Bridging the air gap: Strengthening mobile workflows with Graykey Fastrak and Axiom Express Extraction

In many forensic labs, especially those operating in air-gapped or high security environments, critical time is lost to fragmented workflows. 

Once a mobile device has been unlocked, examiners often spend hours manually copying extractions from an extraction device to external storage, and then again from that storage into the secure analysis network.

This multi-step transfer process introduces a pain point at exactly the wrong moment: when evidence is already accessible and the investigative process could be taking place.

A workflow challenge in secure labs

Magnet Forensics has developed solutions designed to eliminate this workflow bottleneck and the manual transfer of evidence it creates. Magnet Graykey Fastrak and Axiom Express Extraction were designed not only to accelerate evidence acquisition, but also to enable extraction to occur directly within the air-gapped environment after initial access is achieved with Magnet Graykey.

The extraction occurs without a live network connection on the offline forensic workstations.

A workflow designed for the air gap

With Graykey Fastrak, once initial access is completed and a device is prepared for Fastrak extraction, it can be transitioned from the Graykey to an offline workstation inside the air-gapped network. The extraction takes place directly on that workstation using Graykey Fastrak, eliminating the need to copy and transfer large datasets.

This allows a single workstation, typically equipped with a powered USB hub, to support concurrent extractions from multiple devices, helping labs scale up throughput. Even more, Graykey Fastrak can be installed on multiple workstations, allowing a large number of devices to be extracted, with just one license.

Same extraction, same evidence—delivered faster

When introducing a new workflow, a common question is whether anything changes in the extraction itself.

With Graykey Fastrak, it doesn’t.

Graykey Fastrak completes the same mobile extraction as Graykey. The extraction delivers the expected results, including the full file system extraction, keychain data, and the associated progress reports. Just as with Graykey, both iOS and Android devices are supported.

What is different is how quickly that evidence becomes available.

Magnet Forensics has long focused on a simple principle: time to evidence (TTE)—surfacing critical evidence as quickly as possible so investigations can progress. Graykey Fastrak extends that principle into air-gapped and high-security lab environments. By allowing mobile extractions to be completed directly to offline forensic workstations, Graykey Fastrak removes the delays traditionally introduced after access is achieved.

Graykey Fastrak is also able to complete the extraction itself more quickly. Because Fastrak runs directly on the forensic workstation, it removes the inherent limitations that come with extractions from dedicated extraction hardware. Some labs have seen an increase of ~35 to 40% over the Graykey hardware.

Building on Fastrak: Axiom Express Extraction—streamlining mobile extraction and processing

Building on the success of Graykey Fastrak, Magnet Forensics developed another solution designed to further reduce delays in mobile investigations: Axiom Express Extractions (AEE).

Like Graykey Fastrak, AEE is built with the goal of shortening the time between extractions, but with a focus on immediate processing. AEE is designed to streamline mobile workflows by combining extraction and Axiom processing into a single step.

A few shared benefits of Fastrak and Axiom Express Extraction include:

• Freeing up Graykey devices for access
• Facilitating air-gapped lab environments
• Offering the same iOS and Android support
• Enabling faster extraction speeds

Just as with Graykey Fastrak, once Graykey gains initial access, an option to “Prepare for Axiom Express Extraction” becomes available.

From extraction to processing—without manual intervention

Once the device is prepared on Graykey, it is moved to the forensic workstation where Axiom Premier is being used. Axiom performs the extraction using the same Graykey/Fastrak method, producing the same extraction output. From an evidence standpoint, nothing changes – the same data is acquired the same way.

The difference is what happens next.

As soon as the extraction completes, Axiom immediately begins processing the data using the settings that were defined when the device was connected from extraction. There is no need for an examiner to return to the workstation to manually start the next phase. Axiom processing begins automatically.

This allows the lab to continue running unattended—overnight, during off hours, or while an examiner is assigned elsewhere. Instead of needing to be present to “push a button” and keep the workflow moving, the next phase is already underway.

In practice, that can make a significant difference in how quickly evidence is available and how effectively lab time is used. By eliminating unnecessary pauses in the workflow, it’s continuing Magnet Forensics’ time to evidence (TTE) approach.

An additional advantage is the ability to scale this workflow. With more than one Axiom Premier license, the same process can be run across multiple workstations, effectively doubling or tripling the number of devices that can be extracted and processed at the same time.

Each workstation operates independently, allowing extractions and processing to continue automatically without requiring constant examiner interaction.

Bringing it all together

Mobile devices continue to grow in both size and complexity, and there is no indication that trend is slowing down. As devices get larger, the demands placed on forensics lab increase—both in terms of time and throughput.

In that environment, it makes sense to use Graykey where it delivers most value: gaining access to devices as efficiently as possible. By shifting extractions downstream and off the Graykey, labs can keep Graykey focused on access while extractions and processing continue elsewhere. This access capability can enable ten, twelve, or even twenty devices to move through extraction during a single shift. The bottleneck shifts away from access and toward a workflow designed to scale.

While Graykey Fastrak and Axiom Express Extraction address different stages of the mobile workflow, they are designed to work together—or independently—depending on a lab’s need. In the end, it’s about keeping Graykey focused on access while the rest of the workflow scales to meet growing devices volumes.

Get started with accelerating your extractions

Learn more about Graykey Fastrak here or reach out to a member of our team at sales@magnet.forensics.com.

If you are already using Axiom with a Premier license or Axiom Cyber and own a Graykey, simply update to the latest version—you already have the ability to use Express Extractions. If you aren’t already using Axiom or aren’t on an Axiom Premier License, you can request a trial to experience Express Extraction for yourself.