Exporting evidence using the exporting wizard

Use the exporting wizard to create and customize exports and reports in AXIOM Examine. When you create an export, the wizard walks you through a series of steps that are customized to the type of export you're creating.

First, you can choose the type of export / report you want to create. You can share evidence in many formats, including Excel, XML, HTML, PST, PDF, and more.

Next, you can choose which items you want to include in your export / report (such as tagged items, Case dashboard cards, etc.), or you can choose to use a template. When you use a template, the export / report options are automatically configured based on the settings in your template—so you can either proceed right to building your report, or you can modify the settings during the rest of the workflow.

Depending on the export type, you can also select which summary information from your case dashboard to include in your export. You can also select this information in your templates.

Depending on the export type, you can also choose which artifact categories (or specific artifacts) you want to include, configure additional artifact details, configure columns to include or use column configurations, customize the title page, and customize formatting options.

Finally, you can preview the names and sizes of all the files that will be included in your export.

Create an export

In AXIOM Examine, click File > Create export / report. Or, if you want to export a specific selection in the current view, select and right-click an artifact group or specific evidence items, then click Create export / report.
Under Export / report format, click a format and then click Next.
In Items to include, select what you want to export and then click Next.
If applicable to your export type, Select artifacts or artifact categories you want to include and then click Next.
If applicable to your export type, Configure the artifact details and then click Next.
If applicable to your export type, follow the steps to Customize title page, Customize formatting options, and Provide additional information, then click Next.
On the Preview and save screen, click Browse and select the location where you want to save the export. Click Select folder.
On the Preview and save screen, click Save.

Note: AXIOM Examine saves exports to your case folder, with a UTC time stamp. Depending on the archive explorer you use to view the exported .zip file, the times of the artifacts might be converted to your local time. You can use tools such as 7-Zip to convert the artifact times back to what you see in AXIOM Examine.

Export types

You can create exports and reports that include different types of evidence, details, attachments, and more. AXIOM Examine supports ten different export formats that are useful in different situations. The table below describes each export type, some possible use cases, and possible limitations that you should keep in mind.

Export type	Description and use cases
CSV	This option exports evidence, including timeline data, to a comma-separated value (CSV) file that you can open in text editor or spreadsheet applications. As the name suggests, each fragment in an artifact is separated by a comma. This option does not include any attachments with the export. Use this export type to export metadata and timeline data, for example. This export is not recommended for exports that include chat messages in a different language than the UI, or other multiline UTF-8 encoded text (Excel exports are a recommended alternative to CSV in these instances).
Excel	This option exports evidence to an .xlsx file. Use this export type to prevent display errors that are common in .csv file exports of multiline UTF-8 encoded text (for example, chat messages in a different language than the UI).
HTML	This option exports evidence to a package of user-friendly HTML files with built-in navigation and includes attachments. You can also select which summary information to include from the case dashboard. Double-click the Report.html file to open the export in a web browser. Use this export type to export chat threads, connections maps (from the Connections explorer), case dashboard cards, and evidence in a different language than the UI.
Identifiers	This option exports all of the identifiers in a case to a .json file so that you can share the information with other organizations. The export requires that you provide your organization name and contact information so that if another organization gets a match on one of your identifiers they can contact you to request more information about your case.
KML	This option exports GPS coordinates from the evidence to plot on a map browser.
Magnet REVIEW 2.0	This option exports all evidence you selected to a .json file with attachments. This option exports in UTC time and in English only. You can also upload the evidence directly to a Magnet REVIEW case on your organization's server. Use this export type to export content from AXIOM Examine to Magnet REVIEW.
PDF	This option exports all evidence you selected to PDF, a read-only format that's easily printable. You can also select which summary information to include from the case dashboard. PDF exports include a table of contents. Use this export type to export chat threads, connections maps (from the Connections explorer), case dashboard cards, and evidence in a different language than the UI.
PST	This option exports Microsoft Outlook email messages to a .pst file that you can open in a PST viewer. This option does not include content like calendar items, contacts, or tasks. PST exports are designed for Microsoft Outlook, but this export type also supports the following email artifacts: Outlook Emails Cloud IMAP/POP Emails Cloud iCloud Mail Cloud MBOX Emails Cloud Gmail Messages
Portable case	This option exports all your evidence to a portable case that users without a full version of Magnet AXIOM can use with limited capabilities. A portable case contains the artifact database and evidence sources, combined with a lightweight version of AXIOM Examine. Certain features are unavailable to create a more streamlined experience for non-technical users. For more information, see the portable case quick start guide.
VICS 1.3, VICS 2.0 (JSON)	This option exports reviewer graded media in a .json file using the Project VIC specification. For more information about Project VIC, see www.projectvic.org. Use this export type to share graded media with Project VIC or CAID. If you have any media in your case that has been precategorized by CAID but is missing from their database, you can help them fill in these gaps by choosing the option to include attachments for media items that are missing from the CAID database. You can optionally generate a new CaseID value so that the exported data appears as a new case within the CAID database.
XML	This option exports all evidence you selected to an .xml file. You can choose to include external files. For more information about the structure of the .xml file, log in to the Customer Portal to review the Sample XML output article. Use this export type to export chat threads, evidence that you want to use with another tool or script, and evidence that includes external files.

Items to include in your export

When you share evidence, you choose which evidence items you want to include. Depending on the export type that you've chosen, different options will be available.

