Artifact updates

Android

Houseparty

KakaoTalk

Slack

Tinder

WickrMe

iOS

Aloha Browser

Evernote

Houseparty

Lyft Last Known Location

Lyft Shortcut Locations NEW

Snapchat

WeChat

Windows

Firewall Event Logs NEW

Network Event Logs NEW

Scheduled Task Event Logs NEW

Script Event Logs NEW

Service Event Logs NEW

System Event Logs NEW

USB Event Logs NEW

User Event Logs

Windows Event Logs

Extract text from files using OCR

Using optical character recognition (OCR) technology, you can extract text from PDF documents (including text in scanned documents and text from pictures in PDF documents) and from picture artifacts.

You can configure OCR to run automatically during the post-processing actions portion of a search, or you can run OCR later in AXIOM Examine.
After processing the files, you can view the extracted text in the Text extracted using OCR preview card
You can apply the Extracted text (OCR) content types filter to review all evidence with extracted text.
When you export evidence using the HTML export type, and you enable the option to include previews and file attachments, text extracted using OCR is included as an .txt file in your export.
Text extraction using OCR is available with an active Magnet AXIOM Complete, Magnet AXIOM Cyber, or Magnet AXIOM Examine license.
More details...

Acquire comments and replies to comments from Facebook Timeline posts

You can now acquire comments and replies to comments for Facebook Timeline posts.

When you include Facebook Timeline posts in your acquisition, you now have the option to select the content you want to include: posts only, posts and comments, or posts, comments, and replies.
Please note that acquiring comments and replies to comments can increase acquisition time.
More details...

Enhancements to exports / reports

In this release, we've introduced several enhancements to exporting from AXIOM Examine:

When configuring which columns to include in your export / report, you can now choose to include visible columns and column sorting from your current view in AXIOM Examine.
You can now create an export / report using the Magnet REVIEW 2.0 export type.
You can optionally export attachments when creating PDF and Excel exports.
PDF reports now include a table of contents.
For Project VIC exports, you can now generate a new CaseID value so that the exported data appears as a new case within the CAID database.
More details...

Artifacts

Aloha Browser | iOS: Updated support for recovering bookmarks. [3.0.0]
Event Logs – Firewall Events | Windows: Added support for recovering Firewall Event logs.
Event Logs – Networking Events | Windows: Added support for recovering Networking Event logs.
Event Logs – Scheduled Task Events | Windows: Added support for recovering Scheduled Task Event logs.
Event Logs – Script Events | Windows: Added support for recovering Script Event logs.
Event Logs – Service Events | Windows: Added support for recovering Services Event logs.
Event Logs – System Events | Windows: Added support for recovering System Event logs.
Event Logs – USB Events | Windows: Added support for recovering USB Event logs.
Event Logs – User Events | Windows: Updated support for recovering User Event logs.
Event Logs – Windows Events | Windows: Updated support for recovering the Event Record ID for Windows Event logs.
Evernote | iOS: Updated support for recovering Evernote accounts. [10.0.3]
Houseparty | Android: Updated support for recovering messages and users. [1.52.0]
Houseparty | iOS: Updated support for recovering messages and users. [1.51.0]
KakaoTalk | Android: Updated support for recovering calls, chat rooms, friends, and messages. [9.0.1]
Lyft | iOS: Added support for recovering shortcut locations. [6.51.3]
Lyft | iOS: Updated support for recovering last known location. [6.53.3]
Pinterest | Android: Updated support for recovering messages. [8.41.0]
Reddit | iOS: Updated support for recovering accounts, posts, and recently visited Subreddits. [2020.41.0]
Slack | Android: Updated support for recovering channel and direct messages. [20.11.10.0]
Snapchat | iOS: Updated support for recovering chat messages [11.0.6]
Tinder | Android: Updated support for recovering Tinder accounts. [11.24.0]
WeChat | iOS: Updated support for recovering chat messages. [7.0.78]
WickrMe | Android: Updated support to carve database files for deleted messages.

