCII 174
Magnet REVIEW 2.0	This option exports all evidence you selected to a .json file with attachments. This option exports in UTC time and in English only. You can also upload the evidence directly to a Magnet REVIEW case on your organization's server. Use this export type to export content from AXIOM Examine to Magnet REVIEW.
PDF	This option exports all evidence you selected to PDF, a read-only format that's easily printable. You can also select which summary information to include from the case dashboard. PDF exports include a table of contents. Use this export type to export chat threads, connections maps (from the Connections explorer), case dashboard cards, and evidence in a different language than the UI.
PST	This option exports Microsoft Outlook email messages to a .pst file that you can open in a PST viewer. This option does not include content like calendar items, contacts, or tasks. PST exports are designed for Microsoft Outlook, but this export type also supports the following email artifacts: Outlook Emails Cloud IMAP/POP Emails Cloud iCloud Mail Cloud MBOX Emails Cloud Gmail Messages
Portable case	This option exports all your evidence to a portable case that users without a full version of Magnet AXIOM Cyber can use with limited capabilities. A portable case contains the artifact database and evidence sources, combined with a lightweight version of AXIOM Examine. Certain features are unavailable to create a more streamlined experience for non-technical users. For more information, see the portable case quick start guide.
XML	This option exports all evidence you selected to an .xml file. You can choose to include external files. For more information about the structure of the .xml file, log in to the Customer Portal to review the Sample XML output article. Use this export type to export chat threads, evidence that you want to use with another tool or script, and evidence that includes external files.

Items to include in your export

When you share evidence, you choose which evidence items you want to include. Depending on the export type that you've chosen, different options will be available.

Option	Description
Use a template	Templates help to streamline the exporting process by predetermining the export's artifact types, columns, and format options. For more information about creating templates, see Creating and managing templates. For Load File exports, consider customizing templates for each specific Discovery platform that you use so that you can reuse those settings for future cases.
All evidence	Export all of the applicable evidence items the case.
Items in the current view	Export all of the applicable evidence items currently visible in Evidence. The items that AXIOM Examine displays depend on which artifacts you select and the filters that you apply. For example, you can select a specific artifact (such as Skype Messages) and apply a date filter to include only the messages in the last six months.
Tagged items	Export only the items you tagged. You can select all tagged items in the case, or only items that you have applied specific tags to.
Selected items only	Export only the items you selected in Evidence.
Summary information to include	For HTML and PDF reports, you can include summary information from the case dashboard in your report. Depending on the evidence available in your case, you can choose to include information such as a case overview, evidence overview, and keyword matches.

Configure artifact details

Under Configure artifact details, certain export types allow you to select or deselect various options about what information you want to include in your export.

Detail	Description
Include previews and file attachments	For HTML exports, if email or other messaging artifacts are exported, attachments will be listed with the message in the report itself, and will be exported in a separate folder. If you extracted text from files using OCR in your case, a .txt file that includes the extracted text is included in the resources folder.
Include embedded picture previews	For PDF and Excel export types, you can embed media items directly in the report.
Include source files in the attachments folder	For PDF, CSV, Excel, and XML export types, export the source files in your case to the attachments folder. If you extracted text from files using OCR in your case, a .txt file that includes the extracted text is included in the resources folder.
Include chat thread reports as PDF or HTML	If you export messages that are available in conversation view, your export will include these threaded conversations in addition to the report with the metadata you've chosen to include.
Make external links clickable	If any of the artifact data in your export includes external links, you'll be able to click on them and view the external web page.
Include native files for each item in the load files	For Load File exports, select this option to include native files (both the source files and chat threads) for each item in your load file export.
Configure chat message previews	For Load File exports, AXIOM Examine exports the chat thread preview file for each message. You can select how many messages from the conversation you want to include in the chat thread for each message's native files. Include all selected messages from the conversation in each native file: The native file for each message will include all selected messages selected for the export. Consider selecting this option if you want to include additional context to reviewers, and you don't have concerns about further redaction after generating the load file. Only display a single message for each native file: The native file includes a single chat bubble for that message. Consider selecting this option if you're concerned about further redaction after generating the load file. Note: Any media included in chat messages will be included in the chat message previews.

Configure columns to include

Under Configure columns to include, certain export types allow you to choose which columns you want to include in your export.

Option	Description
All columns	Include all columns from your case in your export.
Visible columns and column sorting from current view	If you're using the Column view in the Artifacts explorer, you can maintain the customizations that you make to the Column view in your export. For example, if you sort, reorder, or hide columns under Evidence, your export does the same.
Specific columns only (advanced)	You can include specific columns in your export using column configurations. Column configurations help to streamline the exporting process by predetermining which columns will be displayed in applicable reports. When you create an export, you can save the column configuration settings for use in future exports. When you manage your column configurations, for each artifact, you can include or exclude specific columns, reorder columns using drag-and-drop, and configure the sort order for up to three column names (primary, secondary, or tertiary). For Load File exports, consider creating column configurations to limit the size of the .dat file. For example, to exclude the email body fragment.

Option

Description

All columns

Include all columns from your case in your export.

Visible columns and column sorting from current view

If you're using the Column view in the Artifacts explorer, you can maintain the customizations that you make to the Column view in your export. For example, if you sort, reorder, or hide columns under Evidence, your export does the same.

Specific columns only (advanced)

You can include specific columns in your export using column configurations. Column configurations help to streamline the exporting process by predetermining which columns will be displayed in applicable reports. When you create an export, you can save the column configuration settings for use in future exports.

When you manage your column configurations, for each artifact, you can include or exclude specific columns, reorder columns using drag-and-drop, and configure the sort order for up to three column names (primary, secondary, or tertiary).

For Load File exports, consider creating column configurations to limit the size of the .dat file. For example, to exclude the email body fragment.

Format options

Export type	Format options
PDF	Generate either a single export file or create separate files: Create one export file with all artifact types: AXIOM Examinegenerates one PDF report (a single .pdf file) that contains all selected artifacts including all of the fragments for each hit. Create a separate export file for each artifact type: AXIOM Examine generates multiple .pdf files for each artifact type.
Excel	Generate either separate Excel workbooks or one Excel workbook with multiple worksheets: Create separate Excel workbooks for each artifact type: AXIOM Examine generates separate workbooks (multiple .xlsx files) for each artifact type. Create one Excel workbook that includes worksheets for each artifact type: AXIOM Examine generates one Excel workbook (a single .xlsx file) that includes a worksheet for each artifact type.
Magnet REVIEW	Select whether you want to use the REVIEW 2.0 or REVIEW 1.0 export version.
Load Files	Customize how you want the native files and text files for each artifact to be named. You can add a prefix, set the numerical starting value, and specify the number of digits used in the file names.
VICS	Select whether you want to use the VICS 2.0 or VICS 1.3 export version. Select whether you want to generate a new CaseID value so that the exported data appears as a new case within the CAID database.