MAGNET IEF automates the discovery of digital forensic evidence.

A single IEF search intelligently parses and carves for hundreds of different types of digital forensic artifacts found in allocated and unallocated space on computers, smartphones and tablets.


Why Digital Forensics Experts Choose IEF

<p><b>ONE SEARCH</b> to recover hundreds of types of artifacts</p>

ONE SEARCH to recover hundreds of types of artifacts

IEF searches for hundreds of different types of digital forensic artifacts at one time. IEF’s intelligent search technique recovers more data from more locations. IEF takes care of data processing so you can focus on the investigation.

<p><b>FIND MORE EVIDENCE</b> from deleted space</p>

FIND MORE EVIDENCE from deleted space

IEF recovers more artifacts from unallocated space by extracting data from fragmented files that are not sequential, out of order, or missing entirely. Advanced validation techniques on carved evidence ensure low false positive rates, and the most accurate and complete data.

<p><b>ALWAYS STAY CURRENT</b> with MAGNET IEF Artifact Updates</p>


Technology changes quickly, frequent artifact updates ensure IEF continues to recover evidence from new and updated applications. The team at Magnet Forensics dedicates tens of thousand of hours on artifact R&D every year.

Magnet AXIOM

Better Analysis and Reporting

Faster Processing and Image Acquisition

Smartphone and Computer Data in One Case File

Try it now

IEF is great for finding the artifacts that are left behind, but would take forever to search for and carve out individually.

It’s really easy to use; basically just set it and forget it. When the searching is done, all you have to do is review the results and choose what is relevant and what isn’t and then create your reports.

― State of Connecticut Judicial Branch, United States


Find Internet Artifacts:

Recover evidence from 265+ types of Internet Artifacts from Windows and Mac computers.

Browser Activity
Internet Explorer, Chrome, Safari, Firefox and others
Instant Messaging and Chat Apps
Applications like GoogleTalk and Skype
Social Netwoking
Applications like Facebook and Twitter
P2P File Sharing
Applications like Ares and Limewire
Web Search and Search Toolbars
Search engine activity from applications like Google and Bing
Media Files
Pictures and Video with EXIF data
Applications like Gmail and Hotmail/
Cloud Drivers
Applications like Dropbox and Flickr
Google Maps Queries and Tiles and Bing Maps Queries

Learn More

Data Sheet:

Internet Artifacts Module



Picture and Video Analysis with IEF

Watch Video


How to Uncover the Covered Tracks


Find Business Applications & OS Artifacts:

Recover evidence from 58 types of Business Applications & OS Artifacts from Windows and Mac computers.

Corporate Email
Artifacts like Outlook OST & PST files, mbox email archives
Corporate Instant Messaging
Artifacts including, and Microsoft Lync/OCS IM
Office application files including .doc, .docx, .xls, .xlsx, .ppt, .pptx., .txt, .pdf
Windows Operating Systems
Artifacts including user accounts, USB device history, lnk files, prefetch files, shellbags, jumplists, event logs and others

Do you need to take your examinations further?

Magnet AXIOM offers a full suite of examination tools. It speeds up image acquisition and processing and has powerful analysis tools for filtering and visualizing data quickly and intelligently.

Learn MoreFree Trial

Learn More

Data Sheet:

Business Applications & OS Artifacts Module



Business Apps & OS Artifacts

View Guide


Finding and Analyzing Document Files with IEF

Read Post

Live System Forensics:

The IEF Triage Module runs from a USB dongle and enables the forensic examination of live systems.

Conduct a quick on-scene search and pre-screen evidence to qualify computers for seizure and further examination.

• Supports Windows-powered computers
• ‘Quick Capture’ feature allows an investigator to capture RAM, live system artifacts, and run a quick search for evidence in a single step

Search Drivers
Capture Live RAM
Detect Disk Encryption
Identified active full disk encryption like Truecrypt, Bitlocker, PGP and more
Collect Volatile Data
Network connections, Running processes, Connected network shares, drives and remote connections, Network Interfaces, Logged on Users, Scheduled Tasks and Services

Learn More

Data Sheet:

IEF Triage Module



Recovering Live System Artifacts with IEF

Watch Video


Investigating Child Exploitation Cases

Watch Webinar

I just ran IEF against an Android dump and got 2x the number of records in the results than I was getting with my other mobile forensic tools...

Magnet Forensics’ first cell phone attempt is a grand slam out of the park.

― Cynthia, Federal Law Enforcement Agency, United States

Find Mobile Artifacts:

Recover 165+ types of Mobile Artifacts from iOS, Android and Windows Phone powered smartphones and tablets.

Native Mobile OS Applications
Including SMS, Contacts, Mapping, Email, Pictures and Video, Call Logs and Voicemail, Downloads, Caches and Notes.
Chat Applications
Application like WhatsApp, Kik Messenger Snapchat, and BBM
Social Networking
Applications like Facebook and Twitter
Cloud Storage
Applications like Dropbox
Dynamic App Finder
Dynamic App Finder searches for any potential mobile chat app databases on mobile images or file dumps, then identifies the app name, and maps the four key fields to interpret results from most chat apps: sender, receiver, date/time and message

Product Review:
Forensics Focus Review of the IEF Mobile Module

See Review

Learn More

Data Sheet:

Mobile Artifacts Module



Analyzing Windows Phone Artifacts with IEF

View Guide


Use IEF and Cellebrite to Find More Evidence on iOS Devices

Read Post