Artifact updates

Android

Bluetooth Devices

Skype Activity

Wickr Me

Windows

Active Users NEW

Firewall Rules NEW

Microsoft Teams

Network Shares NEW

Scheduled Jobs NEW

iOS

Apple Keychain NEW

Apple Mail

Bluetooth Devices

Snapchat Messages

macOS

Active Users NEW

Network Shares NEW

Linux

Active Users NEW

Firewall Rules NEW

Tag email attachments in the Email explorer

When you tag an email in the Email explorer, AXIOM Examine now gives you the option to automatically tag its attachments as well. You can adjust this preference in Tools > Settings.

View individual points in World map view

In the World map view, you can now view individual points or clusters, depending on the needs of your investigation.

Create profiles with User Account data

In addition to Identifier data, you can now create profiles with User Account data from the refined results artifact category.

Updates to Hash Sets Manager

We've added the following features to the Hash Sets Manager beta:

You can now upload new hashes from AXIOM Examine directly to existing hash sets in Hash Sets Manager.
As an administrator, you can protect certain hash sets from being modified, such as hash sets from Project VIC or CAID.
If you're using AXIOM Examine in an offline environment, you can use the latest downloaded version of a hash set while disconnected from Hash Sets Manager.

To learn more about Hash Sets Manager and download a copy of the beta, visit the Magnet Idea Lab.

Artifacts

Apple Keychain | iOS: Added support for Apple Keychain from CLBX images that have been acquired with Cellebrite.
Bluetooth Devices | iOS: Updated "Last Seen Date / Time" fragment so that it remains in the applicable local time.
Skype Activity | Android: Updated support for recovering video attachments. [8.87.0.403]
Various email artifacts: Updated support for recovering the file size of email attachments.
Wickr Me | Android: Updated support for entering known or suspected passwords to acquire more data from a user's Wickr Me account.

Remote acquisition

Active Users | Windows, macOS, Linux: Added support for recovering a list of active users on the endpoint.
Firewall Rules | Windows, Linux: Added support for recovering a list of firewall rules on the endpoint.
Scheduled Jobs | Windows: Added support for recovering a list of scheduled jobs on the endpoint.
Network Shares | Windows, macOS: Added support for recovering a list of mounted network shares on the endpoint.

Cloud

A Link to the MAGNET Apple Warrant Return Assistant is now available when selecting a Cloud Apple evidence source.

Processing

Previously, if carving post processing failed, it could not be retried.
Reduced loading time of segmented .zip files from a network location.

Examining

In World map view, you can now choose to view individual or clustered points.
Some Linked Path values were appearing with incorrect encoding.
The advanced search feature wasn't working correctly in the Timeline explorer.
You can now create profiles using User Accounts data from refined results.
In Tools > Settings, you can now choose whether or not to automatically tag attachments when you tag emails in the Email explorer.
In the Email explorer, file sizes now appear for email attachments in the preview window.
When you tag emails in the Email explorer, AXIOM Examine can now automatically tag their attachments as well.
You can now use the latest downloaded copy of a hash set when you're disconnected from your organization's Hash Sets Manager database.
In the Hash Sets Manager database, you can now protect hash sets from being edited by other users.
You can now upload new hashes from AXIOM Examine to existing hash sets in your organization's Hash Sets Manager database.

Bug fixes

Previously, decryption may have been unsuccessful when correct BitLocker key was provided. -AXP-7932
Previously, if an iOS backup was found in a Mac image containing Windows-illegal characters in the path, the search would fail. -AXP-1683
Security - CVE-2018-1285: Patched vulnerable version of log4net surrounding parsing of XML configuration files in applications where it is permitted to undertake XML external entity processing. -AXP-9503
Sometimes, identification of allocated APFS volumes would be missed. -AXP-7664
When navigating between artifact categories and types, a spinner now appears to indicate that AXIOM Examine is loading results. -AXE-10738
Sometimes, when switching to a new case when World map view was still open in another case, the map points wouldn't load. -AXE-10793
Performance was very slow when removing tags after tagging a large amount of evidence. -ACE-257
When a subfolder was open in the Email explorer and new evidence was added, the new folders wouldn't load properly in the Email explorer. -ACE-18
When a case contained Email evidence that wasn't supported by the Email explorer, the Email explorer would fail to build. -ACE-19
When viewing Snapchat Messages in Conversation view, the messages' read status and chat threading would appear incorrectly if the user had changed their username. -MA-4404

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.