Artifact updates

Android

Facebook Messenger

Windows

Chrome Cache Records

Firefox

KakaoTalk

User Accounts

Yahoo! Messenger

Cloud

Cloud Google Hangouts Messages (Warrant Return) NEW

iOS

iMessage/MMS/SMS

Private Photo Vault Media

Recently Deleted Messages NEW

Reminders NEW

Safari Suspended State Tabs NEW

Snapchat Stories

TikTok Videos

macOS

CUPS Print Jobs

Limit artifacts in Examine by using a Date range filter

You can now limit the results in Examine to only include artifacts for a specified date range.

Applying a date range affects all evidence explorers and views with the exception of the File system and Registry explorers.
Only applies to UTC times stamps. The filter does not apply to Local Time fragments.
Choose to include or exclude artifacts hits that do not include at least one time stamp.

From the Case dashboard, you can now view consolidated data from all your evidence sources.

Click Evidence sources to view all devices and other evidence sources at a glance.
Select an evidence source to view summary information about it on its own dashboard.
On an evidence source dashboard, use the evidence source details section to view information such as unique device identifier and serial number.
Find a starting point with sections for each evidence source's artifact categories, tags, comments, keyword matches, and more.

Chrome Cache Records | Windows: Added a new File Name attribute for media files.
Facebook Messenger Groups | Android: Updated carving support for Facebook Messenger Groups.
Facebook Messenger Users | Android: Updated carving support for Facebook Messenger Users. [380.1.0.17]
Google Hangouts Messages (Warrant Return) | Cloud: Added support for recovering chat and photo messages.
iMessage/SMS/MMS | iOS: Updated support to include edited and unsent messages.
Private Photo Vault | iOS: Updated support for recovering pictures and videos. [14.0]
Recently Deleted Messages | iOS: Added support for Recently Deleted Messages. [iOS 16]
Reminders | iOS: Added support for iOS Reminders. [iOS 16]
Safari | iOS: Added carving support for Safari Suspended State Tabs. [iOS 16]
Snapchat | iOS: Updated support for Snapchat Stories. [iOS 14, Snapchat 12.0.0]
TikTok | iOS: Updated support for recovering videos. [TikTok 26.5.0, iOS 14]
User Accounts | Windows: Updated attributes in User Accounts artifact for clarity. [Windows 7, 8, 10]
WhatsApp Messages | Android: Updated support for messages and chat artifacts. [v2.22.14.74]
WhatsApp | iOS: Updated parsing support for completed calls and duration. [22.20.75]
Google Hangouts Messages (Warrant Return) | Cloud: Added support for recovering chat and photo messages.

AXIOM will no longer assign a non-pertinent media category using PhotoDNA. Non-pertinent matches will only be applied if there is a direct hash (MD5 / SHA1) match.
AXIOM will now locate and load embedded keychain files when processing iOS images obtained from GrayKey's Simultaneous Download feature.
Process will attempt to search for a valid VMDK descriptor file and present a message if one cannot be found.
You can now apply a Date range filter when setting up your case to limit artifacts hits.

When viewing an evidence source dashboard, you can use the Evidence source details section to view information unique to the device or other location that the data was acquired from, such as unique device identifier, serial number, and more.
Performance improvements to tagging emails in the Email explorer.
When an email has many attachments, you can now expand and collapse attachments in the email preview window in the Email explorer.
In the Case dashboard, you can now view all evidence sources at a glance, as well as individual dashboards with summary information about each evidence source and the data that was recovered from it.

You can now perform a remote Linux memory dump capture.
You can now create endpoints manually and define the collection before the agent comes online for the first time.

AXIOM will now search for chat and photo messages from Cloud Google Hangouts (Warrant Return).
AXIOM Process is now able to capture all SharePoint sites within an organization in addition to the root SharePoint site.

Chrome Cache Results weren't being exported with Project VIC reports. -AXE-10948
Previously, tagging artifacts using a hash list may fail if the image contained non windows characters. -AXP-10318
Project VIC exports were reporting an incorrect number of total media files because squashed results from the same source were being counted multiple times. These squashed results are now counted correctly as one file in the export. -AXE-10876
Project VIC exports were showing different counts between evidence in the Artifacts and Media explorers. -AXE-10951
Sometimes, AXIOM Examine would crash when loading an evidence source after AXIOM Process finished scanning it. -AXE-10808
CUPS Print Jobs timestamps were incorrectly labeled as local time, when the timestamp was actually in UTC. -COMP-1902
Previously, if an Apple warrant return contained duplicate keybags this could cause processing to fail. -CA-46
When processing evidence and calculating hash values, sometimes the scan wouldn't complete. -EXE-62
When selecting whether to tag emails and attachments together, you can now choose if you want the prompt for this setting to appear every time you tag evidence in the Email explorer. -EXE-39
Media categorization hash sets couldn't be used without selecting the option to calculate hash values for all files. Now, the option to calculate media files only is selected by default and media hash set options are available. -DEA-2801

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.