Google Calendar NEW
Mi Browser NEW
Mint Browser NEW
Google Meet NEW
Google Calendar NEW
Secret Photo Vault
Application Permissions NEW
Magnet Web Page Saver
AXIOM Cyber now supports using AFF4-L containers to store file and folder data for logical acquisitions. This industry standard container helps ensure evidence integrity and admissibility in court.
The AFF4-L images that you create using remote acquire can be loaded into and processed by Magnet AXIOM.
For more information about AFF4, visit www.magnetforensics.com/blog/aff4-aff4-l-an-open-standard-for-forensic-imaging/.
Improved keyword search capabilities
AXIOM Examine has introduced the following search capabilities:
- Keyword search history for each case
- Auto-suggestion of column names and search history when using the search bar
- Search results highlighted within the Preview card of HTML-based documents
- Performance improvements with advanced searches (proximity search, match case, exact match, etc.)
- Apple Maps Favorites | iOS: Added support for recovering favorite locations. [iOS 11]
- Apple Maps | iOS: Updated artifacts to support iOS 11.
- FeatureUsage | Windows: Added support for recovering app usage information from the FeatureUsage registry keys. [Windows 10]
- Google Calendar Events | iOS: Added support for recovering calendar events. [20.29]
- Google Calendar | Android: Added support for recovering calendars and calendar events.
- Google Calendar | iOS: Added support for recovering a user's calendars. [20.29]
- Google Duo Messages | Android: Now includes support for chat threading.
- Google Duo Messages | Android: Updated to include support for reactions to messages.
- Google Duo Messages | iOS: Now includes support for chat threading.
- KakaoTalk Messages | Android: Updated to include support for recovering attachments. [8.9.6]
- Mi and Mint browsers | Android: Added support for recovering browser history data. [Mi 12.1.14, Mint 3.4]
- Private Photo Vault | iOS: Updated to include support for the Pro version of the app.
- SQLite carving: Improved performance while carving SQLite data.
- Safari History | iOS: Updates support to include the last visited date for web pages. [iOS 13]
- Secret Photo Vault | iOS: Added support for recovering photos taken for break-in attempts. [2.4]
- Signal Messages | Windows: Added support for recovering messages. [1.25.3]
- Snapchat Stories | iOS: Updated to support the latest version. [10.85]
- TextMe | iOS: Updated support for the latest version. [3.23.6]
- TikTok | iOS: Updated support for the latest version. [17.3]
- Twitter Users | iOS: Updated for the latest version. [8.35]
- Wickr Me | Android: Updated to include support for parsing decrypted messages and contacts.
- Wickr Messages | Windows: Added support for recovering messages. Decryption is attempted without having to provide a password. [5.60.16]
- Yahoo Mail Messages | iOS: Updated support for the latest version. [6.14]
- When acquiring files and folders from a remote computer, AXIOM Process now creates an AFF4-L container for the evidence instead of a .zip file. If you want AXIOM Process to continue creating .zip files for file and folder evidence, you can change this option in Tools > Settings.
- Added support for preservation*.html files in Facebook and Instagram Warrant Returns.
- Improvements to Facebook Friends acquisition.
- When you load a cloud image created in Magnet AXIOM 3.3 or earlier, the dates might appear incorrectly. You can verify the date/time format before you process the image. To learn how to solve the issue, see the article “Date/time data in old cloud image is incorrect.”
- You can now load Skype Exports.
- Added a new Channel Name fragment to the Cloud Slack Messages artifact to better identify the recipient of a channel message. [Cloud Premium]
- AXIOM Process now caches data to improve performance when loading, scanning, and examining images.
- You can now load AFF4-L images that were created using AXIOM Cyber Remote Acquisition.
- AXIOM Examine now keeps a search history for each case. When you use the search bar, suggested terms will appear based on the column names and search history in the current case.
- The Case dashboard is now available in portable cases. HTML, PDF, and Excel exports are still available. The Timeline explorer and the option to save files from the case have been removed.
- When performing an advanced search, AXIOM Examine now uses fast searching using the Lucene.NET integration to improve search time.
- You can now perform a keyword search within Preview card for artifacts, including all types of documents, that have an HTML-based Preview card. Matching keywords are highlighted in the Preview card, and you can click back or next to review all matching hits.
- You can now set a default time zone in AXIOM Examine as an application setting.
- When processing English data with a non-English locale in AXIOM Process, some data would be misrepresented. When converting English data to non-English data, AXIOM Process searches for delimiters that would identify a certain type of number (e.g. a decimal) in the set language. If certain delimiters were missing according to the set language, AXIOM Process would sometimes misrepresent the value in the converted data. -AXP-6998
- Cloud Google Activity artifacts were not being recovered consistently. -CAO-3214
- In IMAP/POP acquisitions, support for the following servers has been added: SSL2, SSL3, TLS1, TLS1.1, TLS2. -CAO-3261
- Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
- Scans would sometimes encounter an error that prevented them from continuing, but the logs would indicate that the scans finished successfully. -AXP-7087
- Sometimes when finishing a scan, AXIOM Process would crash and an “Access denied” error would appear. -AXP-7061
- Sometimes, Twitter Direct Messages could not be acquired. -CAO-3181
- Sometimes, previews wouldn't appear for AFF4 and archive files due to temp file errors. -AXP-7311
- Sometimes, when creating a portable case that included media attachments, the export would fail. This failure might still occur when copying large media attachments to the portable case, with increased logging to help you troubleshoot. -AXE-7315
- Sometimes, when creating a portable case, an error message would incorrectly state that the system didn’t have enough memory and the export would fail. -AXE-8322
- Sometimes, when you opened a portable case, a "CreateCards" exception appeared in the log files. -AXE-8466
- The Google Photos Warrant Return artifact wasn’t properly parsing quotations and commas from the evidence source. -CAO-3126
- The “Save artifact to” option was not available for individual audio files. -AXE-7919
- When exporting media items to a PDF export, multiple error messages were appearing. -AXE-8066
- When searching a table in the SQLite viewer using a search term that included an asterisk (*), the query would fail. -AXE-8080
- When updating Magnet AXIOM through the update prompt in the application, the update would sometimes fail and AXIOM Process would fail to open. -AXP-7214
- When viewing a PDF report, you were unable to open chat thread preview links. -AXE-8344
- Full email bodies could not be recovered from Windows 10 Mail. -COMP-680
- Google Accounts were sometimes being wrongly attributed as Google Meet Accounts. -MA-2327
- In reports, the Magnet Web Page Saver artifact would display the database name in place of file names. Now, the hash value of the file is displayed instead. -MA-2296
- TikTok Messages weren't reporting data for the Media URL fragment. -MA-2326