Artifact updates

Android

Android Call Logs

Android Contacts

Android Messages

Android SMS/MMS

Textfree Messages / Calls

Cloud

Cloud MBOX Emails

Cloud WhatsApp Chats

iVE

Files

All Platforms

Audio

Email Attachments Refined Result

Pictures

User Accounts Refined Result NEW

Video

iOS

Apple Mail

Apple Maps Searches

Apple Maps Trips

Apple Notes

iOS iMessage/SMS/MMS - App Intents NEW

iOS Maps

iOS Wi-Fi Profiles

Signal Messages

Signal Group Members

SIM Card Activity

Snapchat Cached Videos

Snapchat Chat Messages

Wallet Transactions

Wallet Payment Cards

macOS

Active Connections NEW

Apple Keychain

iCloud

iCloud Devices NEW

iCloud Server Files NEW

Network ARP Info NEW

Process List NEW

Windows

Active Connections NEW

DNS Cache NEW

Network ARP Info NEW

Operating System Information

Process List NEW

User Accounts - Windows NEW

Linux

Active Connections NEW

DNS Cache NEW

Network ARP Info NEW

Process List NEW

Email Explorer

In AXIOM Examine, you can now view Microsoft Outlook evidence in the Email explorer.

Select an email container to view emails in a folder structure that mirrors the application where the data was recovered.
View related artifacts and artifact details.
Tag and export email evidence directly from the Email explorer.
More details...

Search for known file hashes in VirusTotal

In this release, we've introduced the ability to check VirusTotal for known threats using a file's hash.

VirusTotal compares a file’s hash to its existing records to check if the file is a known threat.
AXIOM Examine will generate hash values for files that do not have a hash value.
More details...

Apple Mail improvements

In this release, we've introduced improvements to Apple Mail:

Improved email previewing so that marked up emails appear as they would on the phone.
Combined Apple Mail and Apple Mail Fragment into a single artifact to make reviewing the evidence easier.
For all email artifacts, empty email attachments are no longer reported in the Email Attachments refined result.
More details...

Artifacts

Active Connections | Windows, Linux, and macOS: Added support for recovering a list of all active and inactive connections, as well as the TCP and UDP ports the device is currently listening to.
Android Call Logs | Android: Updated carving support for Android Call Logs. [Android 12]
Android Contacts | Android: Updated parsing and carving support for Android Contacts. [Android 12]
Android Messages | Android: Updated parsing and carving support as well as updated support for previewing attachments in the chat thread. [Android 12]
Android SMS/MMS | Android: Updated support for previewing attachments in the chat thread. [Android 12]
Apple Keychain | macOS: Updated logging to indicate which password was used to decrypt the keychain successfully or which password did not work for decryption.
Apple Mail | iOS: Improvements to previewing emails so that marked up emails appear as they would on the phone and combined Apple Mail and Apple Mail Fragment into a single artifact to make reviewing the evidence easier.
Apple Maps | iOS: Updated support for recovering address and search term information for Apple Maps Searches and Apple Maps Trips. [iOS 15]
Apple Notes | iOS: Updated support for recovering attachments and encrypted picture attachments from secured Apple Notes and updated support for recovering Created Date/Time. [iOS 15]
Apple Notes | iOS: When you include the Apple Keychain when processing an iOS image, the product can decrypt secure Apple Notes from devices configured with biometric authentication. [iOS 15.4.1]
Apple Wallet | iOS: Updated support for recovering Wallet Transactions and Wallet Payment Cards. [iOS 15]
Cloud WhatsApp Chats | Android and iOS: Updated support for WhatsApp chats obtained from the cloud.
DNS Cache | Windows and Linux: Added support for recovering a list of all the cached DNS Records for the device.
Email Attachments | Refined Result: Empty email attachments are no longer reported in the Email Attachments refined result.
iCloud Devices | macOS: Added support for recovering a list of devices that have access to the iCloud.
iCloud Server Files | macOS: Added support for recovering information about files that have been imported from the local computer or synced remotely from the iCloud Drive folder on a macOS machine.
iCloud | macOS: Updated the application name of iCloud Local Files to iCloud.
iOS iMessage/SMS/MMS - App Intents | iOS: Information recovered about application intents can now be found in its own artifact. Additionally, updated support to recover more iOS iMessage/SMS/MMS - App Intents hits from the KnowledgeC database.
iOS Maps | iOS: Updated support for the latest version, including support for recovering the map tile image and accessed date/time. [iOS 15]
iOS Wi-Fi Profiles | iOS: Updated support for recovering iOS Wi-Fi Profiles from the latest version. [iOS 15]
iVe | Vehicle: Updated instances of "phone" to "devices" in the Artifact Reference guide to more clearly indicate that other types of devices could be connected to the vehicle.
Network ARP Info | Windows, Linux, and macOS: Added support for recovering a list of cached Address Resolution Protocol (ARP) entries.
Operating System Information | Windows: Added support for recovering information about the domain that the computer is currently connected to.
Operating System Information | Windows: Updated support for correctly recovering product name information for computers running Windows 11.
Process List | Windows, Linux, and macOS: Added support for recovering a list of all processes currently running on the target machine.
Signal | iOS: Updated support for recovering messages and group members. [5.29.0]
SIM Card Activity | iOS: Updated carving support for SIM Card Activity. [iOS 15]
Snapchat | iOS: Updated support for recovering attachments from deleted Snapchat Chat Messages and renamed Snapchat Received Videos to Snapchat Cached Videos.
Textfree | Android: Updated support for recovering attachment files. [8.76+]
User Accounts | Refined Result: Added a new refined result that contains all of the local user's application accounts that are found on the system.
User Accounts - Windows | Windows and Windows Phone: Updated the name of the User Accounts artifact to User Accounts - Windows.

Remote acquisition

You can now include volatile artifacts as part of a targeted location collection.

Cloud

You can now acquire the last three months' of WhatsApp messages and conversations using the QR code method.

Processing

SQLite errors and exceptions for the attachments database will now be logged in the log.txt file.
You can now open a browser to VirusTotal to search a file's hash value for any known information.

Examining

Snapchat messages are now readable in Dark mode as they no longer appear with a transparent background.
The appearance of the AXIOM Examine Settings window has been improved to allow for more user-friendly navigation.
When you export evidence to a portable case, AXIOM Examine now creates an .exe file instead of a .bat file to open the portable case.
When you perform an advanced keyword search, matching keywords in the results are now highlighted.
You can create exports from the Email explorer.
You can now build the Email explorer in AXIOM Examine, which you can use to view Microsoft Outlook emails similarly to how they appear in the original application.
Using Magnet.AI categorization, you can now search for pictures that contain handwriting.

Bug fixes

Korean text was not being rendered correctly in document previews. If you copied and pasted this text and used it to search your evidence, the results would be found but not highlighted in the document. -AXE-10374
.m4a and .m4r files were incorrectly categorized as Video artifacts instead of Audio artifacts. -COMP-1729
Connections for some iVe artifacts did not build properly in the Connections explorer. -MA-4208
Improvements to the Cloud MBOX Emails to prevent redundant carving and duplicate hits. -COMP-1786

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.