Option	Description
Use a template	Templates help to streamline the exporting process by predetermining the export's artifact types, columns, and format options. For more information about creating templates, see Creating and managing templates.
All evidence	Export all of the applicable evidence items the case.
Items in the current view	Export all of the applicable evidence items currently visible in Evidence. The items that AXIOM Examine displays depend on which artifacts you select and the filters that you apply. For example, you can select a specific artifact (such as Skype Messages) and apply a date filter to include only the messages in the last six months.
Tagged items	Export only the items you tagged. You can select all tagged items in the case, or only items that you have applied specific tags to.
Selected items only	Export only the items you selected in Evidence.
Graded media items	For VICS 1.3 and VICS 2.0 export types, export the graded media metadata and attachments in the case. You can choose to export attachments for reviewer graded items only. If you enabled a pre-set media categorization profile for Canada (Project VIC), the United States (Project VIC), or the United Kingdom (CAID), the following categories are included in the export by default: Canada (Project VIC): Category 1 International (Project VIC): Categories 1-2 United Kingdom (CAID): All categories except 8 United States (Project VIC): Categories 1-3
Summary information to include	For HTML and PDF reports, you can include summary information from the case dashboard in your report. Depending on the evidence available in your case, you can choose to include information such as a case overview, evidence overview, media categorization summary, and keyword matches.

Configure artifact details

Under Configure artifact details, certain export types allow you to select or deselect various options about what information you want to include in your export.

Detail	Description
Include previews and file attachments	For HTML exports, if email or other messaging artifacts are exported, attachments will be listed with the message in the report itself, and will be exported in a separate folder. You can optionally blur previews for sensitive items in your export . Blurring and blocking is based on the existing media categorization in your case. If you extracted text from files using OCR in your case, a .txt file that includes the extracted text is included in the resources folder.
Include embedded picture previews	For PDF and Excel export types, you can embed media items directly in the report. If your case includes categorized media, you can optionally blur previews or remove previews completely for contraband media in specific media categories in your report. The available media categorization options are based on the existing media categorizations in your case. By default, all illegal categories are selected. If you choose to remove previews completely, your report will dipslay a picture crossed out.
Include source files in the attachments folder	For PDF, CSV, Excel, and XML export types, export the source files in your case to the attachments folder. If your case includes categorized media, you can optionally remove attachments for contraband media for specific media categories in PDF and Excel exports. The available media categorization options are based on the existing media categorizations in your case. By default, all illegal categories are selected. If you choose to remove attachments for contraband media, the attachments folder in your export will not include the selected categories. If you extracted text from files using OCR in your case, a .txt file that includes the extracted text is included in the resources folder.
Include chat thread reports as PDF or HTML	If you export messages that are available in conversation view, your export will include these threaded conversations in addition to the report with the metadata you've chosen to include.
Make external links clickable	If any of the artifact data in your export includes external links, you'll be able to click on them and view the external web page.

Configure columns to include

Under Configure columns to include, certain export types allow you to choose which columns you want to include in your export.

Option	Description
All columns	Include all columns from your case in your export.
Visible columns and column sorting from current view	If you're using the Column view in the Artifacts explorer, you can maintain the customizations that you make to the Column view in your export. For example, if you sort, reorder, or hide columns under Evidence, your export does the same.
Specific columns only (advanced)	You can include specific columns in your export using column configurations. Column configurations help to streamline the exporting process by predetermining which columns will be displayed in applicable reports. When you create an export, you can save the column configuration settings for use in future exports. When you manage your column configurations, for each artifact, you can include or exclude specific columns, reorder columns using drag-and-drop, and configure the sort order for up to three column names (primary, secondary, or tertiary).

Option

Description

All columns

Include all columns from your case in your export.

Visible columns and column sorting from current view

If you're using the Column view in the Artifacts explorer, you can maintain the customizations that you make to the Column view in your export. For example, if you sort, reorder, or hide columns under Evidence, your export does the same.

Specific columns only (advanced)

You can include specific columns in your export using column configurations. Column configurations help to streamline the exporting process by predetermining which columns will be displayed in applicable reports. When you create an export, you can save the column configuration settings for use in future exports.

When you manage your column configurations, for each artifact, you can include or exclude specific columns, reorder columns using drag-and-drop, and configure the sort order for up to three column names (primary, secondary, or tertiary).

Format options

Export type	Format options
PDF	Generate either a single export file or create separate files: Create one export file with all artifact types: AXIOM Examinegenerates one PDF report (a single .pdf file) that contains all selected artifacts including all of the fragments for each hit. Create a separate export file for each artifact type: AXIOM Examine generates multiple .pdf files for each artifact type.
Excel	Generate either separate Excel workbooks or one Excel workbook with multiple worksheets: Create separate Excel workbooks for each artifact type: AXIOM Examine generates separate workbooks (multiple .xlsx files) for each artifact type. Create one Excel workbook that includes worksheets for each artifact type: AXIOM Examine generates one Excel workbook (a single .xlsx file) that includes a worksheet for each artifact type.
Magnet REVIEW	Select whether you want to use the REVIEW 2.0 or REVIEW 1.0 export version.
Load Files	Customize how you want the native files and text files for each artifact to be named. You can add a prefix, set the numerical starting value, and specify the number of digits used in the file names.
VICS	Select whether you want to use the VICS 2.0 or VICS 1.3 export version. Select whether you want to generate a new CaseID value so that the exported data appears as a new case within the CAID database.