Magnet AXIOM 4.6 Mac & iOS Artifact Updates

With Magnet AXIOM 4.6, we’ve updated and added a whole slew of new Mac and iOS artifacts for examiners to use in their investigations.

In this blog, we’ll review some of these new artifacts like the Rebuilt Desktop for macOS and artifacts now to support Google Docs, Drive, Sheets, and Slides for iOS. With the impeding release of macOS 11 (Big Sur) we’ve been hard at work validating and testing AXIOM and AXIOM Cyber and they are ready to go!

Magnet AXIOM 4.6 and Magnet AXIOM Cyber 4.6 are now available — upgrade today in-product or over at the Customer Portal.

Rebuilt Desktop for macOS

Initially launched in AXIOM 3.9 for Windows, the new Rebuilt Desktop for Mac artifact provides examiners with an approximation of what a user’s desktop resembled without the need to virtualize the endpoint.

Many examiners as a part of court prep are asked to provide exhibits to help provide clear understanding to the evidence for non-technical stakeholders. Instead of spending the time virtualizing the environment, as a part of processing with AXIOM and AXIOM Cyber we’ll automatically provide a glimpse as to what the user’s desktop looked like as you can see below. Make sure to check out Chris Vance’s blog on the Rebuilt Desktop for macOS here.

Google Apps for iOS

Productivity apps such as Google Slides, Sheets, Docs, and Drive have been gaining popularity as an alternative to Microsoft Office for many individuals and organizations alike. In AXIOM 4.6 we support parsing evidence from several Google productivity apps for iOS. These apps include Google Docs, Drive, Slides, and Sheets. This can be extremely useful in cases such as insider threat where an individual is opening Microsoft Word on their iOS device, copying text from potentially a highly sensitive document (HSD) then pasting that information in a personal Google Docs text file saved on their Google Drive.

Big Sur

The Magnet team has diligently tested both the acquisition and analysis of beta versions of Big Sur set to release this fall from Apple. AXIOM Cyber’s remote acquisition capabilities throughout testing of macOS 11 have connected time and time again to endpoints running the Big Sur betas without any issue, and easily collected evidence for investigations. AXIOM and AXIOM Cyber also parse macOS 11 forensic images with no problem, so come launch day AXIOM is ready to support your Mac investigations!

Additional Updates

Additional updates to many macOS and iOS artifacts included in the AXIOM and AXIOM 4.6 release are:

• Photo Media Information (macOS & iOS)
• Mac Mail (macOS)
• Calendar Events (macOS)
• Duck Duck Go (iOS)
• Ecosia (iOS)
• Twitter Users (iOS) Signal (iOS)
• Application Permissions (iOS 14)
• iMessage (iOS 14)
• iMaps (iOS 14)
• PowerLog (iOS)
• Lyft (iOS)
• Google Photo Albums (iOS)
• Google Calendar Reminders (iOS)
• Facebook Messenger-Audio & Visual Messages (iOS)

Learn more about what’s new in Magnet AXIOM 4.6, and be sure to try out the new updates today!