NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.Magnet Forensics
Magnet Axiom Cyber
Axiom Cyber is the Axiom variant for organisations rather than police. It adds remote collection from Windows, Mac and Linux endpoints, including machines that are off the corporate network. It can be hosted in AWS or Azure.
PlatformCommercialCurrent
Profile
- Manufacturer
- Magnet Forensics
- Category
- Computer forensics
- Product type
- Platform
- Platforms
- Not stated by the manufacturer
- Licensing
- Commercial
- Product status
- Current
- Educational level
- Advanced
- Last verified
- 2 November 2026
Current product, written Magnet Axiom Cyber on Magnet's page. The page names Mac, Windows and Linux only as collection targets and AWS and Azure only as hosting options; it does not name individual cloud evidence sources or the examiner's operating system.
What Magnet Axiom Cyber is
A corporate investigation rarely begins with a seized laptop on a bench. The device is in another city, the employee is still working and the evidence may be in a cloud service as much as on the disk. Magnet positions Axiom Cyber for that setting. Its page describes secure remote collections from Mac, Windows and Linux devices even when they are off the network. Analysis covers remote endpoints, cloud environments and mobile sources. The platform can run in the cloud, on premises or in a hybrid arrangement. Hosting on AWS or Azure is what makes collection from an off-network endpoint possible.
The analysis side is the same artefact-based engine as Axiom, so an examiner who knows one can work in the other. Magnet directs law enforcement to Axiom and places Axiom Cyber beside Magnet Nexus for remote collection at scale and Magnet One, which links its products through the cloud. For an Indian enterprise the legal side needs attention before the technical side: collection from an employee's device must rest on policy, consent or a lawful order. Personal data gathered along the way falls under the Digital Personal Data Protection Act, 2023.
Primary applications
Where it is used
- Internal investigations where the endpoint is remote and must stay in use
- Incident response evidence collection from compromised machines
- Collecting from cloud environments used by the organisation
- Producing forensically sound subsets of data for eDiscovery teams
- Hybrid deployments where some evidence must never leave the organisation's own servers
Who uses it
- Corporate security and incident response teams
- eDiscovery and legal operations teams in large organisations
- Consultancies that run investigations for enterprise clients
- Students of enterprise and cloud forensics
Capabilities and limits
Major capabilities
- Remote collection from Mac, Windows and Linux endpoints
- Collection from endpoints that are off the corporate network when hosted on AWS or Azure
- Analysis across remote endpoints, cloud environments and mobile sources
- Deployment in the cloud, on premises or in a hybrid model
- Same artefact analysis, Connections and Timeline approach as Magnet Axiom
- Works alongside Magnet Nexus for remote collection at scale and Magnet One for cloud linking
Technical limitations
- Remote collection needs an agent on the endpoint, so deployment and access rights have to be arranged in advance
- Named cloud services are not listed on the product page, so coverage of a specific service must be confirmed with Magnet
- Cloud hosting raises data residency and personal data questions that a company must settle before collection
- The page does not state the operating system the examiner's workstation runs, so the platform is left empty
- Collection without a proper legal basis is itself a liability, whatever the tool allows
Learning with DFRTI
Independent professional education covering the principles and workflows of Magnet Axiom Cyber. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- Magnet Axiom artefact analysis
- Enterprise networks, endpoint agents and cloud hosting basics
- Data protection law and employment policy as they apply to investigations
Disciplines
Related tools
- Magnet AxiomAxiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.Magnet Forensics
- OpenText Forensic (EnCase)EnCase Forensic, one of the oldest names in computer forensics, is now called OpenText Forensic (EnCase). OpenText says it is the same product, renamed to fit its cybersecurity portfolio.OpenText
- Exterro FTK Forensic ToolkitFTK is the Forensic Toolkit that AccessData built and Exterro has owned since late 2020. Today Exterro sells it as Exterro FTK in a standalone form and as FTK Central for teams, with FTK Imager alongside.Exterro
- Belkasoft X ForensicBelkasoft X is a single tool for computer, mobile, drone, vehicle and cloud evidence. Belkasoft sells X Forensic to government customers and X Corporate to businesses, both on a perpetual licence.Belkasoft
- VelociraptorVelociraptor puts a small agent on endpoints and lets an examiner ask them questions in a query language. A hunt sends the same question to every machine and the answers come back as tables.Rapid7
- KAPE (Kroll Artifact Parser and Extractor)KAPE copies the files an examiner needs from a Windows system or image in minutes and then runs other programs over them. It is the quickest route from a live machine to parsed artefacts.Kroll
Courses that cover this tool
NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.
MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.
NetworkNetwork & Cloud ForensicsNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.
LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.