Magnet IEF - Artifact-First Investigations

Digital forensics professionals around the world have relied on Magnet IEF to help them easily find, analyze, and report on digital evidence from computers, smartphones, and tablets.

Request A Free Trial

Magnet IEF Empowers Examiners

Magnet IEF can recover evidence from a variety of data sources, and integrate them into a single Magnet IEF case file for analysis and reporting.

Find

Hundreds of Artifacts

IEF parses hundreds of Artifacts from computer and mobile devices enabling you to quickly dive into the evidence that matters.
Carve Data from Fragmented Files

Recover evidence from unallocated space by carving data from fragmented files that aren’t sequential or are missing entirely.
Dynamic App Finder

Discover unknown applications or app features by identifying potential chat databases with Dynamic App Finder.
Regular Updates

Monthly updates ensure that IEF artifacts continue to recover evidence from new and updated applications.

Analyze

Find Important Evidence

Quickly drill down to the important evidence with artifact filters, keyword searches, timeline and picture analysis.
Easily Understand Results

Review evidence in a familiar format by threading chat history, viewing geo-location data on a map and by rebuilding webpages in their original layout.
One View for All Evidence

Consolidate all computers and mobile devices related to your investigation into a single case for an integrated view of the evidence.
Identify Relevant Photos

Refine and categorize picture results with skin tone filters, PhotoDNA, MD5 and SHA-1 hash values and Project VIC imports.

Report

Easy-To-Read Reports

IEF creates an easy-to-read and navigate HTML report from any artifacts selected within the Report Viewer. It lists all the artifacts along the left side, similar to how IEF Report Viewer is displayed.
Portable Case

With Portable Case, you can create a light copy of the IEF Case File and allow other investigators to collaboratively review the evidence.
IEF Timeline Keeps You Organized

Visualize digital evidence in an organized and chronological sequence. IEF Timeline helps you see overall patterns in a individual’s digital activity.
Export Multiple Formats

Export reports in a variety of formats including, PDF, Excel, CSV, XML and tab-delimited formats.

Discover Magnet AXIOM

Magnet AXIOM is fine-tuned to get the most relevant evidence from each source of data, whether it’s from smartphones, computers, or the cloud. Here are just a few of the things that make Magnet AXIOM the complete digital investigation platform.

Magnet Axiom

Performance

On average, AXIOM processes evidence 40% faster than IEF.

AXIOM is also up to 40 times faster than IEF when it comes to reviewing case data.
Mobile Acquisition

AXIOM has built-in acquisition capabilities for iOS and Android devices.

AXIOM can also bypass passwords to extract full physical images on thousands of Android devices.
Cloud Forensics

AXIOM Cloud recovers data from 50+ of the most forensically relevant social networks, cloud and email services.
Connections

Connections—in AXIOM—automatically visualizes the relationships between files, artifacts, users and devices.

Watch Magnet AXIOM With Connections
Magnet.AI

Magnet.AI searches pictures and flags potential nudity, weapons, CSAM, drugs, personal ID, money, buildings, vehicles, drones and screenshot images.

Magnet.AI also reviews chats and identifies potential child luring.
Memory Analysis

Examiners can analyze memory directly in AXIOM by selecting artifacts and running Volatility.
File System & Registry View

AXIOM’s file system explorer also allows examiners to browse the file structure of a given image.

With source linking, examiners can quickly validate their artifact findings and view the exact location in the file system or registry that the evidence was stored.
Passware

AXIOM is fully integrated with Passware, enabling examiners to decrypt computers with Bitlocker, TrueCrypt, PGP and McAfee encryption. * Passware is included at no extra cost.
GrayKey

AXIOM easily ingests GrayKey images and allows examiners to review evidence from locked iOS devices.

Due to the built-in PList, SQLite and File System viewers in AXIOM, examiners can review and analyze raw iOS data that isn’t viewable in IEF.