Release Notes

Magnet AXIOM Cyber 6.1.0.31400 April 29, 2022

Artifact updates

Android

Aloha Browser

Facebook User/Friends

Gmail

Google Accounts

Google Meet Meeting History

KakaoTalk

LINE Messages

MEGA

Private Photo Vault

Signal Conversations

Snapchat

TextMe

TextNow Chat

TextNow Profile

TextPlus Calls

TextPlus Users NEW

UC Browser History

Viber

Yahoo Webmail Accounts

Yandex

Zalo

iOS

Apple Notes

Discord

DuckDuckGo Bookmarks

Edge Chrome Logins

Gmail

Home Screen Items

iMessage/SMS/MMS

MEGA

Slack Users

Snapchat

Snapchat Chat Messages

Viber

Viber Messages

Wickr Me

macOS

Edge Chrome Logins

USB Connection History

Cross-platform

Cloud Passwords and Tokens

Identifier People

Passwords and Tokens

Expanded support for HxStore format

Artifacts

• Aloha Browser | Android: Updated support for recovering downloads. [3.6.4]
• Apple Notes | iOS: Updated logging to indicate which password was used to decrypt successfully or which password did not work for decryption.
• Cloud Passwords and Tokens | Cross-platform: Added support for classifying keychain records as Microsoft. Microsoft passwords and tokens found in Apple Keychain Generic Passwords are being parsed and pulled into the Cloud Passwords and Tokens Refined Result.
• Cloud Passwords and Tokens | Cross-platform: Improved logic for pulling Apple tokens from Apple Keychain Generic Password into the Cloud Passwords and Tokens Refined Result.
• Discord | iOS: Updated support to message types previously reported as 0. [85.0]
• DuckDuckGo Bookmarks | iOS: Updated support for recovering bookmarks. [7.65.7]
• Edge Chromium Logins | iOS and macOS: Added support for decrypting the Chrome Login passwords by using the keychain.
• Facebook User/Friends | Android: Updated support for recovering data from the latest version. [340.0.27]
• Gmail | Android and iOS: Updated support for recovering the sent and received date time values for emails. [2022.2.20.431583552]
• Google Accounts | Android: Updated support to recover Google Account data from multiple sources rather than just one Google app.
• Google Meet Meeting History | Android 12: Updated support for recovering meeting history from the latest version. [2022.3.6.433612476]
• Home Screen Items | iOS 15: Improved support for recovering hits for applications using BinaryPlist.
• Identifier People | Cross-platform: Added support for including people from Apple Keychain Generic Password in the Identifier People Refined Result.
• KakaoTalk | Android: Updated support to recover local user information. [9.7.5]
• LINE Messages | Android: Updated support to recover media attachments (pictures, stickers, and video). [12.22.2]
• MEGA | Android: Added support for recovering downloaded videos. [6.1.1]
• MEGA | iOS: Updated support for recovering voice messages and received media (pictures and videos) from chat participants. [7.2]
• Passwords and Tokens | Cross-platform: Added support for including passwords and tokens from Apple Keychain Generic Password in the Passwords and Tokens Refined Result.
• Private Photo Vault | Android 12: Updated support for recovering Album, Media, and Thumbnail artifacts. [3.2.2]
• Signal Conversations | Android: Updated support so that the location from the recipient table is no longer reported twice.
• Slack Users | iOS: Updated support for recovering Slack Users. [21.12.10]
• iMessage/SMS/MMS | iOS: Improvements to App Intents plist carver to avoid crash scenario and updated support for iOS 14 AppIntent carver with protobuf.
• iMessage/SMS/MMS | iOS: Enhanced carving support for devices running iOS 14.x - 15.2.1.
• Snapchat Chat Messages | iOS: Updated support for recovering message media attachments. [11.48]
• Snapchat | Android: Updated support to recover media files that were not being recovered in versions 11.64-11.70.
• Snapchat | iOS: Updated the decryption options dialog for My Eyes Only and Memories to improve the description of what each key does.
• TextMe | Android 12: Updated support for recovering message media attachments. [3.33.2]
• TextNow Chat | Android: Added support for voice messages and message attachments.
• TextNow Profile| Android: Updated support to recover the local user's phone number. [21.5.2.0]
• TextPlus Calls | Android: Updated support for recovering calls as well as username and display for calls. [7.8.4]
• TextPlus Users | Android: Added support for recovering Users. [7.8.4]
• UC Browser History | Android: Updated support for recovering browser history from the latest version. [13.4.0.1306]
• USB Connection History | macOS 12: Improvements to USB connection history.
• Viber | Android: Updated support to include chat threading.
• Viber | iOS: Updated support to recover Instant Videos and updated . [16.7.0]
• Viber | iOS: Updated parsing support to identify senders and recipients in group and individual chats.
• Viber Messages | iOS: Updated support for recovering calls, including no longer reporting blank values for Message and Type fragments. [17.0.3]
• Wickr Me | iOS: Updated support for the latest version of the app. [5.102]
• Yahoo Webmail Accounts | Android 12: Updated support to recover all accounts. [6.45.3.1608100]
• Yandex | Android: Updated support for recovering Top Sites and Logins. [21.11.0.251]
• Zalo | Android: Updated support for recovering media attachment files. [21.6.1]

Cloud

• Improvements to describing what information is collected when acquiring Facebook public activity.
• The following Snapchat features are now supported:
  • Chat threading
  • Chat media linking
  • IP History

Processing

• Improved performance when selecting File and Folder scans on systems where an exFAT drive is connected.
• If your organization uses AXIOM with an LLS license, you can now create up to two administrator accounts to manage your licenses.

Examining

• Performance improvements when you use the keyboard shortcut CTRL + A to select and tag all visible evidence in the Artifacts explorer.
• Various improvements to the appearance of Dark mode in AXIOM Examine.
• When you export evidence to a portable case, AXIOM Examine now creates an .exe file instead of a .bat file to open the portable case.
• When you include email attachments with an export, AXIOM Examine now exports the emails as .msg files.
• You can now use advanced keyword searches and column filtering in a portable case.
• You can now build and examine the Timeline explorer using a portable case.

Bug fixes

• Improved reporting for deleted files and folders that are being carved while processing. -AXP-9434
• Sometimes, chats in Conversation view wouldn't load, or would take a long time to load. -AXE-9986
• If the Timeline explorer was partially built, the Timeline would experience performance issues. AXE-10047
• Sometimes, the global search wouldn't work for Korean characters. This issue will be resolved in all cases created in AXIOM 6.1 and later. -AXE-10068
• When keywords were added to a case, no results were being found in memory dump evidence. -AXE-10247
• Snapchat messages weren't readable in Dark mode because they appeared with a transparent background. -AXE-10357
• You were unable to recover video files for Snapchat My Eyes Only hits. -MA-4091
• In newer versions of Snapchat Warrant Returns, chats were not parsed and media attachments were not linked to hits. -CAO-3527
• Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
• iMessages weren't parsed from iCloud backups for iOS 14.7 onwards. -MA-4083

Known issues

• To search for information about known issues, visit the knowledge base at support.magnetforensics.com.