Magnet Response
Non-technical users helping collect data during cyber incident investigations
Capturing RAM and other volatile data before it is lost
Gathering Windows Event Logs, Registry Hives, Jumplist files, and related IR artifacts
USB-based field use with a simple single-executable workflow
Sending collected output into AXIOM or AXIOM Cyber for follow-on analysis
Magnet Response is a free tool designed to help investigators and non-technical users quickly collect and preserve critical data from local endpoints during incident response investigations. It is built for situations where relevant data may be modified or lost if it is not captured immediately.
Magnet says Response uses a pre-set collection profile to gather a broad set of incident-response data, including RAM, Windows Event Logs, Registry Hives, Jumplist files, and other relevant log files. It uses a guided two-step workflow, can run as a single executable from a USB key, supports keyword-based collection and file-size limits, and saves results as a consolidated .zip file with an embedded hash value.
Response is strongest when the need is fast local endpoint preservation, especially by users who are not deep forensic examiners. It is not a full examination suite; it is a focused collection tool that feeds later analysis.