Magnet IEF - Artifact-First Investigations

Digital forensics professionals around the world have relied on Magnet IEF to help them easily find, analyze, and report on digital evidence from computers, smartphones, and tablets.

Request A Free Trial

Magnet IEF Empowers Examiners

Magnet IEF can recover evidence from a variety of data sources, and integrate them into a single Magnet IEF case file for analysis and reporting.

Find

Hundreds of Artifacts

IEF parses hundreds of Artifacts from computer and mobile devices enabling you to quickly dive into the evidence that matters.
Carve Data from Fragmented Files

Recover evidence from unallocated space by carving data from fragmented files that aren’t sequential or are missing entirely.
Dynamic App Finder

Discover unknown applications or app features by identifying potential chat databases with Dynamic App Finder.
Regular Updates

Monthly updates ensure that IEF artifacts continue to recover evidence from new and updated applications.

Analyze

Find Important Evidence

Quickly drill down to the important evidence with artifact filters, keyword searches, timeline and picture analysis.
Easily Understand Results

Review evidence in a familiar format by threading chat history, viewing geo-location data on a map and by rebuilding webpages in their original layout.
One View for All Evidence

Consolidate all computers and mobile devices related to your investigation into a single case for an integrated view of the evidence.
Identify Relevant Photos

Refine and categorize picture results with skin tone filters, PhotoDNA, MD5 and SHA-1 hash values and Project VIC imports.

Report

Easy-To-Read Reports

IEF creates an easy-to-read and navigate HTML report from any artifacts selected within the Report Viewer. It lists all the artifacts along the left side, similar to how IEF Report Viewer is displayed.
Portable Case

With Portable Case, you can create a light copy of the IEF Case File and allow other investigators to collaboratively review the evidence.
IEF Timeline Keeps You Organized

Visualize digital evidence in an organized and chronological sequence. IEF Timeline helps you see overall patterns in a individual’s digital activity.
Export Multiple Formats

Export reports in a variety of formats including, PDF, Excel, CSV, XML and tab-delimited formats.

Discover Magnet AXIOM

Magnet AXIOM is fine-tuned to get the most relevant evidence from each source of data, whether it’s from smartphones, computers, or the cloud. Here are just a few of the things that make Magnet AXIOM the complete digital investigation platform.

Magnet Axiom

Performance

When time is of the essence, use Magnet AXIOM. On average, AXIOM processes evidence 40% faster than IEF and is up to 40 times faster when it comes to reviewing case data. Searching is also significantly faster in AXIOM than it is in IEF.
Advanced Mac Support

Whereas IEF supports HFS+, AXIOM supports both HFS+ and APFS as well as decryption of FileVault 2 encrypted drives, volumes, and partitions. Discover more macOS artifacts with AXIOM such as FSEvents and Bash History.
Mobile Acquisition

AXIOM has built-in acquisition capabilities for iOS and Android devices. AXIOM is the only Magnet Forensics tool that has the most robust features to bypass passwords and to extract full physical images on thousands of Android devices.
Cloud Forensics

AXIOM has the most comprehensive support for cloud data. Acquire data from 50+ of the most forensically relevant social networks, cloud and email services. Analyze Facebook warrant returns, ingest user-requested archives from cloud services (Google and Facebook) and acquire publicly available information from Twitter.
Connections

Automatically visualize the relationships between files, artifacts, people, and devices using Connections.

Watch Magnet AXIOM With Connections
Timeline

AXIOM takes Timeline to the next level with the ability to build a timeline on all artifacts and file system data, categorize and filter Timeline events, and display unique row item for each date/time stamp.
Magnet.AI

Magnet.AI searches pictures and flags potential nudity, weapons, CSAM, extremist imagery, and more. Review chats and identify potential luring conversations.
GrayKey

Due to the built-in PList, SQLite, and file system viewers in AXIOM, examiners can review and analyze raw iOS data from GrayKey images that isn’t viewable in IEF.
Memory Analysis

Examiners can analyze memory by selecting artifacts and running Volatility that is directly integrated in AXIOM.