Artifact updates

Windows

Skype Accounts

Windows Event Logs

Windows Event Logs - Firewall Events

Windows Event Logs - Networking Events

Windows Event Logs - Office Alerts Events

Windows Event Logs - Scheduled Task Events

Windows Event Logs - Script Events

Windows Event Logs - Services Events

Windows Event Logs - Storage Device Events

Windows Event Logs - System Events

Windows Event Logs - User Events

Windows Event Logs - User Pnp Events

Remote Desktop Protocol

Windows Search - Office Documents NEW

Windows Search - Outlook NEW

Windows Search - Internet Explorer NEW

Windows Search - Image NEW

Windows Search - Calendar NEW

Windows Search - Contacts NEW

MBOX E-mails

Cloud MBOX Emails

Cloud Gmail Messages

Cloud iCloud Mail

Scheduled Processes NEW

Services NEW

macOS

Find My Devices NEW

Find My Items NEW

Find My Locations NEW

iCloud Local Files

Skype Accounts

MBOX E-mails

Cloud MBOX Emails

Cloud Gmail Messages

Cloud iCloud Mail

Scheduled Processes NEW

Services NEW

Android

Android User Accounts

Outlook Email

Signal Users

Skype Accounts

Telegram Messages

WeChat Messages

MBOX E-mails

Cloud MBOX Emails

Cloud Gmail Messages

Cloud iCloud Mail

WeChat

WeChat Messages

Samsung Story Service NEW

iOS

Apple Maps Trips

Find My Devices NEW

Find My Items NEW

Find My Locations NEW

Signal Users

Skype Accounts

Snapchat Chat Messages

User Notification Events

MBOX E-mails

Cloud MBOX Emails

Cloud Gmail Messages

Cloud iCloud Mail

Refined Results

User Accounts

MBOX E-mails

Cloud MBOX Emails

Cloud Gmail Messages

Cloud iCloud Mail

Cloud

Linux

Scheduled Processes NEW

Services NEW

Only parse selected artifacts and reprocess artifacts with carving

In this release, we've introduced the option to only parse artifacts on initial scan with the ability to carve the same artifacts later.

Get to key evidence quicker while reducing processing time.
Maintaining the ability to deep dive on evidence using Carving Post Processing.

More details...

Categorize media using Hash Sets Manager

You can now integrate a beta version of Hash Sets Manager with AXIOM Process.

Search media evidence in your case for matching hashes in your organization's centralized database, using custom hash lists or hash sets from organizations such as Project VIC or CAID.

More details...

Artifact highlights

Added support for iOS and macOS Find My application

In this release we've introduced support for the Find My application in iOS and macOS. You can now recover information regarding the following:

Locations
Items
Devices

More details...

Added support for Windows Search

In this release we've added support for Windows Search. Now you can parse data indexed by the search engine for the following items:

Outlook
Internet Explorer
Office Documents
Images
Calendar

More details...

Artifacts

Android User Accounts | Android: Added support for Signal Users in the User Account refined result.
Apple Maps Trips | iOS: Updated support for Start, End and Created Date/Time. [iOS 15]
Find My Devices | iOS and macOS: Added support for recovering information regarding devices listed in a user's Find My application.
Find My Items | iOS and macOS: Added support for recovering information regarding items listed in a user's Find My application.
Find My Locations | iOS and macOS: Added support for recovering information regarding locations listed in a user's Find My application.
iCloud Local Files | macOS: Added support for recovering device information.
iOS: Added support for documenting what password was correct/incorrect in the log.
MBOX | Android, iOS, MacOS, Windows, Linux: Updated parsing support for MBOX E-mails, Cloud MBOX Emails, Cloud Gmail Messages and Cloud iCloud Mail.
Outlook Email | Android: Added support for recovering information regarding Sync Date/Time.
Parsed Search Query | Refined Results: Added support for DuckDuckGo in domains list.
Samsung Story Service | Android: Added support for dme.db for location artifacts on Samsung devices.
Signal Users | Android and iOS: Added Local User fragment.
Skype Accounts and User Accounts | iOS, macOS, Android, Windows and Refined Results: Updated support for displaying DateTime information.
Snapchat Chat Messages | iOS: Updated support for recovering information regarding Snap messages and attachments.
Telegram Messages | Android: Partner name would include extra semi-colon characters.
User Accounts | Refined Result: Updated deduplication logic for User Accounts.
User Notification Events | iOS: Added support for recoving information for User Notification Events. [iOS 15]
WeChat Messages | Android: Updated support for video and audio attachments.
WeChat | Android: Updated support for decrypting support files.
Windows Event Logs | Windows: Added support for parsing. Carving and parsing are now both supported.
Windows Search | Windows: Added parsing support for recovering data indexed by the search engine for Outlook, Internet Explorer, Office Documents, Images, and Calendar. Searching for these artifacts is not enabled by default.
Scheduled Processes | Windows, Linux and MacOS: Added support for recovering a list of all Scheduled Processes on the target machine.
Services | Windows, Linux and MacOS: Added support for recovering a list of all services on the target machine.

