Counsel asks us some version of this every few weeks: "We have a forensic image containing email files, and we need every message that hits on this keyword list. Can you pull them out for us to review?"
We worked a case along exactly those lines recently. A keyword list of several dozen terms, an AD1 image containing email data, and a legal team that needed a clean, reviewable export at the end of it. What follows is what we got out of Magnet AXIOM on that task, and the point at which a different tool became the better call.
The setup
The starting point was a forensic image in AD1 format holding the email files we needed to search. In principle the workflow is straightforward: load the image into AXIOM, apply the keyword list and a date range, export the matching emails.
We loaded the keyword list as a plain text file with one term per line and constrained the search to the relevant date window. AXIOM ran it across the parsed email artifacts in the image and surfaced the matching items.
Comparing the export formats
AXIOM offers several export formats, and for a deliverable that a legal team has to actually work in, the choice matters more than you would expect.
HTML export was the clear winner for legal review. The output is organized into a navigable structure, the full email body renders correctly, embedded images and inline content display properly, attachments are linked and open directly, and there is a link back to the original message in Outlook for context. For a reviewer scanning hundreds of hits, nothing else came close.
Magnet's native format (.mfdb, internally JSON) is built for programmatic consumption and for ingestion back into AXIOM, not for human reading. The structured data is all there. A lawyer trying to review emails out of a raw JSON dump is going to have a bad day.
PDF export sounds appealing and disappoints in practice. Attachments do not carry over cleanly, the email body sometimes renders with raw HTML strings mixed into the visible text, and threading and formatting get lost badly enough that reviewers start second-guessing what they are looking at.
Excel export is tidy at the row-and-column level but strips out the things that matter most for review. You lose the body content and the links to attachments. It works as an index or a hit-list summary. It does not work as the deliverable.
After working through all four we standardized on HTML for review-grade exports and wrote up the steps internally so the workflow repeats cleanly on the next matter.
The accuracy problem
Here is the harder lesson from this case. AXIOM's keyword search produced both false positives and false negatives, enough of each that we were not comfortable handing over the result as a complete picture of the data.
False positives come with any keyword search. Hits in email signatures, headers, quoted footers from prior threads, incidental matches inside attachment metadata or encoded payloads. Reviewers can filter those out with attention, but it costs time.
False negatives are the dangerous half. Modern email containers, PST files especially, store body content in UTF-16 LE encoding, while a default keyword search against unparsed content does ASCII matching unless you configure it otherwise. A keyword that should match plainly readable text can silently miss most of a document because the underlying bytes are encoded differently than the search assumes. Add keywords split across line wraps in HTML email bodies, hits buried in attachments that were not fully parsed, and Unicode normalization differences like smart quotes versus straight quotes, ligatures and accented characters, and the accuracy ceiling turns into a real problem.
We tried a few mitigations during the case, including running the search against all content rather than only parsed artifacts, and re-running with the keyword list applied at different stages of case creation. The ceiling stayed in roughly the same range.
Where the line falls
AXIOM is an excellent forensic investigation tool. For timeline analysis, deleted item recovery, artifact carving and general case investigation, it is hard to beat.
For large-scale keyword discovery across email data, though, meaning the specific task of "here is a list of several dozen terms, find every hit in this mailbox", the better answer is increasingly to hand the PST file to counsel and let them ingest it directly into a dedicated e-discovery platform like Relativity.
Relativity is purpose-built for that workflow. Its search engine handles encoding properly, its review interface is designed for legal teams to tag, redact and code documents at scale, and its keyword search results carry the kind of defensibility that survives a discovery dispute. That is what counsel asked for in the end on this matter, and on similar ones we would recommend the same approach from day one.
When AXIOM is still the right call
None of which amounts to "don't use AXIOM for emails." AXIOM still shines when the question is forensic rather than discovery. When was this email deleted, what attachments did it have, was it ever forwarded, what does the device's messaging timeline look like overall. It shines again when you need to correlate email evidence with other artifacts on the same device, like chat messages, browser history or file system activity, because its integrated case view is hard to replicate anywhere else. For small datasets where careful manual review of an HTML export is realistic, AXIOM is also still the cleanest path.
The line we draw now is AXIOM for investigation, Relativity for review. Working out which side of it a given matter sits on is most of the job.
Case details have been generalized to protect client confidentiality. Published with client consent.
Working an e-discovery matter and unsure where the line falls? Our Email & eDiscovery team handles both sides — open a case for a privileged consult.