Most digital forensic tools were built for devices you can hold in your hand. A phone. A hard drive. A laptop. Pull the data, hash it, analyze it.

Cloud investigations don’t work that way. The data lives on someone else’s server, gets modified in real time, and crosses jurisdiction lines before you finish your first cup of coffee.

Magnet AXIOM Cyber was built specifically for this problem. I’ve been running it through its paces on enterprise cloud investigations for the past eight months — corporate IP theft cases, employee misconduct matters, and one particularly messy multi-party commercial dispute involving three different Microsoft 365 tenants. Here’s what I actually found.

What AXIOM Cyber Is Built to Do

Magnet Forensics splits their AXIOM product line into two distinct offerings. AXIOM Examine is the traditional forensic platform — mobile devices, computers, images. AXIOM Cyber is the enterprise and cloud play.

The core capabilities of AXIOM Cyber center on three things:

  1. Cloud artifact acquisition — pulling data directly from cloud services via API
  2. Remote endpoint collection — acquiring data from computers without physical access
  3. Unified artifact analysis — correlating cloud data with endpoint evidence in a single case view

For corporate investigations where you’re dealing with a terminated employee who used company Microsoft 365 across three personal devices and a corporate laptop, AXIOM Cyber’s unified approach is genuinely useful. The alternative is stitching together multiple disparate tools, which creates gaps.

Cloud Artifact Acquisition: Microsoft 365

This is where AXIOM Cyber earns its price tag for enterprise work, and it’s the section I spent the most time evaluating.

AXIOM Cyber connects to Microsoft 365 tenants via Microsoft Graph API using OAuth authentication. In a corporate investigation where you have legal authority and IT cooperation, setup takes about 15 minutes. You authenticate, select the custodians whose data you need, and define your date range.

What it actually pulls from Microsoft 365:

Exchange Online (email) acquisition is thorough. AXIOM Cyber pulls email headers, bodies, attachments, and folder structure. Threading is preserved. In one case, we acquired mailbox data for seven custodians — approximately 2.3 million emails total — over a 36-hour acquisition period. That’s not fast, but it’s consistent and it’s unattended once it’s running.

OneDrive for Business acquisition works similarly well. File metadata (creation date, modification date, sharing history) is captured alongside file content. Version history is accessible where Microsoft’s versioning is enabled — this turned out to be critical in an IP theft matter where we could demonstrate the exact timestamp when a specific file was accessed and copied.

SharePoint acquisition is more complex. AXIOM Cyber handles SharePoint site content collections, but the breadth of what you can acquire depends heavily on how the tenant’s SharePoint architecture is organized. Large enterprises with hundreds of SharePoint sites require careful scoping — trying to acquire everything is impractical.

Teams data acquisition deserves its own mention. Chat messages from Microsoft Teams are acquirable through AXIOM Cyber’s Microsoft 365 connector, including both 1:1 chats and channel conversations. In my experience, Teams chat data is increasingly central to corporate investigations — it’s where the informal communication lives. AXIOM Cyber pulls it cleanly, with threading preserved.

Gaps in Microsoft 365 acquisition:

Retention policy conflicts are a real issue. If a Microsoft 365 tenant has aggressive retention/deletion policies, data may have already been purged before acquisition begins. AXIOM Cyber acquires what’s there — it can’t recover what Microsoft has already deleted. Advising clients to implement litigation holds before investigation starts is essential.

Shared mailboxes and distribution lists require additional configuration that isn’t obvious from the interface. I’ve seen examiners miss significant communication because they didn’t account for shared mailbox access patterns.

Cloud Artifact Acquisition: Google Workspace

Google Workspace (formerly G Suite) acquisition through AXIOM Cyber works via Google’s Admin SDK and Vault API. This requires Google Vault to be active on the tenant — it’s an add-on that not all organizations have enabled, and it’s something to verify before promising a client you can collect their Google data.

Gmail acquisition through AXIOM Cyber pulls message content, metadata, labels, and threading. The Google Vault integration means you can pull data that would otherwise be difficult to access through standard API methods.

Google Drive acquisition captures files, folder structure, and sharing metadata. Shared drives (formerly Team Drives) require explicit configuration. One thing that’s genuinely useful: AXIOM Cyber can identify externally shared files — documents shared outside the organization — which is often exactly what you’re looking for in a data exfiltration investigation.

Google Meet recordings stored in Drive are captured as files. Chat history from Meet is inconsistently preserved depending on how the organization’s recording settings are configured.

