Upgrade note: If you're updating from version 4.4 through the update dialog in Magnet AXIOM Cyber, delta pack updates are not supported for this release. Your update will take longer than usual.

For more information about what delta packs offer, see www.magnetforensics.com/blog/delta-packs-let-you-download-axiom-updates-quickly.

Artifact updates

Android

Google Calendar NEW

Google Duo

KakaoTalk

Mi Browser NEW

Mint Browser NEW

Wickr Me

Windows

FeatureUsage NEW

Signal NEW

Wickr NEW

iOS

Apple Maps

Google Meet NEW

Google Calendar NEW

Safari

Secret Photo Vault

Snapchat

TextMe

TikTok

Twitter

Yahoo Mail

macOS

Application Permissions NEW

Cross-platform

Magnet Web Page Saver

AFF4-L containers

AXIOM Cyber now supports using AFF4-L containers to store file and folder data for logical acquisitions. This industry standard container helps ensure evidence integrity and admissibility in court.

The AFF4-L images that you create using remote acquire can be loaded into and processed by Magnet AXIOM.

For more information about AFF4, visit www.magnetforensics.com/blog/aff4-aff4-l-an-open-standard-for-forensic-imaging/.

Improved keyword search capabilities

AXIOM Examine has introduced the following search capabilities:

Keyword search history for each case
Auto-suggestion of column names and search history when using the search bar
Search results highlighted within the Preview card of HTML-based documents
Performance improvements with advanced searches (proximity search, match case, exact match, etc.)

Artifacts

Apple Maps Favorites | iOS: Added support for recovering favorite locations. [iOS 11]
Apple Maps | iOS: Updated artifacts to support iOS 11.
FeatureUsage | Windows: Added support for recovering app usage information from the FeatureUsage registry keys. [Windows 10]
Google Calendar Events | iOS: Added support for recovering calendar events. [20.29]
Google Calendar | Android: Added support for recovering calendars and calendar events.
Google Calendar | iOS: Added support for recovering a user's calendars. [20.29]
Google Duo Messages | Android: Now includes support for chat threading.
Google Duo Messages | Android: Updated to include support for reactions to messages.
Google Duo Messages | iOS: Now includes support for chat threading.
KakaoTalk Messages | Android: Updated to include support for recovering attachments. [8.9.6]
Mi and Mint browsers | Android: Added support for recovering browser history data. [Mi 12.1.14, Mint 3.4]
Private Photo Vault | iOS: Updated to include support for the Pro version of the app.
SQLite carving: Improved performance while carving SQLite data.
Safari History | iOS: Updates support to include the last visited date for web pages. [iOS 13]
Secret Photo Vault | iOS: Added support for recovering photos taken for break-in attempts. [2.4]
Signal Messages | Windows: Added support for recovering messages. [1.25.3]
Snapchat Stories | iOS: Updated to support the latest version. [10.85]
TextMe | iOS: Updated support for the latest version. [3.23.6]
TikTok | iOS: Updated support for the latest version. [17.3]
Twitter Users | iOS: Updated for the latest version. [8.35]
Wickr Me | Android: Updated to include support for parsing decrypted messages and contacts.
Wickr Messages | Windows: Added support for recovering messages. Decryption is attempted without having to provide a password. [5.60.16]
Yahoo Mail Messages | iOS: Updated support for the latest version. [6.14]

Remote acquisition

When acquiring files and folders from a remote computer, AXIOM Process now creates an AFF4-L container for the evidence instead of a .zip file. If you want AXIOM Process to continue creating .zip files for file and folder evidence, you can change this option in Tools > Settings.

Cloud

Added support for preservation*.html files in Facebook and Instagram Warrant Returns.
Improvements to Facebook Friends acquisition.
When you load a cloud image created in Magnet AXIOM 3.3 or earlier, the dates might appear incorrectly. You can verify the date/time format before you process the image. To learn how to solve the issue, see the article “Date/time data in old cloud image is incorrect.”
You can now load Skype Exports.
Added a new Channel Name fragment to the Cloud Slack Messages artifact to better identify the recipient of a channel message. [Cloud Premium]

Processing

AXIOM Process now caches data to improve performance when loading, scanning, and examining images.
You can now load AFF4-L images that were created using AXIOM Cyber Remote Acquisition.

Examining

AXIOM Examine now keeps a search history for each case. When you use the search bar, suggested terms will appear based on the column names and search history in the current case.
The Case dashboard is now available in portable cases. HTML, PDF, and Excel exports are still available. The Timeline explorer and the option to save files from the case have been removed.
When performing an advanced search, AXIOM Examine now uses fast searching using the Lucene.NET integration to improve search time.
You can now perform a keyword search within Preview card for artifacts, including all types of documents, that have an HTML-based Preview card. Matching keywords are highlighted in the Preview card, and you can click back or next to review all matching hits.
You can now set a default time zone in AXIOM Examine as an application setting.

Bug fixes

When processing English data with a non-English locale in AXIOM Process, some data would be misrepresented. When converting English data to non-English data, AXIOM Process searches for delimiters that would identify a certain type of number (e.g. a decimal) in the set language. If certain delimiters were missing according to the set language, AXIOM Process would sometimes misrepresent the value in the converted data. -AXP-6998
Cloud Google Activity artifacts were not being recovered consistently. -CAO-3214
In IMAP/POP acquisitions, support for the following servers has been added: SSL2, SSL3, TLS1, TLS1.1, TLS2. -CAO-3261
Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
Scans would sometimes encounter an error that prevented them from continuing, but the logs would indicate that the scans finished successfully. -AXP-7087
Sometimes when finishing a scan, AXIOM Process would crash and an “Access denied” error would appear. -AXP-7061
Sometimes, Twitter Direct Messages could not be acquired. -CAO-3181
Sometimes, previews wouldn't appear for AFF4 and archive files due to temp file errors. -AXP-7311
Sometimes, when creating a portable case that included media attachments, the export would fail. This failure might still occur when copying large media attachments to the portable case, with increased logging to help you troubleshoot. -AXE-7315
Sometimes, when creating a portable case, an error message would incorrectly state that the system didn’t have enough memory and the export would fail. -AXE-8322
Sometimes, when you opened a portable case, a "CreateCards" exception appeared in the log files. -AXE-8466
The Google Photos Warrant Return artifact wasn’t properly parsing quotations and commas from the evidence source. -CAO-3126
The “Save artifact to” option was not available for individual audio files. -AXE-7919
When exporting media items to a PDF export, multiple error messages were appearing. -AXE-8066
When searching a table in the SQLite viewer using a search term that included an asterisk (*), the query would fail. -AXE-8080
When updating Magnet AXIOM through the update prompt in the application, the update would sometimes fail and AXIOM Process would fail to open. -AXP-7214
When viewing a PDF report, you were unable to open chat thread preview links. -AXE-8344
Full email bodies could not be recovered from Windows 10 Mail. -COMP-680
Google Accounts were sometimes being wrongly attributed as Google Meet Accounts. -MA-2327
In reports, the Magnet Web Page Saver artifact would display the database name in place of file names. Now, the hash value of the file is displayed instead. -MA-2296
TikTok Messages weren't reporting data for the Media URL fragment. -MA-2326

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.