• Cloud iCloud Keychain | Cloud: Added parsing support for iCloud Keychain. NEW
• Microsoft Sticky Notes | Computer: Added parsing support for Microsoft Sticky Notes. NEW
• Linux Faillogs | Linux: Added parsing support for faillog files. NEW
• Snapchat - Snapchat Segmented Videos | iOS/Android: Added parsing support for Snapchat Segmented Videos. NEW
• Biome WiFi Connections | iOS: Added parsing support for Wi-Fi network connections made by the device.
• Google Timeline Events | Android: Added parsing support for information about visited locations.

• Pictures | Computer: Updated parsing support for Pictures in the thumbs.db. NEW
• Custom Artifacts | Updated to attempt automatic routing by associating date/time values with each Latitude/Longitude fragment pair. NEW
• Chrome Sync Data | Computer: Updated parsing of Device and Session data from the levelDB file. NEW
• Instagram Direct Messages | Android: Updated to retrieve sender/recipient information for both Instagram Direct Messages & Instagram Group Members. NEW
• Microsoft Teams - Direct Messages, Meeting Messages, Activity, Topic Messages | Computer: Updated parsing support. NEW
• Facebook Messenger End-to-End Encrypted Chats | iOS, Android: Updated to correct missing or incorrect Sender/Recipient values.
• Hangul Word Processor | Computer: Updated carving to include proper extensions for embedded pictures.
• Pictures | All platforms: Improved picture handling for many formats, including .heic, .tiff, .raw, .rw2, .ktx, and more.
• Prefetch Files - Windows 8/10/11 | Computer: Updated parsing support to include prefetch files from Windows 11 evidence sources.
• Telegram | Android: Updated to support new Telegram schema.
• Trash Items - macOS | macOS: Updated to include MD5 and SHA1 hashes.
• iOS iMessage/SMS/MMS | iOS: Updated parsing to support attachments containing shared contacts with multiple GPS locations.

• You can now acquire an iCloud Keychain as a data source for Cloud Apple acquisitions. NEW
• You can now authenticate using a phone number when performing a WhatsApp acquisition. NEW
• Axiom Process can now acquire shared OneDrive photos from Microsoft Teams Messages as modern attachments.
• When processing a Slack Export, you can now monitor the progress of downloading attachments.
• Updated processing to support new Meta warrant return format.

• You can now automatically publish a copy of a case to Magnet Review SaaS from Axiom Process.

• Axiom Examine will now alert and include any related errors when building or exporting chat threads. NEW
• Media file types in PDF reports now include a hyperlink to the original file that was exported with the PDF. NEW
• Cloud Outlook Mail is now a supported platform for viewing emails individually or in threads, in Email explorer.

• Previously, file attachments with null characters may have failed to upload to Magnet Review. -ENGN-13204 NEW
• Previously, when Publishing to Magnet Review from Axiom Process, Axiom Process would crash if the scan exceeded the token expiration time. -ENGN-13224 NEW
• Previously, when Publishing to Magnet Review from Axiom Process, attachments may not have been named correctly. - ENGN-13227 NEW
• Previously, when Publishing to Magnet Review from Axiom Process, Magnet Review may have failed to ingest hits stating the exception “Unable to cast object of type ‘Google.Protobuf.Collections’”. - ENGN-13232 NEW
• Previously, Axiom Process may have incorrectly determined there was not enough available free space when performing an Azure acquisition. -CA-2752 NEW
• Previously, WhatsApp Groups were not parsed from Android OS 14 full file system extractions. -MARS-2650 NEW
• Previously, Axiom Examine may have failed to produce the VICs export or build the Media Explorer. -EXM-4450 NEW
• Security - CVE-2024-48510: Removed DotNetZip dependencies to address a vulnerability where a remote attacker could execute arbitrary code.
• Security - CVE-2024-8316, CVE-2024-7576, CVE-2024-7575, CVE-2024-10012 (Previously fixed in Axiom Process and Axiom Examine): Addressed vulnerabilities in Axiom License Manager where code execution attack was possible through an insecure deserialization vulnerability or improper neutralization of hyperlink elements.
• Security - CVE-2024-10095: Addressed vulnerabilities where code execution attack was possible through an insecure deserialization vulnerability. See the Known Issues section for future Telerik vulnerabilities extending to Axiom License Manager that will be addressed in Magnet Axiom 9.0.
• Previously, Axiom Process may not have recognized an APFS file system of an encrypted E01 SSD. -ENGN-12509
• Email message artifacts uploaded to Magnet Review may not have included the message body. -EXM-4359
• Previously, Axiom Examine may have failed to load the available results while Axiom Process continued to parse the evidence. -EXM-4271
• Previously, categorizing media in Axiom Examine may have resulted in a crash. -EXM-4267
• Previously, exporting emails to PDF may have taken a long time or failed to complete. -EXM-4288
• Previously, search terms would be visible in another case if multiple cases were open in the same instance of Axiom Examine. -EXM-3684
• Previously, the translation feature may not have been available if the case was opened by double clicking the case.mfdb. -EXM-3810
• Previously, exporting Chat threads from Axiom Examine may have failed. -SRA-821
• Previously, Cloud Gmail Messages with empty Delivered Date/Time values were displaying the epoch value of Jan 1, 1970. -CLA-119
• Previously, FileSystemEvents hit may have been missed due to multipart compression. -CARS-1157
• Previously, Axiom Process may have become non-responsive when populating the Participant and Group for a WhatsApp QR acquisition. -CA-2237
• Previously, Axiom Process may have timed out when performing a Slack acquisition containing 1000s of public and private channels. -CA-2647
• Previously, processing a Slack Workspace Export may not have completed successfully. -CA-2684
• Previously, some acquired Slack attachments may not have had a valid file extension. -CA-2644
• Previously, processing a Slack Export may have taken days to complete or consumed all available memory. -CA-2540

• Security - CVE-2024-10095: Magnet Axiom 9.0 will include Telerik UI for WPF to 2024.4.1213 to address a vulnerability where a code execution attack is possible through an insecure deserialization vulnerability in the PersistenceFramework. The current risk to Axiom is low as it only applies to license functionality and does not extend to Axiom Process or Axiom Examine functionality.
• To search for information about known issues, visit the knowledge base at support.magnetforensics.com.

At Magnet Forensics, we welcome your feedback and want to hear about your ideas to help us improve Magnet Axiom. You can submit your feedback for future consideration at the Magnet Axiom Ideas Portal.

Note: To access the Magnet Axiom Ideas Portal, you must sign in to the Support Portal.

• To see release notes for previous versions of Magnet Axiom, go to support.magnetforensics.com.