Artifact updates

Android

Burner Messages

Facebook Messenger

Kiwi Browser

Life360

MMS

Motion Photos

Samsung Health NEW

Signal

Tinder

Twitter

Uber Cached Locations

Wickr Messages

Yahoo Webmail

macOS

Application Permissions

iOS

Application Permissions

Burner Messages

Chrome

Facebook Messenger

Google Meet

Grindr

Grindr Group Members NEW

Instagram Media

PowerLog

Signal

Slack

Snapchat

TextNow

Uber Cached Locations

WeChat Friends

Wickr Messages

Linux

Bash History NEW

Custom File Types

Network Interfaces NEW

Operating System Information NEW

Recent Files NEW

Scheduled Tasks NEW

SSH Keys NEW

Startup Items NEW

System Logs NEW

Trash NEW

User Accounts NEW

Cloud

OneDrive

Windows

PowerShell History NEW

Wickr Messages

Adding keywords to a case after processing

In this release, we've introduced significant enhancements to searching your evidence for keywords:

Add keywords to your case and run keyword searches against your already processed evidence from AXIOM Examine—without creating new evidence items.
Choose which evidence sources you want to search for keywords.
Additional related improvements to reduce overall scan times, including keyword searches, in AXIOM Process by approximately 30%.
More details...

Linux support

Added support for processing and recovering artifacts from images and files acquired from a Linux device.

Support for many popular distributions, including Ubuntu, Red Hat, Debian, Kali, and more.
Recover a wide range of system artifacts, such as user accounts, SSH keys, scheduled tasks, log files, Bash history, and recent files.
Process Linux images using a dedicated workflow in AXIOM Process.
More details...

Azure support

For Magnet AXIOM Cyber 5.0.0 and higher, customers with an active CLS license can deploy Magnet AXIOM Cyber using Microsoft Azure. For information about recommended configurations, log in to the Customer Portal to review the Running Magnet AXIOM Cyber in an Azure virtual machine article.

Artifacts

Application Permissions | Android: Added parsing and carving support to retrieve permissions used by each package and indicate what permissions have been granted by the user and requested by the application.
Application Permissions | iOS and macOS: Updated the naming conventions for the Application Permissions artifact to indicate "macOS, iOS" rather than "AppleOS".
Artifact categories: The artifact categories have undergone some changes this release, so some items might not appear where you'd expect when you're looking for an artifact in AXIOM Process, AXIOM Examine, and the Artifact Reference.
- Chat is now Communication
- Email is now Email & Calendar
- Encryption is now Encryption & Credentials
- Mobile is now Application Usage
- Transportation & Travel is now Location & Travel
- Internet of Things is now Connected Devices
- Many of the artifacts previously found under Operating System, Mobile, and Cloud have been relocated to more appropriate categories
Bash/ZSH Sessions | Linux: Added support for recovering Bash information, including session ID, user, start date/time, end date/time, and session command history.
Burner Messages | Android and iOS: Updated the Burner artifact to display the local users' names instead of phone numbers for messages.
Chrome | iOS: Updated support for recovering last tabs and current tabs. [87.4280.163]
Cron Jobs | Linux: Added support for recovering information about scheduled tasks, such as frequency, command, and paths of the directories.
Facebook Messenger | Android and iOS: Updated the Facebook Messenger Messages chat threading to show sender names before sender IDs, and to show only two participants.
Google Meet | iOS: Updated support for recovering user emails and user names for meeting history. [57.0.0]
Grindr | iOS: Added support for recovering group members and updated support for recovering messages and buddies. -MA-2989
Instagram Media | iOS: Updating support for the Instagram Media artifact to recover Instagram Reels videos.
Kiwi Browser | Android: Updated support for the latest version. [Git20126Gen426127039]
Life360 | Android: Updated support for recovering circle members, local user accounts, messages, and places. [20.8.0]
Location History | iOS: Removed the Local User fragment from the Significant Locations and Significant Locations Visits artifacts as there was no data to report.
MMS | Android: Updated carving support for the Android MMS artifact to recover and join information from multiple tables.
Motion Photos | Android: Updated support to retrieve SHA1 and PhotoDNA hashes.
Network Interfaces | Linux: Added support for recovering network interfaces information and their DHCP leases assigned by the local DHCP server.
OneDrive Files | Cloud: Updated support to acquire last modified name.
Operation System Information | Linux: Added support for recovering Linux operation system installation information.
PowerLog | iOS: Updated the PowerLog artifacts to uniformly display the Adjusted/Original Date/Time.
PowerShell History | Windows: Added support for recovering PowerShell history, including the user that executed the command and the command text.
Recent Files | Linux: Added support for recovering information about the files that are recently accessed by a user.
Samsung Health | Android: Added parsing support to retrieve user information from the Samsung Health app, including name, profile image, email, birthday, height, weight, and more.
Signal | Android: Updated support for Messages, Charts, and Users artifacts for Android Signal. [5.1.9]
Slack | iOS: Updated support for recovering recipients for direct messages. [21.3.20]
Snapchat | iOS: Updated parsing and carving support for recovering Snapchat username information.
SSH Keys | Linux: Added support for recovering SSH Keys information, including file name, key type, encryption type, MAC times, and file content.
Startup Items | Linux: Added support for recovering information about configured auto-run scripts that open when a Linux device starts.
System Logs | Linux: Added support for recovering OS-generated logs stored on the machine.
Telegram | iOS: Updated support for the Telegram artifact to recover deleted account information in the latest version of Telegram. [7.6]
Tinder Accounts | Android: Updated support for recovering user IDs and names.
Trash Items | Linux: Added support for recovering items that a user has sent to the trash, including both deleted files and deleted directories.
Uber Cached Locations | Android and iOS: Updated support to retrieve the name of the cached location, tags assigned to the location by the user, and categories assigned to the location by Uber.
Updated Custom File Type searches to support custom file type searching on Linux.
Updated support for filtering creation date/time information for the following media-related artifacts: Your Phone Pictures, KakaoTalk Pictures, Line Pictures, Live Photos, Motion Photos, Pictures, Videos, Whatsapp Profile Pictures.
User Accounts | Linux: Added support for recovering user account information such as the username, password hash, last password change date/time, user ID, account description, and more.
WeChat Friends | iOS: Updated parsing support for the WeChat Friends artifact to recover profile image, nickname, chat room participants, and geolocation information. [7.0.78]
Wickr Messages | Android, iOS, and Windows: Updated the Wickr Messages artifact schemas to be consistent across different platforms (iOS, Android, and Windows), updated support to recover room name and chat type information, and updated support for system messages.
Yahoo Webmail | Android: Updated parsing support to retrieve attachment files. [6.19.4]