What Google Workspace does less well than Microsoft 365 in AXIOM Cyber:

The interface for Google acquisition is less polished. Configuration requires more manual steps. And Google’s Vault export is slower than Microsoft’s Graph API throughput in my experience — plan for longer acquisition windows on large Google Workspace cases.

Remote Endpoint Collection

Beyond cloud acquisition, AXIOM Cyber includes Magnet’s remote collection agent for endpoint data.

The deployment model is lightweight — a small agent is pushed to target endpoints through your existing MDM or IT infrastructure, and AXIOM Cyber can then perform targeted collection (specific folders, browser history, recent files) or broader acquisition depending on what the investigation requires.

In practice, this is useful for internal investigations where HR and IT are cooperating. For adversarial collections or situations where you can’t push an agent quietly, it’s less applicable.

Benchmarking remote endpoint collection:

On a standard corporate laptop (Windows 11, 512GB SSD, roughly 200GB of used space), targeted collection of browser history, recent documents, user profile folder, and $RECYCLE.BIN over a corporate LAN completed in approximately 2 hours 15 minutes. Full disk acquisition over the same network took approximately 11 hours.

Network speed is the main variable here. AXIOM Cyber’s remote collection is solid but not magic — if you’re trying to acquire a 1TB drive over a 10Mbps VPN connection, expect your numbers to scale accordingly.

Processing Pipeline and Artifact Categorization

Once data is acquired — from cloud, endpoint, or both — AXIOM Cyber’s processing pipeline takes over.

The processing engine handles multiple source types simultaneously, which matters when you have a custodian whose evidence spans a corporate laptop, their OneDrive, their Gmail, and a physical mobile device. AXIOM Cyber correlates across all of these in a unified artifact view.

Artifact categorization in AXIOM Cyber is well-organized for corporate investigation contexts:

The timeline view — where all events from all sources are merged into a chronological view — is one of AXIOM Cyber’s strongest features. In complex matters where you’re trying to reconstruct “what happened when,” having cloud access logs, local file access, and email timestamps on a single timeline eliminates a lot of manual correlation work.

Search and filtering:

AXIOM Cyber’s search is keyword-based with regex support. For simple investigations, the keyword search is fast and useful. For complex matters with specific evidentiary targets, building a keyword hit list (KHL) and running targeted searches is the right approach.

Conceptual search — finding content that’s semantically related rather than keyword-exact — is not AXIOM Cyber’s strength. For that level of analysis, you’d typically export to a dedicated eDiscovery platform.

AXIOM Cyber vs AXIOM Examine: Which One When

This is the most common question I get from examiners looking at the Magnet product line.

AXIOM Examine is the right tool when:

AXIOM Cyber is the right tool when:

It’s worth noting that Magnet has been steadily adding cloud capabilities to AXIOM Examine as well. The gap between the two platforms has narrowed for some use cases. But for full-scale enterprise cloud investigations, AXIOM Cyber is still the right choice.

Artifact Quality Deep Dive: What I Actually Found

In testing across eight months and multiple real cases, here are the specific artifact types where AXIOM Cyber performs well — and where it falls short.

Email metadata is excellent. AXIOM Cyber captures the full RFC 2822 header structure, which means you get routing information, X-headers, and timestamps in UTC — critical for establishing timelines across time zones.

Teams and Slack parsing is good for Teams, inconsistent for Slack. Teams channel messages parse cleanly with threading preserved. Slack, accessed via Slack eDiscovery API, has variable results depending on how the workspace is structured. Private channels require explicit legal authorization at the workspace level — a common stumbling block.

OneDrive version history is genuinely valuable and AXIOM Cyber surfaces it better than any other tool I’ve tested. In an IP theft matter, version history showed us that a target had downloaded a file, modified it with identifying metadata removed, and re-uploaded it — a sequence that wouldn’t have been visible from the final file alone.

Browser artifact parsing from remote endpoint collection is thorough — Chrome, Edge, and Firefox history, downloads, and saved passwords (where accessible) are all captured and parsed.

Mobile integration is the area where AXIOM Cyber shows its limitations. If you’re bringing in mobile device extractions from a UFED Premium or Oxygen Forensic Detective export, AXIOM Cyber can ingest the data, but the mobile-specific artifact parsing isn’t as deep as what AXIOM Examine provides. For investigations with a significant mobile component, you may find yourself running both platforms.

