Artifact updates

Android

Device Health Services NEW

Installed Applications

Motion Photos

TikTok Media

iOS

Device Information

Device Wallpapers NEW

TikTok Media

WhatsApp Messages

Linux

Operating System Information

Windows

Microsoft Office 365 MRU NEW

Program Compatibility Assistant Records-icon

Program Compatibility Assistant Records NEW

Cloud

Cloud Google Account Information (Warrant Return)

Cloud Google Login History (Warrant Return)

Snapchat Geolocation (Warrant Return) NEW

All platforms

Audio

Video

Deflate64 and RAR solid support

AXIOM Process will now recover artifacts from Deflate 64 based ZIP files and RAR solid archives. This may result in more evidence being properly recovered from these formats when discovered within evidence.

Enhanced file source exception reporting

Now, you can enable a more detailed level of exception reporting. Once enabled, a summary of the file source exceptions will be available in the case dashboard's scan summary in AXIOM Examine.

Include image hash verification in the scan summary

If enabled, image hash verification will now appear in the scan summary in AXIOM Process when the scan completes and also in the case dashboard's scan summary in AXIOM Examine. Previously, it was only available in the case information.

Import tags and keywords from Magnet REVIEW

You can now merge tags and comments back into the original case after exporting them to Magnet REVIEW.

In AXIOM Examine, create a Magnet REVIEW export including tags and comments.
Another stakeholder can apply tags and comments to the exported evidence in Magnet REVIEW, then export their updates.
Import the evidence back into the original case in AXIOM Examine.

Conversation view enhancements

We've updated Conversation view with an improved layout and faster loading in cases with many chat threads. In Conversation view, select a chat thread to view the messages in the conversation below.

Artifacts

Audio, Video | All platforms: Updated carving support to accurately categorize .mp4 files as either audio or video.
Cloud Google Account Information (Warrant Return) | Cloud: Updated artifact to recover data from Google’s new format.
Cloud Google Login History (Warrant Return) | Cloud: Updated parsing support to recover login history from new warrant return format.
Device Health Services | Android: Added parsing support for Device Health Services.
Device Health Services Battery Usage | Android: Added parsing support for Device Health Services Battery Usage.
Device Information | iOS: Updated parsing support to recover current home screen and lock screen.
Installed Applications | Android: Improved Installed Applications parsing to recover more hits.
iOS Device Wallpapers | iOS: Added parsing support to recover the home screen wallpaper and lock screen wallpaper.
Motion Photos | Android: Updated parsing and carving support to correctly carve .mp4 video files contained in the motion photo files.
Operating System Information | Linux: Updated parsing support to recover the Adapter Name.
Program Compatibility Assistant Records | Windows: Added support for Program Compatibility Assistant Records. [Windows 11]
Snapchat Geolocation (Warrant Return) | Cloud: Added parsing support for Snapchat Geolocation warrant returns.
TikTok Media | Android: Updated parsing to recover draft pictures. [v29.2.4]
TikTok Media | iOS: Updated parsing support to recover draft pictures. [v28.9.1]
Videos | All platforms: Improved parsing support for .m4v video files.
WhatsApp Messages | iOS: Updated carving support to recover call history data that was lost. [WhatsApp v23.8.78, iOS 14]

Remote acquisition

AXIOM Cyber now supports FIPS enabled endpoints without the need for additional configuration.

Processing

AXIOM Process will now recover artifacts from Deflate64 and RAR solid archives.
Image hash verification details are now included in the scan summary when enabled in Process->Settings.
Improved logging to provide greater detail when performing Amazon S3 acquisition. -CA-959

Examining

Conversation view in the Artifacts explorer now has an improved look that allows for faster loading on large data sets.
Security - CVE-2020-26293: Updated HtmlSanitizer to address XSS bypass vulnerability.
Significant performance improvements to tagging and categorizing evidence with Magnet.AI, allowing these features to be much more usable in large cases. -EXM-2212
You can now import tags and comments from Magnet REVIEW back into the original Magnet AXIOM case.
You can now view LevelDB cell contents in a PList Viewer.
You can now search and filter evidence by Item ID in the Artifacts explorer.

