Watch folders
Watch folders allow you to define a file system location where new images will be saved. Magnet AUTOMATE watches that location and automatically creates and processes new cases when an image is detected.
- Watch folders allow you to include applications or hardware imagers in your workflows that don't have a CLI or are otherwise unsupported by Magnet AUTOMATE. Configure the application or tool to output to the watch folder location and have its output consumed by the workflow.
- Case numbers and evidence numbers for the case are parsed automatically from the watch folder file path
- Validation of the image occurs before processing starts
- And, you can select the specific nodes that you want to run the workflow
Mobile updates
- Added support for parsing UFD files and reconstructing the associated images if the formats are supported (not currently supported for watch folders).
- Added support for processing DAR image files from Cellebrite advanced services and iOS acquisitions.
- Added the ability to detect some types of encrypted images, such as encrypted iOS backups, Android backups and APFS encrypted images. These image types are funneled to the Pending cases screen as processing isn't currently supported.
Magnet AXIOM updates
- Updated agent installers to include the latest versions of workflow applications: AXIOM Process, AXIOM Exporter, AXIOM Post-Processing (Magnet AXIOM 4.1.1) and Magnet ACQUIRE 2.27.
- AXIOM Exporter now supports export templates and column configurations that are created in AXIOM Examine.
- You can now configure AXIOM Process to run a 'triage' search. This search type is designed to finish quickly by searching only allocated space and files such as $MFT, $LogFile, Hiberfil.sys, pagefile.sys, and sleepimage (Windows and macOS only).
- You can now set a maximum for the size of videos that AXIOM Process can carve from an evidence source. You can set the value in the UI and by using a CLI argument.
- Logging for Magnet AXIOM has improved. In addition to sending information to the standard log, AXIOM Process now publishes logs and errors to the case. You can view the parsed errors for the case in AXIOM Examine.
For more information about Magnet AXIOM 4.1.1 updates, see the Release Notes at www.magnetforensics.com/release-notes
User experience improvements
- User interface improvements to the dashboard to increase the width of the content area and fix table column sizes.
- A pending cases tab has been added to the dashboard. Cases appear on this tab if they require additional information before they can start processing.
- Added the ability to save workflows as drafts.
- If a workflow fails to generate a log initially, a Refresh log button has been added to the manually pull the log.
Architecture and security
- HTTPS/SSL can now be enabled for all communication between components in AUTOMATE.
- The agent installer now comes packaged with .NET 4.8.
- Updated various backend plugins for Jenkins to address potential security vulnerabilities.
Bug fixes
- AXIOM Exporter was including artifacts in exports that were excluded in an artifact profile. -AUTO-1485
- Images that included non-English characters in their paths would sometimes fail. -AUTO-1577
- Workflows could not be cancelled if they hadn't already started. -AUTO-1510
Known issues
- Watch folder workflows that detect Cellebrite DAR files are not able to parse the attached plist for additional timestamps. This bug is being prioritized for the next release.
- When an image that is missing segments is detected by a watch folder, Magnet AUTOMATE continues waiting for the missing segment. This prevents the workflow from processing and reporting the error.
- After upgrading, the Statistics screen is not updating consistently with case data and stats accumulated before the upgrade are not displayed.
