Artifact updates

Android

Contacts

Signal

Snapchat

Zello Audio Messages NEW

Windows

Signal

EML(X) Files

iOS

Apple Keychain

PowerLog In Call Service NEW

Signal

Zello Audio Messages NEW

Cloud

Google Drive

Chromebook

Device Information NEW

Downloads NEW

Extensions NEW

Offline Storage NEW

Recent Tasks NEW

Trash Items NEW

Google Workspace acquisition enhancements

We've redesigned the Cloud acquisition workflow for Google Workspace!

Understand the type of data you can expect to acquire based on the method you choose with improved authentication method selection.
When signing in with an administrator account, select your access level to either access both admin and user account data or admin account data only.
After selecting the user accounts you want to acquire evidence from, choose the specific data you want to acquire for each account, including a new option to acquire audit logs at the user level.
Customize the Google account and application data you want to acquire.
Recover information about a file's version history in Google Drive

Manage agents and endpoints

We've updated the "Manage agents and endpoints" screen to give you more information and more flexibility when deploying your agents and connecting to endpoints:

View details about your agents such as Agent ID, file name, saved location, and more.
Create a new agent or deploy an existing agent to a new endpoint.
View details about the endpoints you previously deployed agents to such as hostname, IP address, agent status, and more.
Connect to an agent previously deployed to an endpoint or redeploy an expired agent.

Chromebook artifacts

We're introducing even more support for Chromebook images. When you load Chromebook images in AXIOM Process, retrieve data from new, dedicated Chromebook artifacts, including Device Information, Downloads, Extensions, Offline Storage, Recent Tasks, and Trash Items.

For more information about these new artifacts, and all supported artifacts, review the Chromebook section of the Artifact Reference Guide.

Artifacts

Contacts | Android: Updated support to include roaming artifacts from calllog.db, including total contact call duration and the picture associated with the contact.
Device Information | Chromebook: Added support for recovering information about the physical device, such as model information, the software version, region information, and the latest Chrome OS version.
Downloads | Chromebook: Added support for recovering file download information from a recovered Chromebook device.
EML(X) Files | Windows: Performance improvement when carving the EML(X) Files artifact.
Extensions | Chromebook: Added support for recovering information about the permissions a plugin or extension has, such as active, granted, or withheld permissions.
Google | Cloud: Added support for recovering information about a file's version history in Google Drive.
Offline Storage | Chromebook: Added support for recovering files that primarily exist online but have also been saved to local storage on the Chromebook device for offline use.
Powerlog In Call Service | iOS: Added support for recovering information about when an application on the device was used to perform a call service.
Recent Tasks | Chromebook: Added support for recovering recent OS tasks recovered from a Chromebook extraction.
Signal Messages | Android: Updated support for Groups to parse Group Update messages.
Signal Messages | iOS: Updated support to parse missing Recipients data in messages. [5.21.0]
Signal | Android: Updated support for the latest version and added support for decrypting WAL files. [5.23.8]
Signal | Windows: Updated support for recovering more data from messages.
Snapchat | Android: Updated support to retrieve snaps and other media files. [11.4]
Trash Items | Chromebook: Added support for recovering information about the items that a user has sent to the trash.
WhatsApp | Android: Updated support for Live Location media caption. [2.21.14.24]
WhatsApp | Android: Updated support for recovering messages, chats, and groups. [2.21.15.20]
Zello | iOS and Android: Added support to recover the audio for sent messages.

Remote acquisition

Deploy and create agents, easily connect to an agent previously deployed to an endpoint, view the status of all of the available endpoints for an agent, and more—all from the updated "Manage your agents and endpoints" screen.

Cloud

Improved workflow for Google workspace account authentication and data selection. This update includes the ability to specify the data acquired from each account, and whether you are acquiring data from users, the administrator, or both.
You can now acquire Google audit logs at a user level.

Processing

In AXIOM Process, you can now add your own case types to the list of types.

Examining

AXIOM Examine now switches to Software rendering mode when it detects a crash while trying to render the UI. You can turn off Software rendering mode in Tools > Settings. To learn more, see Running AXIOM Examine in Software rendering mode.

Bug fixes

Updated support to enable the agent to start properly on a computer that has FIPS compliance enforced. -CRA-521
In Timeline view, when a tag was applied to multiple selected items, it would take a significant amount of time and not all of them would be properly tagged. -AXE-9433
Sometimes, AXIOM Examine would crash when trying to play videos. -AXE-9520
Sometimes, when media evidence in your case was recovered from internet browser artifacts, the Media explorer index would fail to build and the Media explorer would crash. -AXE-9696
When a carved picture was exported using the "Save artifact to" feature, two duplicate picture files were being created. -AXE-8409
When loading an AFF4 image, AXIOM Process would sometimes report that there were illegal characters in the file path. -AXP-7404
When the time zone was adjusted in AXIOM Examine, the scan date was being incorrectly adjusted to reflect this setting, rather than displaying the correct time when the scan took place. -AXE-9521
When you changed the time zone setting in AXIOM Examine and created an export, the evidence would be set to UTC+0:00, rather than the time zone you selected. -AXE-9709
When you went from the World map view in the Artifacts explorer to the Timeline explorer, and then back to the World map view, AXIOM Examine would crash. -AXE-9705
EXIF data for videos was incorrectly processed as Local time instead of UTC. -MA-3428
Updated support for carvers to retrieve missed hits from a calllog.db-wal by processing database support files. -MA-3381
When processing an iOS keychain file, some keys in the plist file were not parsed. -MA-3480

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.