Artifact updates

Android

Facebook Messenger

Google Maps

TikTok

Videos

iOS

Apple Notes

iMessages/SMS/MMS

Reminders

Safari Suspended State Tabs

Videos

Cloud

Cloud Apple Messages (Warrant Return)

Linux

Videos

macOS

Quick Look Thumbnails

Videos

Windows

Default Browser

Event Logs Script Events

KakaoTalk

Microsoft Teams

Videos

View details after exporting completes

In AXIOM Examine, you can now view detailed information after your exports / reports have completed.

If an export / report completes with exceptions, a window appears with details about each exception so that you can troubleshoot and resolve the issues.
View this information later in the ExportSummary.json file included with your exports.
View details and any possible exceptions for all previous exports in the Case exports / reports section on the Case dashboard.

Artifacts

Apple Notes | iOS: Updated support for Apple Notes decryption using keychain. [iOS 16]

Default Browser | Windows: Added support for recovering a user's default browser.

Facebook Messenger | Android: Updated support to recover more messages. [386.2.0.22]

Google Maps Saved Locations | Android: Updated carving support.

iMessage | iOS: Updated carving support for edited messages and deduplication. [iOS 16]

KakaoTalk | Windows: Updated support for user credentials.

Microsoft Teams | Windows: Added parsing support for Direct Messages and Meeting Messages.

Microsoft Teams | Windows: Added parsing support for Topic Messages.

Reminders | iOS: Added carving support for Reminders. [iOS 15, 16]

Safari | iOS: Added carving support for Safari Suspended State Tabs. [iOS 16]

SMS/MMS | iOS: Updated carving support for message GUIDs.

TikTok Videos | Android: Updated parsing support to include MDL files. Note that in order to recover cached videos and display them in the Artifacts explorer, AXIOM modifies the header. You can still view the original file in the File system explorer.

Videos: Added Creation Date to Exif Data.

WhatsApp Accounts Information | Android: Updated support to recover the WhatsApp Name attribute. [2.22.22.80]

WhatsApp Messages | Android: Updated carving support for calls.

WhatsApp Messages | Android: Updated carving support for messages.

WhatsApp Messages | Android: Updated carving support to acquire crypt backups.

Cloud

Apple warrant returns containing iMessage Cloud data in the MessagesInICloud.csv will be recovered as, Apple Messages in iCloud - Warrant Return.

Previously, decrypted backups found within an Apple warrant return would be not be processed in AXIOM.

The Magnet Apple warrant return assistant will now validate the provided Apple warrant return.

The Magnet Apple warrant return assistant will produce the Evidence.zip once all items from the Apple warrant return have been decompressed.

You can now perform a text search of Site names when acquiring SharePoint Sites.

You can now select multiple decrypted Apple warrant return .zips to be processed as individual evidence sources. Multiple decrypted Apple warrant return .zips can also be combined into a single .zip container to be processed as a single evidence source.

Processing

When included with an AXIOM release, ReversingLabs YARA rules updates will update existing rules, add new rules, and recreate previously deleted rules.

When processing a Cellebrite CLBX image, AXIOM will automatically load the keychain for pre-processing if it is found.

Examining

In the LevelDB viewer, you can now search the data and filter columns.

Performance improvements when scrolling through Artifacts explorer in Column view.

The LevelDB viewer has been improved to show data from a custom comparator.

When you create an export in AXIOM Examine and it experiences errors, you can now view a detailed report of these errors so you can try and resolve them.

You can now sort by Item ID in the Artifacts explorer.

The correct file name will now appear in the URL of Chrome Cache Records in Project VIC exports.

Data enrichment and analytics

Performance improvements when syncing hash sets from Hash Sets Manager.

Bug fixes

Previously, searches of images containing an iOS backup may have failed stating the same key has already been added. -ENGN-257

Quick Look Thumbnails | macOS: Updated Thumbnail Created Date/Time to more accurately be called Target File Last Modified Date/Time. -CARS-50

The description for Windows Event ID 5860 was inaccurate. -CARS-1

WhatsApp Messages chat data wasn't being carved. [2.21.19.21] -MARS-533

Some iOS text messages were missing from acquired data. [iOS 16] -MA-4668

Previously, AXIOM was unable to acquire Google Activity. -CA-487

Previously, if an Apple warrant return contained a backup with a corrupt encryption key this could cause an exception during decryption. -CA-55

Sometimes, keyword match counts were not appearing in the evidence source information section. -AXE-10989

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.