Artifact updates
Android
Aloha Browser
Device Information
Discord
Ecosia Browser
Facebook Messages
Houseparty
Instagram Messages
Motion Photos
NEW
Reddit
Signal
Snapchat
TextMe
Uber
Usage History
Whale Browser
Wickr
iOS
AirDrop
Facebook Messages
Google Photos Album
NEW
Google Photos Media
NEW
Houseparty
Instagram Messages
macOS
iMessage
Quick Look
Rebuilt Desktops
Windows
Dropbox
EML(X) Files
Internet Explorer
Shellbags
Windows Event Logs
User Event Logs
NEW
Artifacts
- Aloha Browser | Android: Updated support for recovering browser history. [2.22.0]
- Device Information | Android: Updated support to recover device information for Android 11.
- Discord Messages | Android: Updated to support recovering messages from the latest versions. [38.3]
- Dropbox | Windows: Updated deserialization and decryption support. [94.4]
- Ecosia Browser | Android: Updated support for recovering top sites for the latest version. [4.0.4]
- Event Logs – User Events | Windows: Added support for recovering User Event logs.
- Facebook Messages | Android: Updated to support cross-app messaging between Facebook and Instagram.
- Facebook Messages | iOS: Updated to support cross-app messaging between Facebook and Instagram.
- Google Photos | iOS: Added support for recovering photo albums and media. [5.8.328412793]
- Houseparty | Android: Updated support for recovering messages and users. [1.49.1]
- Houseparty | iOS: Updated support for recovering messages and users. [1.49.0]
- iMessage | macOS: Updated to support Big Sur. [macOS 11]
- Instagram Messages | Android: Updated to support cross-app messaging between Facebook and Instagram.
- Instagram Messages | iOS: Updated to support cross-app messaging between Facebook and Instagram.
- Motion Photo | Android: Added support for recovering motion photo .mp4 files embedded in .jpg files.
- Quick Look thumbnails | macOS: Updated to support Big Sur. [macOS 11]
- Rebuilt Desktops | macOS: Improvements to the menu bar for Siri, the clock, and the user’s name.
- Reddit | Android: Updated support for recovering accounts, posts, and recently visited Subreddits. [2020.37.02020.37.0]
- Signal | Android: Added support for recovering messages, local user, and group members.
- Snapchat | Android: Updated support for recovering chat messages and group members. [11.1.0.66]
- TextMe | Android: Updated support for recovering calls and messages for the latest version. [3.24.2]
- Uber Cached Locations | Android: Updated support for recovering cached locations. [4.335.10002]
- Usage History | Android: Updated support to recover usage history for Android 11.
- Whale Browser | Android: Updated support for recovering top sites for the latest version. [1.8.2.2]
- Wickr | Android: Updated support for Android 11.
Cloud
- AXIOM Process is now able to acquire files or folders from a Mega account that were shared (including those shared by the signed-in user to a third-party or shared with the signed-in user by a third-party).
- Improvements to reduce the likelihood of experiencing a rate limiting exception when downloading a large number of files from a Mega account.
- Previously, when you tried to acquire a cloud account, you received a Windows security alert indicating that Windows Defender Firewall blocked some features of AXIOM Process.
- The Date/Time fragment for Cloud Google Gmail Messages artifact is now separated into Submitted Date/Time and Delivered Date/Time fragments.
- The option to sign in to a Facebook account using an authentication token is no longer available.
Processing
- Added support for Quick Acquisition of iOS 14 devices.
- The Windows decryption options screen now includes a warning that, if the device was encrypted on a system with a TPM (Trusted Platform Module), the recovery key is required to decrypt the image and the password will not decrypt the image.
- If you renewed your license prior to October 2020 and received an email from Magnet Forensics with an updated .bin file, you can now update your dongle using the Licensing > Dongle (.bin file) workflow in Magnet AXIOM.
Examining
- Improvements to customizing formatting options when exporting PDF files. When you export a combined PDF, AXIOM Examine now generates one PDF report (a single .pdf file) that contains all selected artifacts including all of the fragments for each hit. When you export separate reports, AXIOM Examine generates multiple .pdf files for each artifact type.
- Improvements to customizing formatting options when exporting Excel files. When you export a combined .xlsx file, AXIOM Examine generates one Excel workbook (a single .xlsx file) that includes a worksheet for each artifact type. When you export separate reports, AXIOM Examine generates separate workbooks (multiple .xlsx files) for each artifact type.
- Reduced the number of folders visible in a portable case export to make the process for opening a portable case more intuitive.
- For email artifacts, you can now use the “Save artifact to…” option to save individual email hits from AXIOM Examine. Emails are saved as .eml files.
Bug fixes
- With an Magnet AXIOM Cyber license, you were unable to access the Add new cloud evidence using passwords/tokens menu option. -AXE-7862
- AXIOM Process could not decrypt a McAfee-encrypted hard drive that was acquired using Remote Acquire.
- Certain types of messages in an Instagram Warrant Return would display "no message content to display". They will now indicate that they are one of the following types: Video Call, Live_viewer_invite, or profile. -CAO-3325
- During processing, AXIOM Process would sometimes cancel the case even though it still had a connection to the case database. -AXP-6820
- In some cases, AXIOM Examine and portable cases could crash when performing a keyword search. -AXE-8424
- In some cases, when changing views in AXIOM Examine, the lower portion of the Evidence and Details panes weren’t visible. -AXE-7532
- Japanese characters did not display correctly for Microsoft Teams chat history in the Preview card. -AXE-8351
- MD5 and SHA1 hash values for cloud images processed between Magnet AXIOM 4.2.0 and 4.6.0 were incorrect. For more information, including how you can validate data integrity where the hash is incorrect, log in to the Customer Portal to review the MD5 and SHA1 hashes incorrect for cloud images article. -CAO-3399
- PST exports for Office 365 did not include “sent” timestamps for email data sources. -CAO-3381
- Portable cases would take a long time to load when a case had a large number of keyword matches. -AXE-8483
- Sometimes, the acquisition of user details would fail when attempting to acquire public activity for an Instagram account. -CAO-3374
- The Clear filters option did not correctly clear all filters if you previously performed a keyword search and then selected the “Filter on conversation” option. -AXE-8074
- The Google Cloud Activity artifact now includes a Date/Time – Local Time fragment. -CAO-2976
- The filter bar did not correctly display all filters when you performed a keyword search and then selected the “Filter on conversation” option. -AXE-8073
- The participant list for Instagram chat messages incorrectly included the authors of shared posts even when they were not part of the chat. -CAO-3312
- When the language was set to German, the login window for signing into a Mega account was too small. -CAO-3375
- When scanning an AFF4 image of an APFS file system, AXIOM Process sometimes crashed due to insufficient system resources. -AXP-6542
- You were unable to create multiple custom artifacts with the same name. -AXP-2978
- AirDrop outgoing transfers were not being parsed. -MA-2524
- Carved hits were missed for Internet Explorer Daily History and Windows Event Logs. -COMP-1186
- In some cases, when saving remote acquisition data from a Windows computer to an .zip container, MAC timestamps did not reflect the correct UTC time of the remote computer while viewing evidence in the case in AXIOM Examine. -CRA-1275
- Sometimes, out of memory errors occurred when performing large remote acquisitions. -CRA-1263
- When saving remote acquisition data to an AFF4-L container, if the same file was downloaded multiple times, an error occurred indicating that AXIOM Process was unable to prepare the downloaded evidence. -CRA-1245
- For Windows 8 and later, some Shellbags data was not correctly parsed. -COMP-1178
Known issues
