Scale your forensic workflows with Magnet Automate 5.2

Connect tools, reduce manual intervention, and move evidence through your investigation workflow more efficiently.

For many teams, their work still involves starting processes manually, moving between tools, monitoring jobs, and repeating the same steps across investigations. As case volume grows, those handoffs can become an operational bottleneck.

That’s where forensic automation can help.

Magnet Automate orchestrates repeatable workflows across both Magnet and third-party forensic tools, helping teams reduce manual intervention, standardize processes, and keep evidence moving through their existing forensic environment.

With Magnet Automate 5.2, teams can take that automation further, with new capabilities for incorporating GID intelligence, initiating workflows, Remote Acquire, Local DateTime, and workflow reliability.

From forensic analysis to forensic operations

Magnet Axiom gives examiners the environment to process and analyze digital evidence. As teams scale, however, the question can shift from “How do I process this case?” to “How do we consistently move many cases through our forensic processes?”

Magnet Automate extends that environment by orchestrating workflows around the forensic tools and processes teams already use, helping them scale operations without replacing their existing forensic toolkit.

Put more intelligence into repeatable workflows

Automation becomes more valuable when it can connect the intelligence and forensic technologies your team already relies on.

With Automate 5.2, GID can now be incorporated into automated workflows through Automate, Process CLI, and GID Manager/Client services. Once configured, teams can identify GID hash sets for use in a Process CLI search, helping improve processing performance compared with local hash lists.

For teams already using GID, this means that intelligence can become part of a repeatable processing workflow rather than a separate investigative step. Remember to also use your Export Templates to refine the export further going into Griffeye, by removing categories you do not need in the Griffeye case.

Build workflows around the process you need

Not every workflow starts with an image or a drive. Automate 5.2 adds an “Other” start element to give teams greater flexibility over how their workflows begin.

That means teams can spend less time accommodating the mechanics of the workflow and more time designing workflows around the processes they actually need to automate.

This enhancement complements Automate’s existing visual workflow approach, which allows teams to build and reuse workflows across their forensic processes.

Connect collection more closely to downstream forensic workflows

Collecting evidence is only the beginning of an investigation. The more teams can connect acquisition to the processes that follow, the less manual intervention is required to keep evidence moving.

Automate 5.2 expands the flexibility of Remote Acquire workflows, enabling teams to build more complex workflows without the previous PowerShell script-length constraint. It also provides additional flexibility when initiating workflows through the API and working with node IP configurations.

Previously, Remote Acquire workflows could encounter PowerShell’s 32,767-character script limit. Automate 5.2 addresses this by temporarily writing the JSON, passing it to Remote Acquire CLI, and removing it after the operation is complete.

The release also includes changes that provide greater flexibility when starting a non-Remote Acquire workflow through the API and when working with node IP configurations.

The outcome is that teams can build more complex Remote Acquire workflows without the previous PowerShell script-length constraint while gaining additional flexibility around how those workflows are initiated and configured.

Preserve time context across automated workflows

Automate 5.2 extends Local DateTime support into Post Processing/RunJob and Exporter workflows, helping teams carry that time context further through automated processing and export.

For teams working with evidence across systems or locations, this provides greater flexibility for maintaining relevant time context as evidence moves through the workflow.

Improved reliability for everyday workflows

Automate 5.2 also includes a range of improvements across licensing, APIs, PowerShell handling, watch-folder processing, and telemetry. Together, these updates are designed to reduce friction and improve reliability across automated workflows.

For the full technical details, see the Automate 5.2 release notes.

Is it time to automate more of your forensic workflow?

Automate may be worth considering if your team:

• Repeats the same processing steps across investigations
• Spends examiner time starting, monitoring, or moving work between forensic tools
• Needs more consistent workflows across investigators or cases
• Uses multiple Magnet or third-party forensic technologies as part of the same process
• Is looking to scale forensic operations without adding the same level of manual process overhead

If you’re already using Magnet Axiom, Axiom Cyber, or other technologies within your forensic workflow, Automate can help connect those individual capabilities into standardized processes.

Ready to automate more of your forensic workflow?

As forensic operations scale, the opportunity isn’t simply to process evidence faster. It’s to reduce the manual work required to keep evidence moving.

Magnet Automate helps teams turn forensic processes into repeatable workflows and Automate 5.2 gives teams even more flexibility over the intelligence, acquisition, and processes they can bring into those workflows.

New to Automate? See how Magnet Automate works

Already using Automate? Explore what’s new in Automate 5.2