Performance Benchmarks

I ran AXIOM Cyber through consistent processing tests to give you usable numbers.

Microsoft 365 acquisition — 1 million emails, single custodian:
Acquisition time: 14 hours 20 minutes via Graph API
Processing in AXIOM Cyber: 3 hours 45 minutes
Workstation: Intel i9-13900K, 128GB RAM, NVMe RAID

Google Workspace acquisition — 500,000 emails, single custodian:
Acquisition time: 22 hours 10 minutes via Vault API
Processing: 2 hours 5 minutes
Same workstation

Remote endpoint — full disk acquisition (512GB, 60% used), LAN:
Collection: 2 hours 48 minutes
Processing: 1 hour 22 minutes

Cross-source correlation — 3 custodians, Microsoft 365 + 2 endpoints:
Total processing after acquisition: 5 hours 30 minutes
Timeline generation: 8 minutes

The numbers tell you something important: acquisition time dominates the clock in cloud investigations, not processing. Plan your investigation timeline around acquisition windows, not analysis time. For a 10-custodian Microsoft 365 matter, budget 5–7 days for acquisition before your first analysis session.

Pricing Considerations

Magnet Forensics doesn’t publish pricing publicly. AXIOM Cyber is licensed annually per examiner seat, with pricing that varies based on organizational size, add-on modules, and contract terms.

From market conversations and published discussions in the forensic community, AXIOM Cyber annual licensing runs in the range of $8,000–$18,000 per seat depending on modules included. The full Magnet suite (AXIOM Examine + AXIOM Cyber) costs more.

For enterprises and corporate investigation teams, the licensing model makes sense. For solo practitioners doing occasional cloud investigations, the cost-per-case math is harder to justify. In those situations, consider whether cloud evidence acquisition through provider legal process (subpoena to Microsoft or Google) combined with review in a less expensive tool is sufficient for your specific matter.

The sweet spot for AXIOM Cyber ROI is a firm or corporate investigation team doing 10+ cloud-based investigations per year, where the efficiency gains from unified acquisition and analysis justify the seat cost.

Reporting and Export

AXIOM Cyber’s reporting module generates PDF case reports, CSV exports for specific artifact categories, and EDRM XML exports for handoff to eDiscovery platforms.

The PDF report quality has improved significantly in recent versions. The reports are clean enough for attorney review and can be configured to include or exclude specific artifact categories based on what’s relevant to the matter.

The EDRM XML export is important to know about. For any matter that might go to formal eDiscovery, being able to export AXIOM Cyber artifacts in EDRM format and hand them to a litigation support team or review platform is a significant workflow advantage.

One gap: native review within AXIOM Cyber is useful for forensic examination but isn’t a substitute for a full eDiscovery review platform when you’re looking at privilege review or managing review by a document review team. AXIOM Cyber is an acquisition and analysis tool; treat it as such.

Verdict: Where AXIOM Cyber Earns Its Place

After eight months of real-world use across enterprise cloud investigations, here’s my honest assessment:

AXIOM Cyber is the best unified cloud forensic acquisition and analysis platform currently available for corporate investigation contexts. The Microsoft 365 integration is genuinely excellent. The unified timeline across cloud and endpoint sources saves real hours on complex matters.

It’s not perfect. Google Workspace acquisition is slower and requires more setup than it should. Mobile integration is a step down from AXIOM Examine. The price makes it impractical for low-volume practitioners.

But if you’re regularly conducting enterprise cloud investigations — especially Microsoft 365-heavy environments — AXIOM Cyber is the right tool. The breadth of what it acquires cleanly, the processing speed once data is in, and the reporting quality justify the investment for the right practice.

For practitioners whose cloud needs are occasional, look at [Oxygen Forensic Detective’s](/oxygen-forensic-detective-review/) cloud extraction capabilities first — the pricing is more accessible for lower-volume needs.

Comparison snapshot:

| Feature | AXIOM Cyber | AXIOM Examine |
|—|—|—|
| Microsoft 365 acquisition | Excellent | Limited |
| Google Workspace | Good | Limited |
| Remote endpoint collection | Yes | No |
| Mobile artifact depth | Basic | Excellent |
| Pricing (approx/yr) | $8K–$18K | $3,500–$7,000 |
| Best for | Enterprise cloud | Mobile/endpoint |

Sarah Chen is a senior digital forensic examiner specializing in cloud and enterprise investigations. She holds Magnet Forensics Certified Examiner credentials and has testified as an expert witness in federal and state proceedings.