Release Notes

Magnet AXIOM Cyber 4.11.0.24063 March 23, 2021

Artifact updates

Android

Android App Roles NEW

Applications Permissions NEW

Houseparty

Parler

Runtime Permissions NEW

Samsung Messages

Signal

Slack

Snapchat

Telegram

Uber

Yahoo Webmail

iOS

Evernote Notes

Google Photo Album Comments NEW

Houseparty

Instagram

Location History

Owner Information

Puffin Browser

Snapchat

Telegram

TextFree

Uber

Viber

WeChat

Cloud

Facebook Profile

Google Activity

Google Audit Logs

Instagram Download Your Data NEW

Computer

Chromebook NEW

Windows

Chrome Keyword Search

Artifacts

• Android App Roles | Android: Added support for parsing the roles.xml file, which indicates which application a user or system has set to perform a function.
• Application Permissions | Android: Added parsing and carving support to retrieve permissions used by each package and indicate what permissions have been granted by the user and requested by the application.
• Chrome Keyword Search Terms | Windows: Updated support for Chrome Keyword Search Terms to show the last visited time in Magnet AXIOM. [4.9.1]
• Chromebook: Added parsing and carving support to identify Chrome artifacts with Chromebook extractions, such as cache, cookies, last tab, media history, web history, and more.
• Evernote | iOS: Updated support for recovering Evernote Notes data, including the note type, the file name, the creator, the owner, who the note was shared with, the last editor, and the notebook name.
• Google Photo Album | iOS: Added support for recovering Google Photo Album comments. [5.8.328412793]
• Houseparty | Android: Updated support for recovering Messages and Users Hits in the latest version of Houseparty. [1.54.0]
• Houseparty | iOS: Updated support for recovering Messages and Users Hits in the latest version of Houseparty. [1.54.1]
• Improvements to extract more data from attachments and thumbnails. Due to the nature of this change, you might experience longer scan times when scanning images that include many small attachment files.
• Instagram | iOS: Updated support for Instagram Profiles to recover profile information of the Local User from different .plist files. [176.0]
• Instagram Download Your Data | Cloud: Added support for acquiring direct messages, direct message attachments, account history, messages, media, and comments from an Instagram Download Your Data archive.
• Location History | iOS: Removed the Local User fragment from the Significant Locations and Significant Locations Visits artifacts as there was no data to report.
• Owner Information | iOS: Updated support for the Owner Information artifact to recover iOS device model information.
• Parler | Android: Updated support to include whether the activity was deleted, the repost count, number of upvotes, and number of downvotes and updated support for Parler Activity and Parler Users to include the "-Android" tag for Android artifacts.
• Puffin Browser | iOS: Updated support for recovering Puffin Browser Bookmarks information. [5.2.5]
• Runtime Permissions | Android: Added parsing and carving support to retrieve the permissions a user has granted or declined to an application.
• Slack | Android: Added support for parsing one-to-one direct messages in Slack [20.9.10 and 20.10.10 onward].
• Snapchat | Android and iOS: Updated support for the Type fragment to indicate message types with descriptive strings instead of numeric codes.
• Snapchat | Android: Updating carving support for retrieving sender and recipient names. [11.17.0.37]
• Snapchat | iOS: Updated carving support to recover Snapchat iOS messages from the Arroyo.db database.
• Telegram | Android and iOS: Updated parsing support to recover Telegram data on video calls.
• TextFree | iOS: Updated support for the Contacts, Groups, and Messages artifacts [11.84]
• Viber | iOS: Added support for recovering attachments information for iOS Viber Messages.
• WeChat | iOS: Updated support for recovering chat messages. [7.0.78]
• Yahoo Mail Emails | Android: Updated parsing support to retrieve Android Yahoo Mail email attachments and message ID. [6.12.1]

Remote acquisition

• When creating your agent, you can now optionally configure the agent to survive a restart or shutdown of the target computer. For more information, log in to the Customer Portal to review the Configure the agent to survive a shutdown of a target computer article.

Examining

• The beta program for Load File exports is now closed. We appreciate all of your questions, comments, and feedback, which we’ve used to make several improvements to Load File exports. We'd still love to hear from you! To continue to provide feedback, please reach out to Tech Support.
• Added support for generating native files for artifacts with HTML-based preview cards, such as Facebook posts, in Load File exports.
• Improvements to how DocIDs are assigned across Load Files, text files, and natives.
• Updated use of delimiters in .dat files to improve compatibility with loading Load File exports in Intella.

Cloud

• In response to new restrictions implemented by Instagram, you now must sign in to an Instagram account to fully acquire publicly available data. You can use any active Instagram account to acquire public activity.
• You can now load a .zip file generated from the Download Your Data (JSON format) option in Instagram as a Cloud evidence source.

Bug fixes

• AXIOM Process was unable to recover some hits from a W10x64_19041 memory profile if process names included a space. -AXP-7758
• If you loaded a folder as evidence and that folder name included an underscore, the underscore was not properly shown in the "Image - location name" column in the list of evidence sources. -AXP-5423
• You were unable to acquire Google Activity. -CAO-3643
• When acquiring a large amount of audit events from G Suite, AXIOM Process would sometimes crash. -CAO-3526
• When emails were exported to PST, some of them were missing the body text. -AXE-8999
• When emails with large amounts of body text were exported to PDF reports, the text would overlap or go off the edge of the page. -AXE-5160
• When watching a video in one explorer, the video would continue playing when AXIOM Examine was switched to another explorer. -AXE-8957
• You were unable to acquire Facebook Profile information. -CAO-3659
• Significant Location Visits artifact data could not be parsed on iOS 14 devices. -MA-2772
• Updated fragment names to be more specific for the following Cloud artifacts: Cloud Amazon S3 Files, Cloud Google Contacts, Cloud Google Photos (Warrant Return), Cloud Twitter Posts Public, Cloud Twitter Users, Cloud Twitter Users Public, Cloud Google Calendar Events, and Facebook Photos (Warrant Return). -MA-2583
• Updated the "Category" fragment names to be more specific for the following Android and iOS artifacts: Android Snapchat Received Images, Android WhatsApp Profile Pictures, Instagram Media, Instagram Photos (Warrant Return), KakaoTalk Pictures, LINE Pictures, Live Photos, Pictures, Carved Video, Snapchat Received Videos, Snapchat Memories, TikTok Videos, and Videos. -MA-2576
• Updated the "Location" fragment names to be more specific for the following Android and iOS artifacts: Whisper Posts (iOS only), Mail.ru Contacts, Outlook Appointments, Pebble Calendar Events, Pinterest Accounts, Pinterest Following, and Twitter Users. -MA-2582
• When you exported Signal Messages .gif attachments from the picture artifact, the .gif files were converted to static .jpeg files. -MA-2774
• When you loaded a World Map in Report Viewer with Lyft Last Known Location for iOS, you got an error and no points were mapped. -MA-2914
• When you reviewed Samsung Messages in the Conversation View, the sender and recipient information were not displayed. -MA-2880
• When trying to analyze the evidence from an AFF4 image generated from a remote acquisition, AXIOM Process would crash if the image included evidence from the "All users - Folders" targeted location. -CRA-1389

Known issues

• To search for information about known issues, visit the knowledge base at support.magnetforensics.com.