Artifact updates

Android

Android 10 System Artifacts

Chrome

Houseparty NEW

KakaoTalk

Snapchat

Uber

Wickr MeNEW

Zoom

Windows

LogMeIn NEW

Remote Desktop Protocol

TeamViewer NEW

Virtual Machines

iOS

Advertising Identifiers NEW

Apple Mail

Cloud Passwords and Tokens

Facebook Messenger

Houseparty NEW

iOS System Information

KnowledgeC Artifacts NEW

Photo Albums

Private Photo Vault NEW

Snapchat

TextFree

Threema

Twitter

Wickr

Zalo

macOS

Apple Voice Notes

iCloud NEW

KnowledgeC Artifacts NEW

Live Photos

LogMeIn

macOS System Information

Photo Albums

Safari Preferences NEW

ZSH Sessions NEW

Cross-platform

Chromium

Safari History

Videos

Remote collections for macOS

You can now acquire evidence from remote macOS computers!

Browse and acquire files and folders from a remote macOS file system.
Quickly select files and folders from the targeted locations list, which includes common items of interest for macOS computers such as iOS backups, iCloud data, Unified logs, and more.
For information, review the Acquiring evidence from a remote computer topic in the Magnet AXIOM Cyber User Guide.

New exporting wizard

We've completely revamped exports / reports in AXIOM Examine! Use the exporting wizard to create and customize your exports and reports. The intuitive new wizard walks you through a series of steps that are customized to the type of export you're creating.

Customize many aspects of your export such as which artifacts or artifact categories you want to include, the title page and formatting options, and more.
Streamline your exporting workflow even more by using templates and column configurations.
For more information about using the new exporting wizard, review the Exporting evidence using the exporting wizard topic in the Magnet AXIOM Cyber User Guide.

Microsoft Azure

You can now remotely acquire images of virtual machines that are hosted in Microsoft Azure.

Configure the Azure environment to provision an account that has permission to access the virtual machine images.
Provide authentication details for the Azure environment in AXIOM Process, and then select the virtual machines that you want to acquire.
For information about configuring your Azure environment and gathering authentication details required for acquisition, review the Find Azure authentication details article in the Customer Portal.

Find similar pictures with Magnet.AI

Using content-based image retrieval technology, Magnet.AI now helps you identify pictures that are similar to each other in your case. For example, Magnet.AI can help you find pictures of similar rooms, scenery, whiteboards, and more.

Build picture comparison so that Magnet.AI can analyze the content of each picture file.
Select a picture from your case or import an external picture to use as the reference to find other pictures that have similar features.
Review the results in the Thumbnail view in the Artifacts explorer. AXIOM Examine sorts the pictures automatically so that the most similar pictures appear at the top.
For more information, review the Finding similar pictures with Magnet.AI topic in the Magnet AXIOM Cyber User Guide.

