StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.Magnet Forensics
Magnet Axiom
Axiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.
PlatformCommercialCurrent
Profile
- Manufacturer
- Magnet Forensics
- Category
- Computer forensics
- Product type
- Platform
- Platforms
- Not stated by the manufacturer
- Licensing
- Commercial
- Product status
- Current
- Educational level
- Intermediate
- Last verified
- 2 November 2026
Magnet's page writes the name Magnet Axiom rather than AXIOM in capitals, which is followed here. The older component names Axiom Process and Axiom Examine do not appear on the page. No operating system is stated.
What Magnet Axiom is
Most investigations today involve more than one kind of device. A laptop image, two phone extractions and a cloud return all belong to the same person and the same week. Axiom is built around that reality. Magnet describes it as a tool to recover, analyse and report on data from mobile, computer, cloud and vehicle sources, all inside one case, with what the company calls artefact coverage as its strength. An artefact in this sense is a parsed, named piece of evidence, for example a browser download record or a chat message, rather than a raw file. The examiner works through categories of artefacts, filters them, follows a Connections view that links related items and reads a Timeline that puts events from all sources in order.
The current page talks about AI-powered analysis and links to a separate Magnet AI area without describing it in detail. It also says Magnet One, the company's cloud link between its products, is included with Axiom and that an Axiom Premier licence bundles Griffeye Advanced for large media sets. What a learner should hold on to is the division of labour. Axiom parses, categorises and connects. The examiner decides what a parsed record means, checks the source bytes when it matters and writes the explanation that will be tested in court.
Primary applications
Where it is used
- Examining a computer image and a phone extraction in the same case
- Reviewing cloud returns alongside device evidence
- Vehicle infotainment data brought in with other sources
- Building a cross-source timeline of a person's activity
- Producing reports that an investigator or counsel can read without the tool
Who uses it
- Police and agency digital forensic examiners
- Private laboratories handling mixed device cases
- Corporate investigators working with consent or authority
- Students learning artefact-based analysis
Capabilities and limits
Major capabilities
- Recovery, analysis and reporting across mobile, computer, cloud and vehicle sources
- Artefact-based presentation of evidence with category filters
- Connections view linking related items across sources
- Timeline across all evidence in a case
- AI-powered analysis features, as named on the product page
- Magnet One included with Axiom; Griffeye Advanced included with an Axiom Premier licence
- Free trial offered by Magnet
Technical limitations
- An artefact parser can miss an app version or format it has not seen; key records need manual verification
- AI-assisted features point to possibilities and do not establish facts
- The product page does not state the operating system, so the platform is left empty here
- Device access for locked phones is not part of Axiom; that needs a separate capability such as Graykey
- Large multi-source cases need a strong workstation and disciplined case management
Learning with DFRTI
Independent professional education covering the principles and workflows of Magnet Axiom. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- File systems, operating system artefacts and mobile app storage basics
- What an image or extraction contains and how it was verified
- Separating a tool's parsed output from the examiner's interpretation
Disciplines
Related tools
- Magnet Axiom CyberAxiom Cyber is the Axiom variant for organisations rather than police. It adds remote collection from Windows, Mac and Linux endpoints, including machines that are off the corporate network. It can be hosted in AWS or Azure.Magnet Forensics
- Magnet GraykeyGraykey is Magnet Forensics' device access product for locked iOS and Android handsets. Magnet sells it only to public safety agencies in selected countries and vets every enquiry through an agency email address.Magnet Forensics
- Magnet ACQUIREMagnet ACQUIRE was Magnet Forensics' free acquisition tool for Android and iOS devices, later extended to computers. It no longer appears on Magnet's product or free tools pages. Its acquisition engine now lives inside Magnet Axiom.Magnet Forensics
- OpenText Forensic (EnCase)EnCase Forensic, one of the oldest names in computer forensics, is now called OpenText Forensic (EnCase). OpenText says it is the same product, renamed to fit its cybersecurity portfolio.OpenText
- Exterro FTK Forensic ToolkitFTK is the Forensic Toolkit that AccessData built and Exterro has owned since late 2020. Today Exterro sells it as Exterro FTK in a standalone form and as FTK Central for teams, with FTK Imager alongside.Exterro
- X-Ways ForensicsX-Ways Forensics is the German examination tool that runs light, starts fast and gives the examiner the raw disk alongside the parsed view. Version 21.9 was current when this page was checked.X-Ways Software Technology AG
- Belkasoft X ForensicBelkasoft X is a single tool for computer, mobile, drone, vehicle and cloud evidence. Belkasoft sells X Forensic to government customers and X Corporate to businesses, both on a perpetual licence.Belkasoft
- AutopsyAutopsy is a free, open source examination platform that puts a graphical interface and ingest modules on top of The Sleuth Kit. For a student it is the first tool that shows a whole case from image to report at no cost.Sleuth Kit Labs
Courses that cover this tool
StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.
MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reports
MobileMobile & IoT ForensicsiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone cases
NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.
LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.Official source
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.