AXIOM icon
Release Notes
Magnet AXIOM January 24, 2020

Artifact updates

GroupMe-icon Group Me NEW
Snapchat-icon Snapchat
TextFree-icon TextFree
TextNow-icon TextNow
Tumblr-icon Tumblr NEW
VK-icon VK
Windows Defender 16-icon Defender Logs
 Dropbox-icon Dropbox
 Firefox-icon Firefox
icon McAfee Logs
Rebuilt Desktops-icon Rebuilt Desktops
RecycleBin-icon Recycle Bin
AirDrop-icon AirDrop NEW
IOS Call Logs-icon Call Logs
Dropbox-icon Dropbox
Facebook Messenger-icon Facebook Messenger
GroupMe-icon GroupMe NEW
Installed Applications-icon Installed Applications
KnowledgeC-icon KnowledgeC
Screen Time-icon Screen Time
Signal-icon Signal
iOS location services 16-icon Significant Locations
Skype-icon Skype
TextFree-icon TextFree
Tinder-icon Tinder
VK-icon VK
Wickr-icon WickrMe
Yahoo Mail App Yahoo Webmail
AirDrop-icon AirDrop NEW
Chrome-icon Chrome Extensions
Picture-icon Pictures

Magnet AXIOM Cyber is here!

We’re proud to announce that Magnet AXIOM Cyber is now available! AXIOM Cyber is an innovative new solution, purpose-built for organizations that need to perform remote acquisitions as well as collect and analyze evidence from cloud sources, computers, and mobile devices.

AXIOM Cyber enables you to remotely collect evidence from target endpoints on an as-needed basis—without the need for additional infrastructure. Using AXIOM Cyber, you can:

  • Covertly deploy a remote agent to a remote computer to acquire drives, memory, and logical files from the file system—even if the drive is encrypted.
  • Automatically resume collection of data from the point where the agent left off if connectivity is lost.
  • Provide known decryption credentials for supported encryption types.
  • Automatically detect memory profiles and load RAM capture dumps in Volatility.

AXIOM Cyber also helps you quickly understand what happened by acquiring and analyzing data across all evidence sources—including cloud, computer and mobile phones. These evidence sources include brand new Cloud-related features, such as:

  • Using admin credentials to access Office 365, G Suite, and
  • Acquisition from Enterprise cloud services AWS S3 buckets and EC2 instances, Microsoft Teams, and Slack (including Slack's JSON exports).

To request a free trial of Magnet AXIOM Cyber today, visit

Rebuilt Desktops artifact

Rebuilt Desktops is an artifact that allows you to view an approximation of what a user’s most recent desktop looked like. Magnet AXIOM recovers configuration data – such as wallpaper, monitor configuration, and icon positioning – from targeted registry keys in the registry, as well as the user’s files and folders. By recovering, processing, and visualizing this data, Magnet AXIOM can replicate the appearance of a user’s desktop on their live Windows machine without having to virtualize it.

For more information about the Rebuilt Desktops artifact, log in to the Customer Portal to review Artifact profile: Rebuilt Desktops.

Syncing tags between Artifacts and File system explorers

For cases processed in Magnet AXIOM 3.9 and higher, tags that you apply to evidence now automatically sync between the Artifacts and File systems explorers.

  • When you tag an artifact in the Artifacts explorer, AXIOM Examine automatically applies the same tag to both the artifact and a corresponding file in the File system explorer if there is a single source for the hit.
  • When you tag an artifact in the File system explorer, AXIOM Examine automatically applies the same tag to both the file and a corresponding artifact if there is a one-to-one relationship between the file in the File system explorer and a parsed artifact hit. If there are multiple artifact hits for the file, AXIOM Examine automatically creates a new artifact from the file and applies the same tag to both—you can quickly view these artifacts in the Tagged from file system artifact category in the Artifacts explorer.
  • For complete details about tag syncing, please review the Tagging evidence topic in the Magnet AXIOM User Guide.

More highlights

Other useful features in Magnet AXIOM 3.9.0 include:

  • AXIOM Process will now automatically attempt to recover a clear key from the MBR and decrypt the drive when BitLocker Device Encryption is detected.
  • AXIOM Process now supports acquiring devices jailbroken with checkra1n without requiring additional software to be installed on the device.
  • File and folder data loading has been improved, allowing you to select which files you want to process much more quickly.
  • More details...





Bug fixes

Known issues