Artifact updates

Android

Beam Transactions NEW

Coinbase NEW

Exodus NEW

Grindr

ProtonMail Contacts NEW

ProtonMail Emails NEW

Signal

Wickr

macOS

PowerLog Battery Shutdown NEW

PowerLog Application State NEW

Trash Items

iOS

Beam Transactions NEW

Coinbase NEW

Exodus NEW

Facebook Messenger

PowerLog Battery Shutdown NEW

PowerLog Application State NEW

Signal

Snapchat

Wickr

Windows

Rebuilt Desktops

Upload evidence from Magnet AXIOM to Magnet REVIEW

If your organization has a Magnet REVIEW server, you can now integrate Magnet AXIOM with Magnet REVIEW for a streamlined upload experience.

Integrate Magnet REVIEW using your organization's server address in Tools > Settings > Product integrations
Using the AXIOM exporting wizard, select the evidence you want to upload directly to a new or existing Magnet REVIEW case
Learn more about Magnet REVIEW

Process XFS file systems

XFS, a file system commonly paired with RedHat Linux (RHEL), Amazon Linux, and CentOS operating systems, is now supported.

Due to its scalability and resilience, corporations employ XFS on high availability, high value systems.
Along with this update, when a logical volume is identified, you will see LVM noted before the volume group.

Artifacts

BEAM Wallet | iOS and Android: Added support for recovering information about transactions and addresses from BEAM Wallet.
Coinbase | iOS and Android: Added support for recovering transactions, addresses, and purchases made using Coinbase.
Exodus | iOS and Android: Added support for recovering information about transactions made using Exodus.
Facebook Messenger | iOS: Updated support to improve carving on Users Contacted fragment. [334.2]
Facebook Messenger | iOS: Updated support to recover artifact hits that were previously being dropped. [334.2]
Grindr | Android: Updated support for the latest version of Grindr Messages. [7.18]
PowerLog Application State | iOS and macOS: Added support for parsing information about application states from the PowerLog.
PowerLog Battery Shutdown | iOS: Added support for recovering information about the device when the battery died.
ProtonMail Emails | Android: Added support for ProtonMail Emails and ProtonMail Contacts.
Rebuilt Desktops | Windows: Updated support to add a standardized date in the taskbar date/time fragment.
SMS/MMS | Android: Added support to parse SMS/MMS messages from the Message table in the mmssms.db.
Signal and Wickr | iOS and Android: Updated support to improve SQLite WAL Files decryption algorithm.
Signal | Android: Messages that are sent as group updates can now be decoded.
Signal | iOS: Updated support to recover missing hits for corrupted WAL File. [5.21.1, 5.23.1+]
Snapchat | iOS: Updated support to retrieve missing hits from multiple artifacts.
Telegram | macOS: Added support for parsing the database through manual decryption with an option to enter the password in the options dialog if one was used to encrypt the local database.
Trash Items | Apple: Updated support for macOS Trash Items to fix the Added Date/Time fragment.
WeChat | Android: Updated support by providing WeChat password in the logs.
WhatsApp | iOS: Added support for Accounts Information artifact.
Updated support to enable performance improvements for scanning PST files.

Remote acquisition

When configuring an agent, you can now choose to manually set a proxy server by providing the proxy server IP address and the proxy server port. Manually configure proxy settings if you want to configure a Windows agent to survive the shutdown of an endpoint as agents cannot auto-detect proxy settings when running as a Windows service.

Processing

You can now parse LVM2 logical volumes that contain XFS file system partitions. Now, when a logical volume is identified LVM is displayed before the volume group.

Examining

When you create a CSV, HTML, Excel, Load File, PDF, or XML report, there is now a column that displays the Item ID for each artifact.
When you upload evidence from Magnet AXIOM to Magnet REVIEW, you can view details about the upload progress and the log files.
When you view evidence in the Artifacts explorer, there is now a column that displays the Item ID for each artifact.
You can now integrate Magnet REVIEW to upload evidence directly from Magnet AXIOM to your organization's Magnet REVIEW server.
You can now upload evidence directly from the AXIOM Examine exporting wizard to your Magnet REVIEW cases.

Bug fixes

AXIOM Process was unable to open .zip files with comments at the end of the file over 0x3740 bytes or .zip files with non-zip data at the beginning of the file. -AXP-8437
Sometimes, when performing an advanced search, AXIOM Examine would crash. -AXE-9802
When a case had no geolocation data, World map view would keep loading, and AXIOM Examine had to be closed. -AXE-9718
When a global search filter was applied in the File system explorer, the sort settings were ignored and other filters couldn't be added. -AXE-9736
AXIOM Process would sometimes hang when searching a migration.db file from a GrayKey image. -COMP-1544
When decrypting Wickr Messages for Android, if you entered more than one key in the options dialog, only one was getting saved. -MA-3509
Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
The Dropbox screen would appear blank after authenticating. -CAO-4190
Twitter public cloud collection would fail with the error "Completed with errors". no artifacts are inserted into the case. -CAO-2599
Valid Facebook profiles would not validate. -CAO-4144
When acquiring OneDrive, not all files would be acquired. -CAO-3790
When you clicked the WhatsApp QR code access, the QR code pop-up did not load and AXIOM Process froze. -CAO-4211

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.