Artifact updates

Android

Breadwallet Events NEW

Breadwallet Transactions NEW

Coinomi Transactions NEW

Discord

Facebook Comments NEW

Facebook Messenger

Facebook Posts NEW

Facebook Tags NEW

Signal

Signal Decryption Validation for Media decryption

Signal Options Dialog

macOS

Facebook Messenger - Calls NEW

Facebook Messenger - Groups NEW

Facebook Messenger - Users Contacted NEW

Facebook Messenger - Messages NEW

File System Events

iOS

Breadwallet Transactions NEW

Coinomi Transactions NEW

Contacts

iMessage

Messages

Snapchat

Viber

Windows

Facebook Messenger - Calls NEW

Facebook Messenger - Groups NEW

Facebook Messenger - Messages NEW

Facebook Messenger - Users Contacted NEW

Telegram Media NEW

Preview geolocation data with the map preview card

For artifacts that contain geolocation data, you can now view world map previews from different explorers in AXIOM without having to open World map view. From the preview, you can open World map view with the artifact of interest shown on the map.

Remote collections for Linux

You can now acquire evidence from Linux endpoints!

Browse and acquire files and folders from a remote Linux file system. Supported distributions include RedHat Linux 8, CentoOS8, Amazon Linux 2, and Ubuntu.
Manually set a proxy server by providing the proxy server IP address and the proxy server port.
Search, sort, and filter the files and folders from a Linux endpoint by configuring the agent to start downloading information about the file system structure
Quickly select files and folders from the targeted locations list, which includes common items of interest for Linux computers such as system files, bash history, web browsing activity, and more.
For information, review the Acquiring evidence from an endpoint topic in the Magnet AXIOM Cyber User Guide.

Artifacts

Breadwallet Events | Android: Added support for Breadwallet Events.
Breadwallet Transactions | iOS and Android: Added support for Breadwallet transactions.
Chrome | Windows: Updated support to include the new "Login Data for Accounts" file location. [96.0.4664.93]
Coinomi Transactions | iOS and Android: Added support for Coinomi Transactions. [1.12.0 (iOS) and 1.24.2 (Android)]
Discord | Android: Updated support for recovering new messages and calls in the latest version. [85.13]
Facebook Messenger Calls | macOS: Added support for parsing call data recovered from Facebook Messenger.
Facebook Messenger Calls | Windows: Added support for parsing call data recovered from Facebook Messenger.
Facebook Messenger Groups | macOS: Added support for parsing data about group chats on Facebook Messenger.
Facebook Messenger Groups | Windows: Added support for parsing data about group chats on Facebook Messenger.
Facebook Messenger Messages | macOS: Added support for Facebook Messenger Messages.
Facebook Messenger Messages | Windows: Added support for Facebook Messenger Messages.
Facebook Messenger Users | macOS: Added support for parsing information about users contacted from the device using Facebook Messenger.
Facebook Messenger Users | Windows: Added support for parsing information about users contacted from the device using Facebook Messenger.
Facebook Posts | Android: Added support for Facebook Posts.
Facebook Tags | Android: Added support for Facebook Tags.
File System Events | macOS: Updated support for recovering file system events from devices with M1 chips.
iMessage | iOS: Updated support to recover iMessage Data in AppIntent folder.
Signal | Android: Added support to validate media decryption.
Signal | Android: Updated support for options dialog to accept media decryption key.
Telegram Media | Windows: Added support for Telegram Media.
Viber | iOS: Updated support for recovering attachments in messages from the latest version.
WhatsApp Messages | iOS: Updated support to parse the local user data for version 2.17 and 2.18.
WhatsApp | iOS: Updated support for Messages to recover local user information.

Remote acquisition

Updated support to include a detailed log of all the files that were collected and could not be collected during remote acquisitions.
You can now acquire files and folders from a Linux endpoint. Support includes Linux-specific targeted locations, indexed file system searches, and manual proxy configuration.

Cloud

Dropbox sessions will no longer expire during account acquisitions.

Processing

In AXIOM Process, sealed volumes are no longer selectable as they contain read only data that is not pertinent to a case.
Performance improvements for processing volumes containing a large number of deleted files.

Examining

When keyword search results were highlighted, SMS/MMS text wasn't readable in the Preview panel.
You can now view a World map preview for artifacts with geolocation data.

Bug fixes

AXIOM Process would sometimes fail when processing a macOS sealed volume. -AXP-7642
After the keyword post-processing job finished, the Artifacts left pane wouldn't refresh to display keyword snippets. -AXE-9892
An error would occur when AXIOM extracted files from some segmented ZIP files -AXP-4269
Sometimes, chat threads were not appearing properly. -AXE-9955
Sometimes, in PDF reports, email bodies were appearing blank. -AXE-8920
Sometimes, when a case was opened, AXIOM Examine wouldn't display all the evidence that was processed. -AXE-9929
The search would sometimes fail when hits were found in the $I30 index but not in the Master File Table. -AXP-7583
When a PDF report was created that include carved and parsed hits, the attachments for parsed hits would not be included. -AXE-9866
When a column filter, then a basic filter, then an advanced filter were applied, AXIOM would crash. -AXE-9720
When processing macOS Big Sur images, the Spotlight attributes panel would not appear. -AXP-8184
When the UI language was set to anything other than English, evidence could not be successfully uploaded to Magnet REVIEW. -AXE-9864
When trying to view some XML .plist files in the File system explorer, an error message would appear in the Preview window. -AXE-9835
When you changed the time zone setting in AXIOM Examine and created an export, the evidence would be set to UTC+0:00, rather than the time zone you selected. -AXE-9709
The Message Sent/Received Date and Time from Signal.db's SMS Table was incorrectly reported for Signal for Android. [5.25.8] -MA-3695
Updated support for Recycle Bin to reduce scan times and false positive hits. -COMP-1598
Updated support to recover hits from Facebook Messenger 313.0. -MA-3600
Updated support to remove duplicate hits for Messages and Contacts. -MA-3698
Video attachments were missing for Facebook Messenger for Android. [333] -MA-3691
In a Google Warrant Return, the UTC was misrepresented as local time. -CAO-3798
In a MEGA download, attachments would fail to write to a temp directory -CAO-3613
Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
The acquisition sometimes fails when acquiring Uber trip history. -CAO-4077
Uber acquisition would fail when acquiring an account with a large amount of data. -CAO-3014
When viewing Snapchat data, AXIOM Examine would not show the correct data for the column heading -CAO-4031
When you clicked the WhatsApp QR code access, the QR code pop-up did not load and AXIOM Process froze. -CAO-4211

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.