Artifact updates

Android

Audio

Call Logs

Chrome Web Visits

Digital Wellbeing Events

Facebook Messenger Messages

Various Chrome artifacts

Chrome Current Sessions
Current Tabs
Last Sessions
Last Tabs

WeChat

iOS

Apple Mail

Chrome Cookies

Chrome Web Visits

Instagram Direct Messages

Journals NEW

Various Edge Chromium artifacts NEW

Edge Chromium Current Session
Current Tabs
Last Sessions
Last Tabs

Various Telegram artifacts

Telegram Chats
Messages
Users artifacts

Voice Mail NEW

Linux

Chrome Web Visits

macOS

Chrome Cookies

Chrome Web Visits

Various Edge Chromium artifacts NEW

Edge Chromium Current Session
Current Tabs
Last Sessions
Last Tabs

Windows

Chrome Cookies

Chrome Web Visits

Chrome Logins

Various Edge Chromium artifacts NEW

Edge Chromium Current Session
Current Tabs
Last Sessions
Last Tabs

Follow a user’s movements with animated map routes

In AXIOM Examine, you can now use route view to follow the movement of target users, for example to confirm if a suspect and victim crossed paths. Routes generate a series of possible paths based on artifacts with geographical data from a particular evidence source. Using route view, you can:

Generate routes based on a particular date and time, or other available filters in AXIOM Examine.
Watch an animated playback of up to five routes simultaneously.
Record and export the route playback to share as an MP4 file.

Artifacts

Apple Mail | iOS: Updated parsing support to remove duplicated hits.

Audio | Android, iOS: Updated carving support to remove false positives for AMR files.

Call Logs | Android: Updated carving support to recover WAL files from Android 9 devices.

Call Logs | iOS: Updated carving support to recover more WAL data from iOS 13 and later.

Chrome Cookies | iOS, macOS, Windows: Updated parsing support to decrypt cookie data.

Chrome Logins | Windows: Updated support to recover more accurate user login data.

Digital Wellbeing Events | Android: Updated parsing support.

Facebook Messenger Messages | Android: Updated carving support to recover WAL files.

Facebook Messenger Messages | Android: Updated parsing support to recover and provide previews for video attachments. [v333 and later]

Journals | iOS: Added parsing support for the Journals application.

Various Chrome artifacts | Android: Updated parsing support to recover Android data for Chrome Current Sessions, Current Tabs, Last Sessions, and Last Tabs.

Various Edge Chromium artifacts | iOS, macOS, Windows: Added parsing support for Edge Chromium Current Session, Current Tabs, Last Sessions, and Last Tabs.

Various Telegram artifacts | iOS: Updated parsing support to recover system messages from Telegram Chats, Messages, and Users artifacts.

Voice Mail | iOS: Added parsing support for Voice Mail recovered from iOS 17 devices.

Cloud

AXIOM now supports the use of Session credentials and External IDs for AWS acquisitions.

Examining

Using Route view in the Artifacts explorer, you can now view a target's movements on an animated map route.

Data enrichment and analytics

We've updated Magnet.AI categorization to use the latest Thorn CSAM models, which provide greater accuracy in the detection of illegal content. This update includes fewer false positives in problem areas, and improved recall precision.

Bug fixes

Previously, Process may have cancelled the scan without user interaction. -ENGN-10595

Previously, Process may have closed while scanning a virtual machine image. -ENGN-10876

Data in the SQLite viewer in AXIOM Examine was being truncated. -EXM-2577

Portable cases were experiencing errors while checking for updates. -AXE-8698 -EXM-590

When creating an Excel report from a portable case, Hangul file attachments were not being exported. -EXM-3184

If a relative date/time filter was applied before the timeline was built, that filter wouldn't be applied in the timeline explorer. -EXM-2726

Sometimes, viewing the timeline explorer caused errors or the data would disappear from AXIOM Examine. -EXM-2487

HTML exports would fail if they contained a file with the # symbol in the file name. -EXM-2675

Apple Mail EMLX files and their attachments weren't being displayed correctly. -MARS-1962

Some carved hits weren't being recovered from WeChat Messages for Android. -MARS-1461

Some plist blob data wasn't being acquired for Instagram Direct Messages. -MARS-1460

The title fragment for Chrome Web Visits artifacts wasn't accurate and has been removed. -MARS-1909

Additional language localization support for Microsoft cloud acquisitions. -CA-688

Previously, a Google warrant return containing a corrupted .zip could cause Process to crash. -CA-1646

Previously, decryption of iCloud backup acquisitions of iOS 17 devices may have failed. -CA-1670

Previously, Facebook Download Your Information evidence sources may not have recovered all messages. -CA-1704

Previously, Google Connected Apps could not be acquired. -CA-1334

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.