Magnet Nexus now supports Targeted Locations (and more!)

Modern digital investigations need to move fast. Analysts are often forced to collect too much, too little, or the wrong data simply because forensic tools don’t give them enough control. Overcollection slows analysis. Under collection increases risk.

Magnet Nexus now enables a collect-only workflow for pre-set Targeted Locations, allowing you to control what data is collected to speed up investigations and avoid gathering unnecessary information.

Let’s walk through two common scenarios where this new capability makes investigations faster, more focused, and more effective.

Use case #1: Reducing risk with faster triage and threat hunting

There are moments when analysts don’t know what they’re looking for yet, only that something is wrong.

Imagine this: Your SOC flags suspicious PowerShell activity across several remote endpoints. You need to understand what’s happening, quickly. The previous workflow in Nexus only allowed you to collect data from specific artifact categories.

Now, Targeted Locations lets you collect exactly what you need. Collect pre-set paths for files and folders where early signs of malicious activity typically appear such Windows event logs and registry files.

This helps you:

• Triage faster by gathering broad-but-relevant data to determine which endpoints need deeper investigation.
• Scope an incident earlier and reduce the amount of data you collect, process, and analyze to get you to key insights sooner.
• Hunt smarter because you can align evidence collection to known attacker behaviors and uncover subtle signs that traditional security tools may miss.

Use case #2: Efficient, highly targeted collections

In other cases, precision is essential.

Picture an internal investigation where a user is suspected of exfiltrating proprietary designs (IP). Legal has asked you to locate a single document.

With Targeted Locations in Nexus, you can now collect just the files and folders you care about (across multiple endpoints if needed) without sweeping up unnecessary data, such as the Documents folder for this specific incident.

This helps you:

• Minimize overcollection which is critical for privacy, compliance, and efficiency
• Save time by reducing data volume sizes and analysis workload
• Focus on only the evidence that matters most

More flexibility to support more of your workflow

Artifact-based collections are powerful, but they can’t meet all investigative needs. Nexus now offers flexibility, allowing you to collect from a list of pre-set, frequently needed files and folders, even those outside of the standard artifact categories.

Plus, we recognize that Nexus may be just one tool in your broader workflow. With Targeted Locations, you can grab what you need and then use other tools for deeper analysis, like Magnet Axiom Cyber, ensuring your workflow remains seamless and adaptable.

See how it works in the interactive demo:

And more to come!

We’re already building on this capability with the following improvements coming soon:

• Targeted Location collections to include data processing within Nexus: Soon we’ll be adding the ability to process the data within Nexus as well, so you get results right within your browser.
• Windows filesystem preview and triage: Browse a hierarchical view of the filesystem, expand volumes, navigate folders, and select files for collection.
• Full physical collections

Stay tuned for more updates in the coming months!

(Want expert insights and product news delivered straight to your inbox? Sign up for our Magnet Unlocked monthly newsletter here.)

Other highlights you may have missed in 2025

Over the past year, we’ve continued to enhance Nexus to help investigative teams increase control over data residency and move cases forward with greater speed and confidence.

New capabilities introduced in 2025 include:

• More flexibility and control over investigations: A new hybrid collection agent and workflow connects online and desktop investigations, giving you control over where data is stored while supporting enterprise policies and case needs.
• Simpler evidence sharing and preservation: Collections can be exported as AFF4-L forensic images to support downstream analysis and defensible evidence handling.
• Cancel active collections: Avoid unnecessary data transfer by cancelling in-progress collections.
• Faster access to critical evidence: UI and filtering improvements make it easier to find, sort, and review data, helping you focus on what matters most.
• Improved collection performance with less network impact: A new proxy bypass option during agent deployment to allow traffic to go directly to Nexus, reduce network overhead, keep firewall logs clean, and potentially speed up collections.

Ready to try Nexus for free?

Nexus now gives analysts precision control over exactly what they collect and an improved user experience as we continue to deliver on the promise of making large-scale investigations easy.

The Targeted Locations feature is now available, so if you’re a Nexus customer, try it out now and let us know what you think.

If you’re new to Nexus, request a free trial here or contact sales@magnetforensics.com or your account representative to arrange a personalized walkthrough.