New and updated
- To improve version number tracking of the digital forensic tools used in your cases, each run summary and log now records the AUTOMATE version and versions of the applications used. This information is available in the Run Details section on the Existing Cases page and the Magnet AUTOMATE REST API.
Note: To record application versions, you must include the version numbers when adding the applications to your nodes.
- From the Nodes and applications table in the Configuration page, all connected nodes now display the AUTOMATE version number in a new Version number column. This is useful for troubleshooting, historic reference (during upgrading), and auditing.
- To make it easier to report on your cases, run logs are now included in the output of each run. In the defined output path for each case, an AUTOMATE run logs folder now appears, which includes the run log as a .txt file. Previously, manually exporting this file was the only option for case reporting.
Bug fixes
- After turning on the "Continue running the workflow if decryption is unsuccessful" option when creating a case, navigating back and forth between the case and evidence steps turned off the option. (AU-360)
- In a localized workflow with local image mode enabled, renaming an image file to include spaces caused Robocopy to fail to copy the image file. This applied to all non-segmented image file types, such as AFF4 and TGZ. (AU-777)
Known issues
- Long lines in log files may fail to wrap correctly, causing them to overlap with other lines. To resolve the issue, refresh the log you are viewing. -AU-699
- In an image processing workflow, AXIOM Process cannot read an iOS image with a keychain encrypted by BitLocker. To successfully read and process this type of image, copy the keychain to an external drive not encrypted with BitLocker. Additionally, if the AUTOMATE agent node's workspace is encrypted with BitLocker, workflows that have been configured to "turn on local image mode" will not be able to read these images. -AXP-10310
- During data validation, if the source destination contains an image with copies of the same image in subfolders, the data validation fails. In this scenario, the expected behavior is that Magnet AUTOMATE doesn't recursively catalog identical files. -AUTO-3407
- When copying files during data validation, the associated node is in use; however, the Nodes column for cases in progress appears empty. The expected behavior is that the Nodes column should display the active node. -AUTO-3406
- When data validation begins, the run log records a "Creating hash catalog" status. If files fail to copy after creating file hashes, there is no status in the run log to indicate when copying started. The expected behavior is that there should be a "Copying" status after "Creating hash catalog" to indicate the sequence of events and when they occurred. -AUTO-3408
Magnet AXIOM and Magnet AXIOM Cyber updates
- No updates to agent installers, which include the following workflow applications: AXIOM Process, AXIOM Exporter, AXIOM Post-Processing, and Magnet ACQUIRE.
- For more information about Magnet AXIOM 7.3 updates, see the Magnet AXIOM 7.3 Release Notes.
- For more information about Magnet AXIOM Cyber 7.3 updates, see the Magnet AXIOM Cyber 7.3 Release Notes.