Artifact updates

Android

Motion Photos

Samsung Messenges NEW

Signal Messages

TamTam Messenger

TextNow

Wickr

iOS

Evernote Contacts

iMessage

Snapchat

Viber

WeChat

Windows

Chrome Media History NEW

Office Alerts Events Logs NEW

Prefetch Files

Windows 7 support

As of Magnet AXIOM Cyber 5.0.0, Windows 7 will no longer be supported for use with AXIOM Process or AXIOM Examine. In this and future versions, we might introduce features or enhancements to Magnet AXIOM Cyber that might not function optimally on a computer with the Windows 7 operating system installed. For the best experience with Magnet AXIOM Cyber, we recommend that you upgrade to a supported operating system. For more information about minimum and recommended system requirements, review the following article in the Customer Portal: System requirements: Magnet AXIOM and Magnet AXIOM Cyber.

Generating load files is in open beta — let us know what you think!

In Magnet AXIOM Cyber 4.9.0, we introduced the ability to export load files from AXIOM Examine for use with eDiscovery platforms. This functionality is currently in open beta, and we would love to hear your feedback on it. Please send your questions and comments on the load file capability to axiombeta@magnetforensics.com. We look forward to hearing your thoughts!

You can generate a load file from using the export wizard in AXIOM Examine.
Load files include a plain text delimited file with a .dat extension, along with folders that contain native files and text associated with the entries in the .dat file.
Native files are included for the following artifacts: Email, user created content, chat messages from any source, and examiner-defined and custom artifacts.
Load file exports include support for both templates and column configurations in the export wizard.

Artifacts

Chromium Browsers | Windows: Added support for recovering media history in Chrome, Edge Chromium and Opera.
Event Logs - Office Alerts Events | Windows: Added support for acquiring Microsoft Office Alert events.
Evernote | iOS: Updated support for recovering contacts, notes, and workchat. [10.0.3]
Motion Photos | Android: Updated support to recover all motion photos formats.
Samsung Messages | Android: Added support for parsing Samsung Messages.
Signal | Android: Updated support for recovering group names and members’ phone numbers from group messages. [4.74.3]
Snapchat | iOS: Updated support for recovering media attachments from chat messages. [11.11.0]
TamTam Messenger | Android: Updated support for recovering group and channel names. [2.16.0]
TextNow | Android: Updated support for recovering accounts without a phone number. [20.46.0.1]
Viber | iOS: Added support for recovering attachment information from messages. [6.8.3]
WeChat | iOS: Updated carving support for chat messages. [WeChat 7]
iMessage | iOS: Improved the ability to find associated attachments in iMessages.

Cloud

For Microsoft OneDrive accounts, you can acquire details about the version history for each file, which will appear as a separate artifact in AXIOM Examine. This artifact includes the date of the revision and the name of the user that made the edit. Note that acquiring version history metadata does not acquire historical versions of each file.

Examining

You can now access the OCR processing option when you right-click a picture or PDF document in your case.

Processing

Updated Volatility support for Windows Build 19041.

Bug fixes

AXIOM Process was unable to open some .tgz files. -AXP-7717
AXIOM Process would crash when adding keywords if the system ran out of memory. -AXP-2961
If AXIOM Process could not verify transaction logs, you were unable to open System or Software hives in the Registry explorer. -AXP-7428
When acquiring public Twitter activity, antivirus software would falsely report mftwint.exe as malware or a trojan.
In newer versions of Snapchat Warrant Returns, chats were not parsed and media attachments were not linked to hits. -CAO-3527
Sometimes, the Accessible / Inaccessible filter wasn't available. -AXE-8813
In some cases, duplicate iMessage chat messages were not merged into one hit. In some cases, duplicate iMessage chat messages were not merged into one hit. -MA-2717
The "Tags" fragment for Android Firefox Bookmarks is now called "Bookmark Data". -MA-2579
The number of last run dates/times did not match the application run count number for the Prefetch Files Windows 10 artifact. -COMP-1274
Updated the "Location" fragment name to be more specific for the following Android and iOS artifacts: BlackBerry Messenger, Calendar Events, Chatous, Evernote, Google Calendar, Google Hangouts (iOS only), GroupMe, iOS Home Screen, Snapchat (Android only), and Whisper. -MA-2580

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.