Remote acquisition

Updated default target locations for macOS remote acquisitions to support new locations introduced in macOS 10.15 (Big Sur).
You can now acquire files located in a user's OneDrive folder on a remote system.

Cloud

In March 2021, the format of warrant returns provided by Apple changed. For information about processing the new warrant return format, log in to the Customer Portal to review the Prepare Apple Warrant Returns for acquisition article.
Prior to acquiring public activity from Instagram, you can now check the user name or hashtag in AXIOM Process to make sure it's valid.
You can now save cloud acquisitions to AFF4-L containers. In AXIOM 5.0.0 and later, the default container type for cloud acquisitions is AFF4-L. You can configure your preferred container type from the Tools > Settings menu.

Processing

You can now process Linux images using a dedicated workflow in AXIOM Process. Load Linux images or add Linux files and folders through Evidence sources > Computer > Linux.
Reduced scan times by approximately 30%. Note: Performance improvements are applicable to running AXIOM Process on systems with Windows 8 or later with SSSE3 architecture CPUs.
You can now click the headings of the on the Scan summary screen to expand or collapse the sections to see more information.
You can now view the "Tag files with matching hash values" setting in the Scan summary screen and Case Information.txt file.
As of Magnet AXIOM Cyber 5.0.0, Windows 7 will no longer be supported for use with AXIOM Process or AXIOM Examine. In this and future versions, we might introduce features or enhancements to Magnet AXIOM Cyber that might not function optimally on a computer with the Windows 7 operating system installed. For the best experience with Magnet AXIOM Cyber, we recommend that you upgrade to a supported operating system. For more information about minimum and recommended system requirements, review the following article in the Customer Portal: System requirements: Magnet AXIOM and Magnet AXIOM Cyber.

Examining

You can add keywords to your case and run keyword searches against your already processed evidence, without creating new evidence items or having to repeat all of the processing steps from when you first scanned the evidence. You can also choose which evidence sources you want to search for keywords. During an all content search, AXIOM Examine processes keyword snippets from the selected evidence sources only. After, AXIOM Examine searches all artifacts in the case for matches, which you can find using the Keyword lists filter.
Improved export time for load files when exporting single messages for each native file.
Improvements to searching and displaying hiberfil.sys files including searching hiberfil.sys files for keywords, viewing the decompressed content in the Text and hex card, and labeling the type as "Hiberfil" instead of "File" in the File system explorer.

Bug fixes

Acquisition of a Box.com account would sometimes time out when downloading files. -CAO-3862
After successfully completing a password attack, a lock icon still appeared next to the evidence item that was successfully decrypted. -AXP-6446
Due to a change by Google, you were unable to acquire Google Activity. -CAO-3828
Improvements towards situations where, if a file path for a folder included a \ (backslash character) followed by a | (vertical bar character), AXIOM was unable to display some information about the evidence item. -AXP-7946
If you selected the "Include attachments with data" option when acquiring a Slack workspace data export, AXIOM Process would sometimes crash. -CAO-3740
Previews of PDF documents were not displayed in the Preview card in AXIOM Examine. -AXE-9128
When categorizing media with medium thumbnails, AXIOM Examine's performance would significantly slow down. -AXE-7841
When finishing a search with a large number of nested archives, AXIOM Process would sometimes become unresponsive or crash and report that not enough quota was available to process the command. -AXP-1823
You were unable to select some regions when signing in to an AWS account. -CAO-3871
Previously, an incorrect attachment file was recovered for TextNow for iOS. -MA-2909
The text from Twitter Direct Messages for Android devices was displayed twice in the Text column and in the Details card. -MA-2959
Updated ExifTool to version 12.25. -COMP-1369
When processing old versions of Signal for iOS (prior to version 3.2), temporary files produced as part of the decryption process were not properly cleaned up or removed when processing was complete. -MA-3040
If you exported a load file that included cloud hits with multiple pictures, the native file that was generated had a .jpeg extension instead of a .zip extension. -CRA-1462
When you loaded UFED physical extractions into AXIOM, some text messages were not carved. -MA-2924
When you added .zip, .tar, .7z as file extensions to the Custom File Types list in AXIOM Process and processed a container with expandable archive files, the archive files were not listed in the Custom section of the Artifact Explorer. -COMP-1292

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.