Magnet Forensics updates mobile hardware and launches Graykey Fastrak

Mobile device acquisition remains one of the sharpest bottlenecks in UK investigations and civil proceedings. When an urgent court order is served or an internal investigation lands, forensic teams often face a physical queue of smartphones waiting for extraction. Because physical and full file system extractions have traditionally tied up specialised hardware sequentially, delays at the collection stage can ripple through the entire disclosure timetable.

Magnet Forensics has introduced two developments aimed directly at laboratory throughput: Graykey Fastrak and Magnet Graykey 2. These releases highlight a clear shift among forensic technology vendors towards addressing scale and physical lab capacity, at a time when data volumes and device counts continue to strain investigators across both criminal and commercial disciplines.

Parallel mobile extractions with Graykey Fastrak

Magnet Forensics announced that Graykey Fastrak enables multiple extractions to run simultaneously. The company stated that the tool is designed to help agencies reduce backlogs and accelerate evidence collection when time is critical. While the vendor has not released public technical documentation detailing device limits or system prerequisites, the core functional change is the departure from strictly serial extraction workflows.

In standard forensic practice, acquiring a modern smartphone often involves long waiting periods while passcode bypass routines execute, followed by multi-hour extraction passes over physical cables. When an investigation requires forensic images from multiple custodians, such as a company board or a group of employees subject to an urgent preservation notice, technicians have traditionally had to process devices one after another. Enabling concurrent extractions on a single deployment removes a major hardware constraint, allowing forensic practitioners to turn physical exhibits around much faster.

Hardware upgrades and growing intake volumes

Alongside the Fastrak release, Magnet Forensics confirmed that Magnet Graykey 2, the next generation of its mobile hardware unit, is now available. The vendor stated that the new hardware is designed to help digital forensic laboratories expand mobile access capacity and deliver critical evidence to investigators faster. The specific physical specifications and internal architectural changes of the Graykey 2 unit have not been detailed in the announcement, but the focus remains squarely on physical lab intake and processing capability.

This pressure on laboratory capacity is evident across the forensic sector. In a concurrent announcement regarding child protection workflows, Cellebrite stated that the volume of Child Sexual Abuse Material (CSAM) reaching law enforcement is at a historic high and continues to grow. Cellebrite reported that online platforms, encrypted services and dark web infrastructure have enabled the production and storage of illicit material at an unprecedented scale. To address this influx, Cellebrite pointed to the adoption of automated triage systems to assist investigators.

Taken together, the updates from Magnet Forensics and Cellebrite reflect how forensic vendors are responding to pressure points at opposite ends of the investigative pipeline. Magnet Forensics is targeting the initial hardware acquisition barrier, while Cellebrite is focusing on processing and triaging high volumes of illicit data once inside the analysis environment.

What this means in practice

For UK litigators, compliance officers and forensic practitioners, hardware and extraction improvements alter how evidence collection should be budgeted and managed under the Civil Procedure Rules.

Reassessing disclosure timetables under Practice Direction 57AD

In English commercial litigation operating under Practice Direction 57AD, parties must agree realistic timetables for the collection, review and production of digital evidence. When mobile devices are in scope, practitioners frequently build substantial contingency periods into the schedule to account for lab bottlenecks. If simultaneous extractions through Graykey Fastrak reduce device turnaround times, forensic teams can provide litigators with tighter, more predictable collection windows, reducing the need to request deadline extensions from the court.

Handling multi-device collections in internal investigations

Internal corporate investigations frequently require the sudden acquisition of several company-issued and personal devices. The primary operational risk in these exercises is business disruption. Custodians are reluctant to surrender their primary communication tools for several days. If a forensic team can connect multiple handsets and extract data concurrently rather than consecutively, custodians can often have their devices returned within hours. This increases compliance with collection requests and minimises operational downtime.

Maintaining strict forensic logging during parallel processing

Running concurrent extractions introduces potential risks to administrative rigor if laboratory protocols are not updated. Practitioners should ensure that:

• Individual device logs, connection times and chain of custody documentation remain entirely segregated for each exhibit.
• Destination storage media and drive paths are clearly partitioned to prevent concurrent read and write operations from creating I/O contention or cross-custodian data contamination.
• Passcode derivation and acquisition completion timestamps are independently validated and recorded against each distinct physical device.

Defensibility and verification

Accelerating extraction speed does not change the evidential thresholds required in UK courts. Whether evidence is intended for a Crown Court trial or an application in the High Court, the methods used to bypass security controls and extract physical storage must remain transparent and reproducible.

Practitioners adopting Graykey Fastrak or Graykey 2 must verify that concurrent extractions yield identical hash values to standard serial acquisitions on the same device profiles. Documenting that simultaneous operations do not introduce dropped packets, truncated files or corrupted system partitions ensures that the resulting digital disclosure withstands scrutiny during expert cross-examination.