Remote Acquisition

You can now use Location profiles to manage multiple Targeted locations for complex repeated collections.

Cloud

Improvements to messages retrieved from WhatsApp Cloud.
You can now acquire WhatsApp Cloud messages up to one year in the past.

Processing

An updated German translation of the User Guide is now available.
AXIOM now supports Windows 11.
You now have the option to only parse artifacts. You can later carve the same artifacts after the search has completed.
You can now integrate the Hash Sets Manager beta with AXIOM Process. Maintain hash lists in one central location and distribute to each instance of AXIOM. Search for known media hashes from Project VIC or CAID and custom hash lists.
To use AXIOM Examine 6.2 (or earlier) with REVIEW 4.0 or to use AXIOM Examine 6.3 or later with REVIEW 3.x, you must manually replace the installed CLI in your AXIOM Examine install with the 4.0 CLI. For more information, see Update the CLI used to upload evidence from AXIOM Examine to Magnet REVIEW.

Examining

Artifacts filter now uses a Lucene index for searching within the Timeline Explorer.
In the Media explorer, the Media categorization details card now includes additional information about hashing. The card indicates which hashes are associated with the media items, as well as which hash type was used to categorize it.
Previously, artifact category names did not change to reflect the corresponding language setting in Tools->Settings.
You can now cancel indexing while building the Timeline explorer. This option allows Timeline explorer to build more quickly, but global search will be unavailable. To use global search, you can close and re-open your case to allow the index to build.
You can now use the AXIOM Examine application on a Windows 11 machine.
Improvements to the appearance of email previews in Email explorer.
Performance improvements to sorting in the Email explorer.
Security updates for cefsharp.
When you filter evidence in the Email explorer, there is now a matching results count that reflects the number of search results.
When you try to build the Email explorer, AXIOM Examine now notifies you if no supported email artifacts are available in your case. Currently, the Email explorer only supports Outlook email artifacts.
You can now multi-select artifacts in the Email explorer and perform actions such as tagging and exporting on the selected items.
You can now perform advanced searches in the Email explorer.
You can now integrate the Hash Sets Manager beta with AXIOM Process. Search for known media hashes from Project VIC or CAID using hash sets that are stored in your organization's centralized database.

Bug fixes

Conversation view does not load if a case artifact type set to iMessage Archived Message. -AXE-10446
Previously, the "More Info" links in the Mobile and Computer acquisition screens would not resolve. -AXP-9695
Project VIC 2.0 exports were taking a long time to be created. -AXE-10513
When you exported documents with Korean characters in their file names to a .zip folder, the Korean characters in the export would be removed from the file names. -AXE-10451
Previously, the "More Info" links in the Mobile and Computer acquisition screens would not resolve. -AXP-9695
AXIOM Process would timeout when processing an iOS GrayKey image containing Telegram data. -MA-4260
Processed iOS GrayKey extraction would not show graphical pin location. -MA-4285
AXIOM was unable to acquire all messages from an Office 365 account when Microsoft reported a 504 gateway timeout error during the acquisition. -CAO-3255
When validating an Instagram username, you could encounter a "Unable to find user name" or account check failure and thus could not acquire public activity from the account. -CAO-3887
You could not acquire Google activity. -CAO-4571
When you filtered on Attachments in the Email explorer and tried to cancel it, the filter would remain. -ACE-159
The Encrypted Files artifact could not be exported from Examine due to a missing Attachment fragment. -COMP-1825
Instagram accounts with special characters could encounter issues when being acquired. -CAO-2750

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.