Bug fixes

Previously, APFS volumes (encrypted and non-encrypted) would be miscalculated when determining available disk space prior to processing. -ENGN-1093
Previously, AXIOM Process may have completed the search with exceptions stating, unable to sort because the method returns inconsistent results. -ENGN-781
Previously, AXIOM Process may have missed large video files due to insufficient disk space. -ENGN-1306
Previously, categorizing pictures and videos by hash value on an existing case would complete unsuccessfully. -ENGN-1307
Previously, invalid date entries for directories in exFAT partitions would not be captured in the logs. -ENGN-1395
Previously, you could not run the build picture comparison job on a completed iOS Greykey image. -ENGN-1203
Hashes were being applied to each layer in a .tiff or .webp file, and therefore didn't match the expected hashes in a Project VIC export. -AXE-10055 -EXM-1100
Sometimes, evidence couldn't be tagged in AXIOM Examine. -EXM-2116
Sometimes, evidence would crash when removing evidence from a case with keywords. -EXM-2084
Sometimes, Excel exports would fail if they included emails with a large number of characters, between 32761 and 32766. -EXM-2049
Sometimes, exports were failing when they included chat threads. -EXM-1899
When clicking on a HEIC picture artifact, an HTML preview was being generated instead. -EXM-1835
Sometimes, when scrolling through picture thumbnails, rows of pictures would be skipped. -AXE-7492 -EXM-1729
When exporting attachments, exceptions were being incorrectly handled and causing the export to fail. AXIOM now correctly handles these exceptions and logs them in the export summary. -EXM-2128
Audio files were incorrectly being reported under the Videos artifact. -MARS-872
Background music was not being recovered correctly from iOS TikTok Draft Videos. [TikTok v28.9.1] -MARS-1097
Empty identifier entries were being recovered with the iOS Device Information artifact. -MARS-1078
iMessage chat threads weren't showing up in Conversation view if a case was processed in AXIOM Process 6.9 or earlier, and opened in AXIOM Examine 7.0. -MARS-1162
Incorrect hits were being carved from iOS Call Logs. -MARS-1087
MMS messages recovered from Android 12 or Android 13 were missing the Application fragment. -MARS-910
Motion Photos recovered from Android 12 or Android 13 were not appearing correctly in AXIOM Examine. -MARS-912
Operating system information was not being correctly recovered from macOS 12 acquisitions. -CARS-7
Sometimes, Magnet.AI categorization wasn't being completed. -DEA-3048
Thorn key activation was failing in AXIOM Examine and needed to be activated in AXIOM Process instead. -DEA-3046
Instagram's download your data new format may have resulted in missing hits. -CA-1087
Previously, AXIOM Process may have crashed when acquiring a Twitter user account. -CA-1218
Previously, AXIOM Process was unable to acquire Instagram Private accounts due to changes made by Instagram. -CA-1179
Previously, AXIOM Process would crash when acquiring an Azure image if the full path to the saved evidence image is greater than 80 characters. Current limit is now 125 characters. -CA-980
Previously, duplicate My Drive and Shared With Me folders may have occurred when acquiring a Google drive. -CA-351
Previously, images sent in Instagram direct messages may not have appeared in chat threads. -CA-206
Previously, Instagram download your data would not acquire some messages and would include an incorrect participant list. -CA-290
Previously, Microsoft Cloud Unified Audit logs would not be parsed if the .csv file name did not begin with 'Auditlogs'. -CA-263
Previously, non-critical errors encountered during a public Instagram acquisition would prevent the acquisition from completing. -CA-1001
Previously, reduced throttling of Microsoft hosted acquisitions may have resulted in dropped hits. -CA-747
Previously, the Google warrant return format changed, preventing AXIOM from pulling device information. -CA-430
Snapchat warrant returns containing group messages with attachments may have appeared as duplicate attachments in the chat threads. -CA-591
Previously, when bulk selecting items to edit comments, the updates were only applied to the first 1000. -EXE-219
Tag counts were appearing incorrectly when an artifact and its source file had the same tag applied to them. -EXE-207

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.