Release Notes

Magnet AXIOM Cyber 5.1.0.24999 May 28, 2021

Artifact updates

Android

Cake

VK

Wickr Me

Wickr Me Conversations NEW

Wickr Me Users NEW

Cloud

Facebook Public Activity Friends

Facebook Public Activity Posts

All Platforms

Pictures

Videos

PowerPoint

iOS

Chrome

Grindr

PowerLog Lightning Cable Status NEW

Slack

Snapchat

Telegram

Tumblr

WeChat

Wickr Me Conversations NEW

Wickr Me Users NEW

Windows

LNK Files

Wickr Me Conversations NEW

Wickr Me Users NEW

macOS

CUPS NEW

Trash Items

Linux

CUPS NEW

Artifacts

• CUPS Print Jobs | macOS and Linux: Added support for recovering records of print jobs that were created by the Common Unix Printing System (CUPS).
• Cake | Android: Updated support for recovering attachments. [2.6.3]
• Chrome | iOS: Updated support for recovering current tabs. [87.4280.163]
• Facebook Public Activity | Cloud: Added support for acquiring friends and posts (including comments and replies).
• Grindr | iOS: Updated support for recovering favourited and social network information, including Facebook, Instagram, and Twitter account names, for Grindr Buddies. [7.6.0]
• PowerLog Lightning Cable Status | iOS: Added support for recovering information about when the phone had a lightning cable connected or disconnected.
• Signal | Android: Updated support for recovering information about the group or individual conversations that the local user has participated in. [5.1.9]
• Slack | iOS: Updated support for recovering channel messages, channels, direct messages, files, users, and workplaces. [21.4.10]
• Tumblr | iOS: Updated support for recovering chat messages and created posts. [18.8]
• VK | Android: Updated support for recovering the group ID from group messages. [6.30]
• Video | All platforms: Added parsing support for .FLV videos.
• Wickr Me Conversations | Android, iOS, and Windows: Added support for recovering details about all the Individual, Group, and Room conversations the local user is a part of.
• Wickr Me Users | Android, iOS, and Windows: Added support for recovering details about the users the local user has interacted with in the app.
• Wickr Me | Android and Windows: Updated support for recovering the Attachment Path fragment.

Remote acquisition

• The list of default targeted locations now includes $Logfile for Windows systems.

Cloud

• In March 2021, the format of warrant returns provided by Apple changed. For information about processing the new warrant return format, log in to the Customer Portal to review the Prepare Apple Warrant Returns for acquisition article.
• You can now acquire public Facebook activity from a target account—without requiring a user name and password for that user. Note: Due to restrictions from Facebook, you must sign in to a Facebook account to fully acquire publicly available data, but you can use any active Facebook account.

Magnet.AI

• When you categorize media using Magnet.AI, you can now select the "Possible icons" category to help eliminate some of the noise in your case.

Processing

• Usability improvements when using side mouse to navigate forward and back in AXIOM Process.
• You can now process Chromebook images generated using the MAGNET Chromebook Acquisition Assistant. Using the dedicated workflow in AXIOM Process, load Chromebook images through Evidence sources > Computer > Chromebook.
• You can now view the currently processing artifact in the thread status message in AXIOM Process.
• You can now search for text in email attachments using optical character recognition (OCR).

Bug fixes

• After an "all content" keyword search was performed, the case was re-indexed. -AXE-9325
• Due to a change in format, you were unable to parse direct messages from Instagram Download Your Data HTML packages. You can now find direct message hits in the Facebook-Instagram Messages (Download Your Data) artifact. -CAO-3832
• Due to a change in format, you were unable to parse direct messages from Instagram warrant returns. -CAO-3826
• If you clicked the Regex / GREP checkbox before entering a keyword, AXIOM Process would crash. -AXP-7978
• In Timeline exports, the date/time was always labelled as UTC, even when the value reflected the local timezone. -AXE-9293
• Long Regex keywords were being truncated in the keywords wizard. -AXE-9151
• Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
• Sometimes, when creating an export, files were being named incorrectly, and were being marked as parsed instead of carved. -AXE-8838
• Sometimes, when performing a keyword search, the Encoding column was blank. -AXE-9163
• Sometimes, when the date/time filter was applied and the end date was modified, the filter would not reset to match the new end date. -AXE-8984
• Sometimes, when viewing the Details pane of a video file in the Artifacts or Media explorers, text would disappear or the preview would scroll incorrectly. -AXE-9115
• When a carved picture was exported using the "Save artifact to" feature, two duplicate picture files were being created. -AXE-8409
• When processing a case with a large number of keyword snippets, AXIOM Examine would use a large amount of memory. -AXE-9259
• When running an all content keyword search in a case with a large number of keyword results, the job would not be completed because it ran out of memory. -AXE-9334
• When viewing related artifacts, if the filter was deselected, the results didn't refresh. -AXE-9343
• PST exports of Outlook emails in languages other than English included characters that were not properly encoded and text displayed incorrectly. -AXP-3458
• If you clicked the Regex / GREP checkbox before entering a keyword, AXIOM Process would crash. -AXP-7978
• PST exports of Outlook emails in languages other than English included characters that were not properly encoded and text displayed incorrectly. -AXP-3458
• AXIOM would appear to hang while processing WeChat data that included a large number of voice memos (.aud or .opus file formats). -MA-3103
• If you set the saved picture size to a width or height greater than 256 pixels, picture artifacts were incorrectly resized to a maximum of 256 pixels. -COMP-857
• Improvements to parsing WeChat messages from iOS devices. -MA-3056
• In some cases, exceptions were thrown when carving Snapchat messages from iOS devices in AXIOM 5.0.0. -MA-3084
• In some cases, files from the .Trash folder were missing from the Trash Items artifact in reports. -COMP-1311
• Message direction was incorrectly displayed in the chat thread for Telegram messages from iOS devices. -MA-3029
• Some .lnk files that were available in the File system explorer did not appear in the LNK Files artifact in the Artifact explorer. -COMP-1376
• When carving .ppt files from a .vmdk image, artifacts related to the .vmdk image were incorrectly included in the PowerPoint artifacts category. -COMP-1388
• Exporting a case that included a large number of chat threads would take a long time. -CRA-1506

Known issues

• To search for information about known issues, visit the knowledge base at support.magnetforensics.com.