Artifacts

Apple Mail Recipients | iOS: Updated support to display every recipient as a separate identifier. [iOS 13]
Apple Voice Notes | macOS: Updated support for previewing voice note recordings. [10.15]
Application Activity | Android: Added support to recover values for the Origin activity and Last time moved fragments. [Android 10]
Chrome Tab History | Android: Added support for recovering tab history. [80+]
Chromium Tab History | Android: Added support for recovering tab history from the following Chromium based browsers: Brave, Ecosia, Edge, Iron, Kiwi, Samsung, and Whale.
Device Information | Android: Added support for recovering IMSI information. [Android 10]
Device Information | iOS: Updated support to display device information fragments in a single hit. [iOS 13.0]
Device Information | iOS: Added support to recover advertising identifiers. [13.1]
Facebook Messenger Messages | iOS: Updated support for recovering attachments. [255]
Houseparty Messages and Users | Android: Added support for recovering messages and user information. [1.41.1]
Installed Applications | Android: Updated support for recovering data from installed applications. [Android 10]
KnowledgeC | iOS: Added support for recovering application usage and web usage data. [iOS 10]
KnowledgeC | macOS: Added support for recovering application usage and web usage data.
Live Photos and Photo Albums | MacOS: Added support to recover live photo and photo album data. [MacOS 10.15]
LogMeIn Activity | macOS: Added support to recover LogMeIn remote desktop client activity data. [4.1.7]
LogMeIn Activity | Windows: Added support to recover LogMeIn remote desktop client activity. [1.3.49]
Photo Albums | iOS: Added support for recovering photo album data. [iOS 12 and 13]
Private Photo Vault | iOS: Added support to recover albums and media information. [10.5]
Safari History | macOS, Windows, iOS: Added support to identify whether a webpage was viewed on a local or synced device. [11.2.1]
TeamViewer Activity | Windows: Added support to recover TeamViewer activity data. [15 and earlier]
Text Free Messages and Groups | iOS: Updated support for recovering messages and group chat information. [11.52]
Twitter Users | iOS: Updated support for recovering user data. [8.7+]
Uber | Android: Updated support to recover accounts, profiles, and cached locations data. [4.313]
Usage History | Android: Updated support for recovering application usage history. [Android 10]
Wickr Me Decryption | iOS: Updated support for accepting multiple decryption keys in the Wickr decryption options dialog. [5.47.6]
Wickr Me Messages | Android: Added support for recovering messages, message timestamps, and sender and recipient names. [5.47.6]
Zalo Messages | iOS: Updated support for displaying message direction. [19.12.03]
Zoom Contacts | Android: Added parsing support for the Contacts artifact. [4.6.11]
ZSH Sessions | MacOS: Added support to recover ZSH shell session history. [MacOS 10.15]

Remote acquisition

The firewall warning dialog now appears after a longer period of time has passed. Previously, the warning sometimes appeared before an agent was able to connect.
When you connect to an agent on a remote computer, the agent now performs additional validation to confirm if you’re using an expected self-signed certificate or a valid certificate signed by a trusted signer.
You can now remotely acquire targeted locations and files / folders from a Mac computer.
Magnet AXIOM Cyber now supports Cloud License Server (CLS) licensing for organizations whose users work in an online environment and want to be able to easily share licenses with others when they’re not using the program.

Cloud

You can now acquire Facebook Account Actions from Facebook Warrant Returns.
You can now acquire Trip Details and Account Information from Lyft accounts, using the account’s phone number, 2FA code, and email address.
You can now remotely acquire images of virtual machines that are hosted in Microsoft Azure. [Cloud Premium]

Processing

Magnet AXIOM now requires version 4.8 of the Microsoft .NET Framework. The framework will install automatically when you download Magnet AXIOM 4.0. For more information, review the System requirements: Magnet AXIOM article in the Customer Portal.
When a search completes, you can view a more detailed summary of the completed search. If a search is completed with errors or the search fails, you’ll now be provided with more detailed messaging about why scanning an evidence source might have failed, and troubleshooting steps where possible. For example, you’ll be notified if AXIOM Process encounters an error while using the Dictionary Attack method to decrypt the evidence source because the list of potential passwords did not include the correct password.
When a source is being searched, the Scan summary screen in AXIOM Process will show its status in real time, and will indicate if a failure occurs.
You can now view the Scan summary screen in AXIOM Examine. On the Case dashboard, under each scan, you can click a link that opens the Scan summary screen.

