What’s new in Magnet Axiom 10.0: smarter artifacts, faster insight, and stronger intelligence
WHAT’S NEW
- Get to evidence faster with Artifact Post Processing, enabling iterative analysis without reprocessing entire datasets
- Strengthen intelligence sharing across investigations with native integration to the Griffeye® Intelligence Database for consistent categorization and collaboration
- Keep pace with evolving data sources through expanded artifact support, including Apple Intelligence, ChatGPT, and Google Search Warrant Returns
Digital investigations continue to grow in scale and complexity, putting increased pressure on examiners to move faster while maintaining defensibility and analytical depth.
Magnet Axiom 10.0 is designed for that reality, helping investigators surface evidence sooner and work more effectively as cases evolve.
Here’s a closer look at what’s new in Axiom 10.0 and how these enhancements support more flexible, intelligence-driven investigations.
Artifact Post Processing: Reducing time‑to‑evidence
Processing evidence thoroughly is essential — but in large or complex cases it can slow investigations to a crawl. Examiners are left waiting on full processing, when what they need is quick access to the most relevant evidence that could quickly shape or redirect an investigation.
Artifact Post Processing is designed to remove that trade‑off.
What is Artifact Post Processing?
Artifact Post Processing allows examiners to process new artifacts after a case has already been initially processed. Instead of reprocessing an entire dataset, investigators can iteratively add one or more artifacts to the scan and process them against selected evidence items only.
In practical terms, this means:
- Initial processing can focus on a smaller subset of artifacts
- Additional artifacts can be enabled and processed later
- Only the newly selected artifacts are processed — not the entire case
This approach gives examiners far more control over how and when artifacts are processed.
Why Artifact Post Processing matters
Investigators need the right evidence quickly. Artifact Post Processing enables faster access to high‑value evidence early in a case, while still supporting deeper analysis as the investigation progresses.
By processing smaller data sets first and adding artifacts as needed, examiners can significantly reduce time‑to‑evidence, especially in large or high‑priority cases.
Real‑world example: Media investigation
Consider a media investigation:
- An examiner initiates a scan with only media artifacts enabled
- Initial review reveals evidence of specific images
- Instead of reprocessing the entire image, the examiner re‑scans the evidence with additional artifacts enabled
- Axiom processes only those newly selected artifacts
This workflow allows the examiner to move quickly from initial discovery to deeper contextual analysis, without incurring the full processing time again.
Griffeye® Intelligence Database (GID) integration: Connecting intelligence across tools
One of the most significant updates in Axiom 10.0 is an improvement to the native integration with the Griffeye® Intelligence Database (GID) — a powerful hash set and intelligence management solution widely used in investigative environments.
What is GID integration in Axiom?
With this release, Axiom and Axiom Cyber integrate directly with GID, allowing examiners to use GID hash sets for categorization within Axiom Examine. Categorizations are visible during analysis and can be pushed back to the GID, enabling a continuous loop of intelligence sharing.
This enhanced integration supports:
- Using GID hash sets for categorization in Axiom
- Viewing GID‑driven categorizations directly in Examine
- Pushing categorization updates back into the GID
The result is tighter connectivity between intelligence management and artifact analysis, without forcing examiners to manage parallel workflows.
Tip: If you don’t have Magnet Griffeye, you can still take advantage of GID hash sets by downloading the Magnet GID Manager.
Supporting local and collaborative hash sets
The GID integration enables users to maintain local hash sets while also collaborating on shared local, regional, or national hash sets. This helps agencies and organizations stay aligned and consistent in how material is categorized across cases.
By replacing isolated or manually maintained hash sets, examiners benefit from a shared intelligence ecosystem where updates are applied more efficiently, and analysis is strengthened by collective knowledge.
Why this matters for Axiom customers
For Axiom users who also rely on Griffeye, this is a major improvement over the legacy Hash Set Manager. Previously, managing, sharing, and updating multiple hash sets could be time‑consuming and fragmented.
With native GID integration, those limitations are removed, making it easier to maintain update, and share local and national hash sets across investigations.
The result is improved connectivity and usability, faster categorization, better collaboration, and stronger alignment across investigations.
New and updated artifacts: Keeping pace with data
Artifact analysis is central to every digital investigation. As devices, platforms, and applications evolve, so does the data they generate — and keeping pace with those changes is essential to understanding user activity and intent.
To support this, Axiom 10.0 expands artifact coverage to include:
- Expanded support for Apple Intelligence
- ChatGPT for iOS, Android, and Windows
- Support for Google Search Warrant Returns
Expanded support for Apple Intelligence
Apple Intelligence introduces new AI‑assisted interactions and content generation on Apple devices. With Axiom 10.0, artifact support has been expanded to help examiners surface and analyze data generated by these features.
This ensures investigators can continue to examine Apple device activity with confidence as AI‑driven capabilities evolve, with Apple Intelligence artifacts integrated directly into Axiom’s analysis workflows.
ChatGPT artifact support for iOS, Android, and Windows
AI‑powered assistants like ChatGPT are now common across mobile and desktop devices. Axiom 10.0 adds support for ChatGPT artifacts on iOS, Android, and Windows, allowing examiners to analyze AI‑assisted interactions alongside other communication and activity data.
This helps investigators view ChatGPT usage in context, supporting analysis of communications, intent, and digital decision‑making within a single case
Support for Google Search Warrant Returns
Cloud data is an increasingly important part of investigations, and Axiom Cyber 10.0 adds support for Google Search Warrant Returns to make it easier to ingest and analyze data received from Google.
By bringing this data into Axiom, examiners can analyze Google account activity alongside mobile, computer, and other cloud evidence in a single case, reducing workflow friction and the need for separate tools or manual correlation.
Export MFT to CSV in Magnet Axiom Cyber
With this release of Magnet Axiom Cyber, you can now work with a complete, clearly labelled NTFS metadata export, using an MFT CSV that can be ingested by industry‑standard tools. Export the full $MFT to CSV from the File System Explorer. This brings together recent MFT improvements — such as extended timestamp data and ADS‑specific filters — making NTFS timelines easier to validate, explain, and defend.
Learn more about Magnet Axiom & Magnet Axiom Cyber
To explore what’s new in Axiom, request a trial or speak to one of our experts for a personalized demo. You can also learn more about this new capability and all the benefits of Axiom in our upcoming webinar: Magnet Axiom: Faster Time to Evidence with Smarter, More Flexible Investigations
Existing customers can upgrade to Axiom 10.0 in the Support Portal and review the Release Notes for full details.