Artifact updates

Android

Grindr

Messages

Skype Activity

WeChat

Wickr

Zello Messages NEW

Zello Profiles NEW

iOS

Apple Mail

Apple Notes - Voice

Facebook Messenger Chats

Google Photos

Grindr

Owner Information

Photos

Safari History

Skype Activity

Snapchat

Tumblr

WeChat

Zello Messages NEW

Zello Profiles NEW

Windows

LNK Files

Microsoft Office Backstage NEW

Microsoft Office Documents

Skype Activity

Cloud

Facebook Public Activity Profiles

Find matching identifiers across cases using Magnet Prague (beta)

Magnet Prague allows you to integrate a centralized database in Magnet AXIOM, and begin to search for identifiers of interest across cases.

Integrate Magnet Prague with AXIOM Examine to search for matching identifiers from other cases and upload identifiers from your case.
The Magnet Prague database can store people identifiers, such as email addresses or phone numbers, and device identifiers, such as camera serial numbers or phone IMEIs.
To download the beta version of Magnet Prague and its installation guide, visit Magnet Idea Lab.
More details...

Search, sort, and filter the files and folders from a remote computer prior to acquisition

To search, sort, and filter the files and folders from the remote computer in AXIOM Process prior to acquisition, configure the agent to start downloading information about the file system structure as well as file and folder metadata.

After connecting to the remote computer, the agent builds an index of the file system structure to help you get to the evidence faster.
Apply date range filters, search the file tree for words or search terms in the selected folder, and sort and filter by file name, extension, or size.
More details...

Artifacts

AXIOM had frequently missing thumbnails after processing video files using FFMPEG.
Apple Notes - Voice | iOS: Updated support for recovering the correct file path of the original recording for edited voice notes. [14.0]
Grindr | Android: Added support for recovering social network information, including Facebook, Instagram, and Twitter account names for Grindr Buddies.
Grindr | iOS: Updated support for recovering Messages and Group Members. [7.8.0]
Grindr | iOS: Updated support for recovering conversation partner information. [7.6.0]
Microsoft Office Backstage Items | Windows: Added support for recovering information about items found in the Backstage View of Microsoft Office applications. [16.0]
Owner Information | iOS: Added support for recovering Directory Services Identifier (DSID) for.
Photos | iOS: Updated support for Photos Media Information from the latest version. [14.0]
Skype | Android, iOS, and Windows: Updated support for Skype Activity to use Created Date/Time as a fallback fragment for chat threading.
Snapchat | iOS: Added support for carving display names.
Telegram | Android: Updated support for recovering user information from deleted accounts. [7.6]
Tumblr | iOS: Updated support for recovering Chat Messages. [20.1]
WeChat | Android: Improvements to WeChat including recovering more information about call messages, such as when calls are declined or cancelled and the duration of the message, recovering and displaying previews of attachments in chat threads, recovering more message types, and recovering raw XML data for Picture, Location, Notice, and Pay message types. -MA-2616
WeChat | iOS: Improvements to WeChat including recovering the duration of messages, recovering more message types, and recovering raw XML data for Picture, Location, Notice, and Pay message types. -MA-3161
WhatsApp | Android: Updated support to include recovering messages from the latest version. [2.21.9.13]
Wickr | Android: Updated support for file carving. [5.76.5]
Zello | Android: Added support for recovering profiles and messages. [4.96.3]
Zello | iOS: Added support for recovering profiles and messages. [4.98.1]
Facebook Public Activity | Cloud: Added support for recovering the Facebook profile of the target account.

Remote acquisition

You can now search, sort, and filter the files and folders from a remote computer in AXIOM Process prior to acquisition. Configure an agent to start downloading information about the file system structure and file and folder metadata after connecting to a remote computer. After the agent builds an index of the file system metadata, apply date range filters, search the file tree for words or search terms in the selected folder, and sort and filter by file name, extension, or size.

Cloud

Improvements to timeout and logging when scanning a WhatsApp QR code.
In March 2021, the format of warrant returns provided by Apple changed. For information about processing the new warrant return format, log in to the Customer Portal to review the Prepare Apple Warrant Returns for acquisition article.
When you right-click a Facebook Cloud Passwords and Tokens artifact and select Add new cloud evidence using passwords / tokens, AXIOM Process will launch and automatically log you in to the selected Facebook account.
You can now check whether the Instagram account you want to acquire exists and if the account is set to private or public.

Processing

Added support for 5 digit extensions for DD raw images.
Custom file type artifacts now include a thumbnail for parsed hits.
Passware SDK has been updated to the latest version. This update also resolves an issue where decryption would fail even when the BitLocker key was correct.
Users with an active CLS administrator account can now add one additional administrator directly from the Magnet License Manager, without the need to contact Magnet Technical Support.

Examining

AXIOM now displays a warning message if short keywords (2 or 3 characters) are being added to a case, as these keywords can return too many irrelevant results.
By default, you can no longer navigate to the internet using links in the Preview card. You can enable internet navigation in Tools > Settings.
You can now create templates to use with KML exports.
You can now integrate a beta version of a Magnet Prague database with AXIOM Examine. After you or someone on your team has installed the beta version of Magnet Prague, configure it in Tools > Settings > Product integrations. Using the Magnet Prague beta, you can search your case for identifier matches to your teammates' cases, and you can also tag identifiers of interest and upload them to your team's database.

Bug fixes

In AXIOM Examine 5.1, the world map view was loading very slowly. -AXE-9475
In some cases, keywords or keywords could not be loaded from the application settings database. -AXP-7981
In the text and hex decode view, Mac Absolute timestamps were being displayed with the wrong year. -AXE-9342
PDF reports with large amounts of threaded SMS/MMS message would fail to export. -AXE-8578
PST exports would fail when exporting a large amount of Outlook evidence. -AXE-8997
When a TIF file was exported using the "Save artifact to" feature, the exported file would not match the file in the case. -AXE-8873
When you would try to update from the AXIOM Examine Help menu, nothing would happen. This issue didn't affect AXIOM installations with the Passware plugin. -AXE-9445
AXIOM was not correctly parsing .msg files from an Encase LX01 image. -COMP-1422
AXIOM was not correctly parsing the embedded target path/filename in LNK files. -COMP-1352
AXIOM would crash with an Access Violation Exception (AVE) when processing certain images. -MA-3189
Android Messages incorrectly represented the Received Date/Time as the Original Transmit Date/Time. -MA-3200
Message data from Apple Mail in iOS 14 was not correctly parsed and HTML previews were not available. -MA-3083
Original Path data was not recovered for Apple Notes Voice for iOS 14 devices. -MA-2240
Safari History incorrectly included default URLs from AutoFillQuirks.plist. -MA-3088
The incorrect physical sector location was displayed for carved legacy Office Document files using the Microsoft Compound File Binary Format. -COMP-1375
Improvements to recovering Google Photos Album Comments and added support for recovering Media ID for iOS. -MA-3172
Box.com file failed to download when path contained non-ascii characters. -CAO-3873
When you clicked the WhatsApp QR code access, the QR code pop-up did not load and AXIOM Process froze. -CAO-3978

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.