Artifacts
- Attached Devices | iVe: Added support for recovering information about all the devices that have been attached to the various vehicles exported by iVe.
- Call Logs | iVe: Added support for recovering information about phone calls that were made by a user in the vehicle.
- Contacts | iVe: Added support for recovering information about contacts saved by the user.
- Device Info | iVe: Added support for recovering information about the vehicle and the infotainment system used.
- Events | iVe: Added support for recovering information about events between the device, the user, and/or the vehicle.
- Files| iVe: Added support for recovering information about files that the vehicle and the infotainment system have stored or read from the device.
- Google | iOS, Android, and Windows: Updated in-product icons for Google artifacts to reflect new Google Workspace branding.
- Metadata | iVe: Added support for recovering information about the application and vehicle.
- Routes | iVe: Added support for recovering information about the routes created by the user.
- SMS | iVe: Added support for recovering information about SMS messages that were sent and received by users in the vehicle.
- SMS/MMS | Android: When the Remove duplicates setting is turned on, the product will attempt to ignore carved hits that duplicate parsed hits for chat messages.
- Slack | iOS: Updated support to recover group messages. [21.7.20]
- Snapchat | Android: Updated carving support to display the correct local user name in the Recipient(s) fragment. [11.40.0.39]
- Telegram | Android: Updated support for recovering messages from the latest version. [7.8.1]
- Track Points | iVe: Added support for recovering information about trackpoints created by the user.
- Velocity Points | iVe: Added support for recovering information about the velocity of the vehicle at different times in a trip.
- Waypoints | iVe: Added support for recovering information about waypoints created by the user.
- WeChat | iOS: Updated support to improve Local user identification for both parsed and carved hits.
- Yahoo Mail | Android: Updated support to recover attachments up to version 6.29.2.
Remote acquisition
- All agents now contain a unique Agent ID to identify the agent in AXIOM Process. You have the option to customize the Agent ID during agent creation.
- You can now configure a default agent location on your examiner workstation. New agents are automatically saved to the agent default location.
- You can now deploy the same agent to multiple endpoints.
- You can now view more information about endpoints running an agent on the Connect to endpoints screen including hostname, IP address, agent status, and more.
Processing
- Performance improvements to how AXIOM scans artifacts.
- Start and end time in the Scan summary screen in Process and Examine, as well as the Case processing details card now indicates local time.
- You can now process data recovered using iVe and exported as IVO files for Magnet AXIOM using a dedicated workflow in AXIOM Process. Add IVO files through Evidence sources > Vehicles > iVe.
- You can now load archives created by the Magnet Chromebook Acquisition Assistant directly from the thumb drive.
- Case ID now displays in the title bar of AXIOM Process while image is processing.
Examining
- The World map view in AXIOM Examine now uses Open Street Map.
- When a crash occurs due to an outdated video driver or Windows version, a dialog now appears, prompting you to upgrade to the latest versions.
- You can now set up an offline map server and connect to it from AXIOM Examine.
Bug fixes
- Sometimes, Conversation view wasn't showing any chat threads in AXIOM Examine. -AXE-9474
- AXIOM was not correctly parsing the Message Status for some Live Location messages and incorrectly displayed Not received by Recipient. -MA-3392
- Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
- The Executed Flag fragment for Shim Cache is no longer parsed for Windows 10 as this data cannot reliably be confirmed to represent program execution in Windows 10. -COMP-1489
Known issues
