Artifact updates

Android

Bluetooth Devices

Chrome

Outlook Email

SMS/MMS

Snapchat

Telegram Messages

Telegram Users

WhatsApp Chats

iOS

Apple Keychain

Chrome Logins

Outlook Email

Photos Media Information

WhatsApp Messages

macOS

Outlook Email NEW

Cloud

Google Drive Activity NEW

Windows

Bitcoin

Windows Mail

Videos

YARA Rules

Use YARA rules to identify matching files in an image. Use any of the rule sets included in AXIOM Process or you can import or manually create your own rule sets.

Queued collections

You can now set up a queued collection to download targeted locations and a full memory dump from multiple endpoints in sequence. Endpoints must all use the same agent and share collection details. You can also customize how the queue is managed, such as how to operate around an offline endpoint. The feature also includes the ability to monitor the status of evidence collection.

Outlook Email recovery

With added support for the HxStore format, AXIOM Cyber can now recover emails from the following locations:

Outlook Email for Android
Outlook Email for iOS
Outlook Email for macOS
Windows Mail

Magnet AXIOM Cloud Authenticator

The Magnet AXIOM Cloud Authenticator provides a Chrome browser extension to authenticate a Google account. This authentication method provides the highest level of access to data in a Google account.

Cloud insights dashboard

The Case dashboard now includes an Insights section where you can view your case's potential cloud evidence leads.

View account details for recovered cloud accounts in your case.
View a list of potential artifacts that can be recovered from each account, and learn more about each artifact in the Artifact Reference Guide.
Attempt to access accounts using recovered usernames, passwords, and tokens.
Use other access methods, such as public activity and warrant returns, to collect more data from each account.

Dark mode

AXIOM Examine now runs in dark mode! Use dark mode to reduce eye strain when you spend long periods of time examining evidence.

Artifacts

Android Bluetooth Devices | Android: Updated support to provide additional Bluetooth devices from backup files. [Android 12]
Bitcoin | Windows: Updated support to avoid excessive RAM usage.
Chrome Logins | iOS: Added support for a new GUID fragment which can be used to look up the password in an Apple keychain.
Chrome | Android: Added decryption support for Chrome Logins.
Google Drive Activity | Cloud: Added support for acquiring Google Drive Activity from a user or admin Google account.
Outlook Email | iOS and Android: Added support for the HxStore format to support recovering emails.
Outlook Email | macOS: Added support for recovering emails, including support for the HxStore format.
Photos Media Information | iOS: Updated support to recover missing videos and images.
SMS/MMS | Android: Updated support for carvers to report the local user (sender/recipient) and the received/sent date correctly.
SMS/MMS | Android: Updated support to enhance recovery of Samsung SMS blocked messages.
Snapchat | Android 12: Updated support for Accounts Information artifact. [11.65.1.32]
Telegram Messages | Android: Added support for recovering attachments and updated carving support for all message types.
Telegram Users | Android: Updated support for recovering all user types and profile photos.
Updated support for Cloud Passwords and Tokens to include Uber Accounts.
Videos | Windows: Updated support to respect Saved video size option.
WhatsApp Chats | Android: Updated support to include Unread message count and Missed call count fragments. [2.21.15.20+]
WhatsApp | iOS: Updated support for recovering deleted messages from the latest version.
Windows Mail | Windows: Added support for the HxStore format to support recovering emails.

Remote acquisition

Added support to include a hyperlink for the agent saved location after creating an agent.
Updated support for AXIOM Process to resume a physical full disk data collection after the endpoint restarts.
The following Linux distributions are now supported for remote acquisitions: RHEL 6.x, 7.x, 8.x, CentOS 6.x, 7.x, 8.x, Amazon Linux 2, Ubuntu 21.04. For operating system requirements, see "Acquiring evidence from an endpoint" in the AXIOM Cyber User Guide.

Cloud

You can now authenticate a Google account using the Magnet AXIOM Cloud Authenticator Chrome browser extension.

Processing

You can now use YARA rules to identify matching files in an image.
You can now load images from GrayKey category based extractions of iOS devices.
You can now load images from GrayKey category based extractions of Android devices.

Examining

In portable cases, the Case dashboard now includes links to online tutorials and the quick start guide.
On the Case dashboard, you can now gain insight into your case's potential cloud evidence leads.
Performance improvements to tagging in AXIOM Examine.
When you select a cloud account on the Cloud insights dashboard in AXIOM Examine, you can click an artifact in the Potential artifacts section to learn more about the data that you might be able to recover from the account.
When you select an access method from the Cloud insights dashboard in AXIOM Examine, a window will appear where you can open AXIOM Process and acquire or load evidence from the selected account.
You can now change the AXIOM Examine display theme to dark mode.

Licensing

If your organization uses AXIOM with an LLS license, you can now create up to two administrator accounts to view and release your licenses.
If your organization uses AXIOM with an LLS license, you can delete an administrator account using a second administrator account.

Bug fixes

The remote acquire SSL certificate expired. -CRA-2118
Improved reporting on folders found while enumerating over the file system. -AXP-9528
If you tried to open another case from AXIOM Examine when viewing a video in the File systems explorer, AXIOM Examine would crash. -AXE-10182
Sometimes, HTML and PDF reports were failing to be exported. -AXE-10218
Sometimes, when creating a Project VIC/CAID export, if you selected the option to export items missing from the CAID database, some media already in the database would also be exported. -AXE-10127
To resolve an issue around case sensitivity when adding keyword lists to a case, all "artifacts only" keyword searches are now case-insensitive. To learn more, see "Artifacts only" search is case-sensitive -AXE-10274
When Live Photo artifacts were exported, the MOV file was incorrectly saved as a HEIC file. -AXE-10240
When generating large Project VIC exports, an "out of memory" error would occur and the export would fail. -AXE-8848
AXIOM Process would sometimes crash when processing a GrayKey image that included certain iOS iMessage data. -MA-3913
AXIOM reported the local user (sender/recipient) and the received/sent date for Android SMS and MMS messages incorrectly. -MA-3721
Improvements to displaying UTF-8 encoded characters recovered from the Apple Keychain. -MA-3938
The Sent By Siri fragment did not indicate messages were sent by Siri in iOS 13 and iOS 14. -MA-3969
The URL Analyzer was reporting blank timestamps when other timestamps were available. -MA-3987
There was some data missing from carved text messages from devices running iOS. -MA-3903
Updated support to fix Chrome login decryption support for Windows. -COMP-1731
When running datasets, providing the ProtonMail decryption key was causing less hits. -MA-4013
Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
When acquiring a Facebook public account, clicking back would launch the login dialog. -CAO-4462

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.