Artifact updates

Android

Facebook Contacts

Facebook Messenger

Google Keep NEW

LINE Chat

Samsung Notes NEW

Skype Activity

Snapchat Messages

Telegram Messages

WeChat Friends

WeChat Messages

WhatsApp Messages

iOS

Apple Mail

LINE Chat

Signal Users

Skype Activity

Twitter Users

WhatsApp Messages

Windows

Prefetch List NEW

Skype

macOS

AirDrop

Cloud

Google Location History

iOS Backups

Decrypt file-based Dell Data Protection Encryption

In this release, you can now decrypt DDPE file-based encryption sources within AXIOM Cyber.

Navigation improvements to Artifacts explorer

Navigation in the Artifacts explorer is now more responsive when taking the following actions:

Selecting categories on the left pane
Loading items when scrolling through evidence
Viewing highlighted search results

Enhancements to the Email explorer

In AXIOM Cyber 6.5.0, we've added the following enhancements to the Email explorer:

MBOX and iCloud Mail artifacts are now supported by the Email explorer
IMAP/POP and Gmail folders are now named after the message owner's email address rather than a generic folder name
Emails with attachments are now indicated using a paperclip icon, and attachment file names appear in the email preview

Undo grading in Media explorer

When grading in the Media explorer, you can now use the keyboard shortcut Ctrl + Z to undo the last grading of a single media item or multi-selected media items.

Improved multi-artifact view in Timeline explorer

The Timeline explorer now shows artifact data in a more convenient view under the timeline graph. Each artifact shows a key, supporting, and additional detail that might be most relevant to your investigation.

Artifacts

AirDrop | macOS: Updated support for AirDrop in macOS v13.
Facebook Contacts | Android: Updated support for the Facebook Contacts artifact. [v369.0.0.18]
Facebook Messenger | Android: Updated support for Facebook Messenger so that URL links are valid and clickable.
Google Keep Notes | Android: Added support for Google Keep Notes. [v5.22.262.2]
LINE Chat | Android, iOS: Updated support for chat threading. [v12.9.x]
Prefetch List | Windows: Added support for recovering a list of Prefetch files on the endpoint.
Samsung Notes | Android: Added support for Samsung Notes.
Signal Users | iOS: Added 'Local User' fragment to indicate accounts that are from the local device.
Skype Activity | Android: Updated support for video attachments. [v8.87.0.403]
Skype Activity | iOS: Updated Skype Activity artifact to support previews of picture and video attachments. [v8.83.408]
Snapchat Messages | Android: Updated support for recovering chat message attachments.
Telegram Messages | Android: Updated support for video attachments. [v8.8.6]
Telegram | Android: Updated support for video attachments. [v8.8.6]
Twitter Users | iOS: Updated support for the Twitter Users artifact. [v9.20]
Various email artifacts | Android, iOS, Windows, macOS: Updated support for recovering email attachments.
WeChat | Android: Improved evidence collection from WeChat for Android. [v8.0.20]
WeChat Friends | Android: Added carving support for decrypted databases.
WhatsApp Messages | Android: Updated Sender and Receiver fragments to display the user's WhatsApp ID instead of phone number when applicable.
WhatsApp Messages | iOS: Combined file and picture fragments to avoid duplication.

Remote acquisition

Prefetch List | Windows: Added support for recovering a list of Prefetch files on the endpoint.

Cloud

Improved parsing of Google warrant return location history.
You can now use the AXIOM Cloud Authenticator Chrome extension to acquire WhatsApp Google Drive backups.

Processing

You can load .ufdx as a supported image type.
You can now decrypt file-based Dell Data Protection Encryption DDPE evidence sources.

Examining

Additional artifact data is now visible in the Timeline explorer.
In the Media explorer, you can now use the shortcut Ctrl + Z to undo the last grading.
Loading times have been reduced when you open a case or click the Home button in your case.
Performance improvements when navigating the Artifacts explorer.
In the Email explorer, Apple iCloud evidence is now grouped together by source name in the Email explorer.
In the Email explorer, Gmail evidence is now grouped under a folder named after the message owner's email address.
In the Email explorer, IMAP/POP email evidence is now grouped under a folder named after the message owner's email address.
In the Email explorer, emails with attachments are now indicated using a paperclip icon, and the attachment file names appear in the email preview.

Bug fixes

CVE-2022-0778 - Multiple vulnerabilities in OpenSSL. Updated OpenSSL version to address critical vulnerabilities surrounding sanitizing characters to prevent injection. Several older versions of OpenSSL used for local mobile extractions over USB were also updated to match the latest version. -AXP-9972
Improved processing of DCIM folders. -AXP-6334
Improved processing of FAT partitions. -AXP-1891
Performance improvements to tagging in AXIOM Examine. -AXE-10579
Sometimes after processing a volume shadow copy, you could not remap the evidence source. -AXP-10086
Sometimes, in Column view in the Artifacts explorer, the rows would appear empty. -AXE-10708
When AXIOM Examine would launch after AXIOM Process finished a scan, the Connections explorer wouldn't prompt you to build connections. -AXE-10706
When a portable case was created, the evidence source was being incorrectly referenced. -AXE-9854
When an export was created that included media from multiple sources, some of these file attachments would be named incorrectly. -AXE-9948
When exporting a very large CSV export, AXIOM Examine would run out of memory. -AXE-10594
When the relative date/time filter was applied to evidence in the Timeline, a timestamp offset would be incorrectly applied to UTC timestamps. -AXE-10619
When you categorized pictures using Magnet.AI and clicked Show results, AXIOM Examine would crash. -AXE-10686
Apple Email headers were being incorrectly parsed and included in the email body. -COMP-1861
The Skype thread preview was incorrectly showing messages as received. -COMP-1709
Support for various Signal artifacts was lost during a recent update. [v5.39.0] -MA-4262
Process would crash when using a temporary profile account while performing functions that require admin permissions. -CRA-2372
When trying to categorize corrupted pictures using Magnet.AI, AXIOM Examine would freeze instead of skipping the corrupted files. -AE-2359
When trying to connect to Hash Sets Manager from AXIOM Process, it wasn't possible to cancel the connection attempt. -AE-2389
Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
Sometimes, iOS backups of devices up to version 15.5 could not be acquired from iCloud. -CAO-4740
If you sorted evidence in the Email explorer, then navigated away, you wouldn't be able to sort again in the Email explorer until you refreshed it. -ACE-239

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.