Cloud

When acquiring Facebook Timeline data, if the target user shared another post on their Timeline, AXIOM incorrectly generated two hits for the post.
You can now acquire comments and replies to comments for Facebook Timeline posts. When acquiring Timeline posts, you can choose to acquire posts only, posts and comments, or posts, comments, and replies. Please note that acquiring comments and replies to comments can significantly increase acquisition time. AXIOM Process will attempt to collect all comments associated with Timeline posts but does not guarantee that all posts will be gathered.
You were unable to acquire Tweets from Twitter Public Activity

Processing

Magnet AXIOM Cyber customers with an active CLS license can now deploy Magnet AXIOM Cyber using AWS EC2. For more information, log in to the Customer Portal to review the Running Magnet AXIOM Cyber in an AWS EC2 virtual machine. article and updates to the System requirements: Magnet AXIOM and Magnet AXIOM Cyber article.
When decrypting an image or drive, AXIOM Process now saves the decrypted evidence to the Location for acquired evidence that you configured for the case.
For customers with an active CLS license, you can now designate up to two administrators for your CLS instance. When logged in as an administrator, you can view the computers connected to your CLS instance by computer name. To request administrator access to your CLS instance, please contact support@magnetforensics.com.

Examining

Using optical character recognition (OCR) technology, you can extract text from PDF documents (including text in scanned documents and text from pictures in PDF documents) and from picture artifacts. This feature is available to extract text for files with Latin characters. Note: Text extraction using OCR is available with an active Magnet AXIOM Complete, Magnet AXIOM Cyber, or Magnet AXIOM Examine license.
Added support for creating an export / report using the Magnet REVIEW 2.0 export type.
PDF reports now include a table of contents.
When configuring which columns to include in your export / report, you can now choose to include visible columns and column sorting from your current view in AXIOM Examine. Please note this feature is currently only available for English.
You can now choose to export attachments when creating a PDF and Excel exports / reports.
You can now filter by items with geolocation data in the Content types filter.

Bug fixes

NEW Previously, incorrect previews of videos were shown in chat thread reports generated using the HTML export type in Magnet AXIOM 4.8.0. This issue is resolved in Magnet AXIOM 4.8.1, and you do not need to reprocess cases created in Magnet AXIOM 4.8.0. -AXE-8735
An IMAP acquisition would fail when you selected specific folders to acquire from an email account. -CAO-2963
Enhancements to WhatsApp QR code acquisitions to improve stability. -CAO-3235
If viewing a video or audio attachments in a chat thread is not supported by the browser, you can now click to play the attachment in your local media player. -AXE-7963
If you loaded a .zip file as file scan, you were later unable to export evidence in the case to a portable case. -AXP-7304
If your case contains evidence that was processed as a drive scan, you’ll now receive a notification suggesting that you open AXIOM Examine in administrator mode. Windows requires administrator privileges to access deleted files from drives on the system, which can affect your ability to save artifacts, export previews and attachments, and run Magnet.AI for these files. For more information, log in to the Customer Portal to review the Run AXIOM Examine in administrator mode article. -AXE-8636
In some cases, the log.txt incorrectly referenced the name and file path of a previous case folder. -AXP-7345
In some cases, when you exported your case using the Magnet REVIEW export type, the export would fail due to an invalid character. -AXE-8588
Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
Sometimes, you were unable to acquire data from a Google Drive account because the refresh token would expire. -CAO-3296
When you tried to copy the contents of your portable case file to another location, some files could not be properly copied to the new location. -AXE-8687
When you tried to select the files that you wanted to acquire from a Box.com account, AXIOM Process was unable to load all files on the Add files and folders screen for accounts with a large number of files. -CAO-3435
You were unable to acquire AOL email accounts. -CAO-3396
You were unable to acquire Facebook Friends data. -CAO-3417
You were unable to acquire Instagram Direct Messages. -CAO-3479
When the message content of WeChat Messages contains embedded XML metadata, the Type will now be categorized as Shared Information. For example, messages that include Location Sharing information or WeChat payment transaction information, payment amounts, e-receipts, and more. -MA-2692

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.