Examining

The new exporting wizard allows you to customize which items and details to include in your exports and reports. Using the intuitive new workflow, you can customize the export’s format, evidence items, and artifact details. Streamline your exporting workflow by using default or customized templates and column configurations. To learn more, see the Exporting evidence using the exporting wizard topic in the Magnet AXIOM User Guide.
Using the Lucene.NET integration, Magnet AXIOM now indexes all evidence to allow you to perform advanced keyword searches up to five times faster. In all cases processed in v4.0 and later, your case will automatically be indexed after processing. When you open a case in v4.0 that was processed in an earlier version, Magnet AXIOM will automatically attempt to index your case. Depending on the size of your case, indexing an existing case could take up to an hour to complete. To learn more about previously processed cases, log in to the Customer Portal to read the Indexing cases processed before Magnet AXIOM 4.0 article.
When you create a portable case to share with stakeholders, the Portable Case Quick Start Guide will now be included in the portable case folder as a PDF.

Magnet.AI

Using content-based image retrieval technology, Magnet.AI now helps you identify pictures that are similar to each other in your case. To learn more, see the Finding similar pictures with Magnet.AI topic in the Magnet AXIOM Cyber User Guide.

Bug fixes

Columns that were selected to be excluded from HTML exports were still being displayed in these exports. -AXE-7898
Data from Snapchat Warrant Returns wasn’t being recovered because some file names had changed. -CAO-2883
Emails in the Cloud artifact category were not being included in PST exports. -AXE-7989
Exports were failing to be created when evidence was missing a source location. -AXE-7842
HTML, PDF, and PST exports were failing when a case contained many emails. -AXE-7698
If artifacts from the “Cloud Twitter Posts Public” and “Cloud Instagram Posts Public” categories included multiple attachments, the attachments would not display in PDF and Excel exports. -AXE-7959
In HTML exports, attachments from the Cloud Twitter Messages artifact category were being incorrectly named “Export.xml”. -AXE-7985
In HTML exports, the video attachment links would open a thumbnail rather than playing the video. -AXE-7962
Keyword searches during scans were failing when non-ASCII encoded characters appeared in keywords and the encoding type was still set to ASCII. To reduce these failures, AXIOM Process will now automatically set the encoding to UTF-8 if it recognizes non-ASCII encoded characters. -AXP-5437
Portable cases that included GrayKey images were failing to be exported. -AXE-7997
When a user’s device was located in another geographical region, Google Drive acquisitions were failing. -CAO-2695
When attempting to download Slack files, an error would occur that caused acquisition of Slack Public Channels and Slack Private Channels to fail. [Cloud Premium] -CAO-2811
When you performed a search in the Timeline explorer in AXIOM Examine, the only way to clear the search was to exit the case. -AXE-8001
When you signed into an Uber account using Google login credentials, the Google login window was partially cut off on the screen. -CAO-2774
Android message data was not being parsed on Android 10 devices. -MA-1842
Blank Chrome passwords were not being accepted for decryption. -COMP-909
Facebook Messenger messages from different chat threads with the same user, were being grouped together in a single chat thread if there were multiple evidence items in a single case. -MA-1753
Full email bodies could not be recovered from Windows 10 Mail. -COMP-680
Group members were not being recovered from Snapchat for Android. -MA-1817
Media files were not being recovered from Snapchat for iOS. -MA-1816
On iOS devices, the following fragments were not being recovered from VK 5.0 or later: Deleted messages, Read state, Forwarded messages, Latitude and Longitude. -MA-1493
Some artifact fragments were being incorrectly categorized as personal identifiers. -MA-1782
The Last Accessed Time Enabled values that were recovered from Windows OS Information, were being displayed as negative numbers. -COMP-602
The Sender name fragment was not being recovered from the Calls and Messages artifacts for KakaoTalk for Android. -MA-1871
Wickr Me data was not being recovered if the Android user had an additional account set up on their device. -MA-1776

Known issues

Here’s some information about known issues:

Depending on screen resolution and scaling, the Export wizard dialog might be too large for some smaller screens, and you aren't able to access some options.
If a case is processed in AXIOM Process 4.0.0 or later, you will be unable to examine the case in AXIOM Examine 3.11.0 or earlier. Please update AXIOM Examine to the latest version.

To search for information about more known issues, visit the knowledge base at support.magnetforensics.com.