Artifact updates

Android

LINE

Motion Photos

Parler NEW

Signal New Users NEW

Signal Groups and Chats NEW

WeChat

Wickr

Yahoo! Mail

iOS

Google Calendar

Parler NEW

Private Photo Vault

Snapchat Groups NEW

TamTam Messenger

Windows

Skype

macOS

Notes NEW

Signal NEW

Generating load files is now in open beta — let us know what you think!

We've introduced the ability to export load files from AXIOM Examine for use with eDiscovery platforms. This functionality is currently in open beta, and we would love to hear your feedback on it. Please send your questions and comments on the load file capability to axiombeta@magnetforensics.com. We look forward to hearing your thoughts!

You can generate a load file from using the export wizard in AXIOM Examine.
Load files include a plain text delimited file with a .dat extension, along with folders that contain native files and text associated with the entries in the .dat file.
Native files are included for the following artifacts: Email, user created content, chat messages from any source, and examiner-defined and custom artifacts.
Load file exports include support for both templates and column configurations in the export wizard.

Artifacts

Google Calendar Reminders | iOS: Added support for recovering more detailed information about recurring reminders including frequency details.

LINE Contacts | Android: Updated support for recovering contacts. [10.20.1]

Motion Photos | Android: Recovered .jpg and .mp4 files are now combined into a single hit with two different evidence sources.

Parler | Android: Added support for recovering users and activity.

Parler | iOS: Added support for recovering users and activity.

QQ | Android: Updated support for recovering file transfers and messages. [8.4.18]

Reddit | iOS: Updated support for recovering usernames for recently visited Subreddits. [2020.43.0]

Signal Messages | macOS: Updated support for previewing attachments. [1.38.2]

Signal | Android: Added support for recovering groups, chats, and users and profiles known to the target account.

Signal | iOS: Updated support for recovering group members and local users. [3.16]

Signal | macOS: Added support for recovering messages.

Skype | Windows: Improvements to logging for Skype artifacts.

Snapchat Group Members | iOS: Added support for recovering group members.

TamTam Messenger | iOS: Updated support for recovering channels, contacts, conversations, groups, and messages. In some cases, you might not be able to preview video attachments recovered for these artifacts. For more information about a workaround for viewing video attachments for TamTam Messenger, log in to the Customer Portal to review the following article: Reviewing video files from TamTam Messenger. [3.0.0]

Updated Exif-enabled artifacts, such as Pictures and Videos, to include a new Exif Data fragment. The data for the Exif Data fragment are raw Exif value. For more information, log in to the Customer Portal to review the Exif data fragment for Exif-enabled artifacts article.

WeChat | Android: Updated decryption support for messages and friends. [7.0.17]

WickrMe | Android: Updated support to carve database files for deleted messages. [5.63.10]

Yahoo Mail | Android: Updated support for recovering emails and user accounts. [6.12.1]

Cloud

AXIOM now separates the header key from the header value using (:) instead of vertical bar (|) in email messages from a Gmail account.

For Box.com account acquisitions, you can contact Box directly to request that they turn on a permission scope that prevents users from receiving notifications related to acquisitions of their accounts. For more information, visit https://developer.box.com/guides/api-calls/permissions-and-errors/scopes/#available-on-request.

The Cloud Slack Messages artifact now includes the Message ID fragment.

Processing

Added additional logging for the Passware feature.

Magnet AXIOM Cyber customers with a CLS license will now see a message in the License Manager when your license is close to expiring or has expired.

Users with a CLS administrator account can now release a connected license from the Currently connected licenses table in the Magnet License Manager. If you attempt to release a license from the CLS but receive an error message indicating that your username or password is incorrect, please reset your password and try again.

Updated the terminology in the Extract text from files (OCR) option in AXIOM Process to more clearly indicate which types of files OCR is optimized for and that running OCR requires more processing time.

When running OCR, the progress indicator now displays which PDF document or picture AXIOM is currently processing out of the total number of items.

Examining

You can now generate a load file from within the export wizard in AXIOM Examine. A load file consists of a plain text delimited file with a .dat extension, along with folders that contain native files and text associated with the entries in the .dat file. While you can include all artifacts in the .dat file, native files are included for the following artifacts: email (includes a .msg file for each email), user created content including pictures, video, audio, and documents (the original file), chat messages from any source (an HTML chat thread is generated for each chat message based on how you configure chat message previews), and examiner-defined and custom artifacts (the original file).

Added support for using templates and configuring columns to include for the Magnet REVIEW 2.0 export format.

If you change the encoding on an email hit that includes a preview, the header fields within the preview now respect the change in encoding.

If your case contains evidence that was processed as a drive scan, you’ll now receive a notification suggesting that you open AXIOM Examine in administrator mode when you save deleted files and folders locally to your computer or to a .zip file or try to open a deleted file with an external application from the File system explorer. Windows requires administrator privileges to access deleted files from drives on the system. For more information, log in to the Customer Portal to review the Run AXIOM Examine in administrator mode article.

Updated the folder and file naming convention for portable cases to be more intuitive. The primary export folder is now called “PortableCase” and the secondary folder is now called “Case Files”.

Updated the terminology of the option to include chat threads in the Create export / report wizard to more clearly specify the format of the chat thread report.

You can now set the sort order (primary, secondary, and tertiary) for columns in your column configuration templates in the Create export / report wizard.

Bug fixes

AXIOM was unable to acquire all messages from an Office 365 account when Microsoft reported a 504 gateway timeout error during the acquisition. -CAO-3255

If the file path to your case folder included a # symbol as a prefix, PDF chat thread reports would fail to generate correctly. -AXE-8706

If you generated a keyword matches report from the Keyword matches card on the Case dashboard, the Report generated date was always Monday, January 1, 0001. -AXE-8663

Previously, deleted files from FAT and NTFS file systems were not scanned in non-Windows search types. -AXP-6047

Previously, incorrect previews of videos were shown in chat thread reports generated using the HTML export type in Magnet AXIOM 4.8.0. This issue is resolved in Magnet AXIOM 4.8.1, and you do not need to reprocess cases created in Magnet AXIOM 4.8.0. -AXE-8735

Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163

When processing an image of a macOS computer, processing would sometimes time out and AXIOM Process would report that array dimensions exceeded supported range in the log files. -AXP-7570

When you enabled the option to find more artifacts using the Dynamic App Finder, AXIOM Process would sometimes crash before you could create custom artifacts from the hits. -AXP-6814

You were unable to acquire Tweets from Twitter Public Activity. -CAO-3532

In some cases, V1 decryption would fail for the Private Photo Vault artifact for an iOS acquisition. -MA-2715

The “Category” fragment for the following artifacts is now called “Type”: Installed Applications (iOS and Android), Pebble (Android), Pinterest (iOS and Android), Google Toolbar (Windows Computer and macOS), Pidgin (Windows Computer), Finder Sidebar (macOS). -MA-2578

The “Category” fragment the following Windows computer artifacts is now called “Type”: Ares Shared Files, Ares Downloads, and Areas Incomplete Downloads”. -MA-2577

The “Comments” fragment for the following Windows computer artifacts is now called “Comment”: Calc Documents, Excel Documents, Impress Documents, PowerPoint Documents, Shareaza Library Files, Word Documents, and Writer Documents”. -MA-2575

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.