Artifact updates

Android

Call Logs

Device Reset/Activation Times NEW

SMS/MMS

Snapchat

macOS

Apple Notes

Cloud

Instagram Direct Messages

iOS

Snapchat

Windows

Operating System Information

AXIOM integration with GrayKey and VeraKey

Automatically process full filesystem GrayKey/VeraKey images as AXIOM cases directly from the GrayKey/VeraKey UI.

Completed GrayKey/VeraKey images are hash verified before being moved to an AXIOM device for processing.
Multiple instances of AXIOM can be configured and selected.
Monitor download and processing status through a new web dashboard.

Examine raw data using the protobuf viewer

AXIOM Examine now includes a protobuf viewer within the File system explorer's SQLite viewer. Protobuf encoded data is increasingly common to encounter on Android and iOS devices. Using the protobuf viewer, you can:

Review and validate encoded data for Android and iOS artifacts.
Find additional potential artifacts and artifact fragments within your current evidence source.
To access Magnet.AI categorization, go to Tools > Settings and enable additional features.

macOS signed agents

In this release, all macOS agents are created as signed applications

Create and deploy signed macOS agents directly from AXIOM Cyber.
Simplified deployment and security control when using 3rd party MDM tools.

Multi encoding support for ZIP files

ZIP files created using non-default Windows encoding can be processesd to correctly display file names and contents.

Supports any valid encoding/codepage. For example, Japanese (Shift-JIS) 932.

To learn more about encoding support for ZIP files, sign in to the Support Portal to read the following article: multi encoding support for ZIP files.

Search for animals with Magnet.AI

Use Magnet.AI picture categorization to search for many animals that are commonly involved in poaching and illegal trading, under four major categories: birds, fish, mammals, and reptiles.

Artifacts

Call Logs | Android: Updated support to remove unnecessary 00:00:00 values from the Call Duration column when a call was missed, unanswered, or declined.
Apple Notes | macOS: Updated parsing support to recover attachments.
Device Reset/Activation Times | Android: Added parsing support for Device Reset/Activation Times.
Instagram Direct Messages (Download Your Data) | Cloud: Updated to included Direct Messages from new format.
Instagram Direct Shares (Warrant Return) | Cloud: Updated Picture fragment to include other media types.
Operating System Information | Windows: Updated parsing support to accurately recover Last Shutdown Date/Time and indicate which control set was used to recover the data.
SMS/MMS | Android: Updated carving support to recover the full message content.
Snapchat Contacts | Android: Updated carving support to recover User ID.
Snapchat Contacts | iOS: Updated parsing support to recover contacts added from the user's phone (native) in addition to existing Snapchat contacts (app).
Snapchat Stories | iOS: Updated parsing and carving support to recover the group name and story type.
Telegram Messages | Android: Updated parsing support to recover photo attachments from secret chat messages.

Remote acquisition

Cyber macOS agents can be deployed without TCC prompts appearing on the endpoint.

Processing

AXIOM can now integrate with GrayKey/VeraKey to automatically process images as AXIOM cases.
AXIOM now supports the processing of .zip files created using alternate encoding.
DateTime values for most artifacts now include millisecond precision.
Improved enumeration of files on NTFS images with large amounts of files.
Improved MFT parsing for Comae Memory resulting in more hits found and reduced processing time.

Examining

Improved the accuracy of the progress bar when AXIOM is creating a portable case, and added more messaging to indicate the step and time remaining.
Improved the appearance of PDF exports by expanding the left margins.
You can now view data in a protobuf viewer in the File system explorer.
Tag counts now update to show an accurate number in the Tags and comments filter window.

Data enrichment and analytics

Magnet.AI picture categorization now includes possible animals, including birds, fish, mammals, and reptiles.

Bug fixes

Previously, AXIOM may have lost the connection to the case at the final stage of searching, resulting in a crash. -ENGN-5173
Previously, AXIOM may not have recognized Windows partitions from an .E01 image with accompanying "Attempted to divide by zero" log entry. -ENGN-1392
Previously, file sizes greater than 4GB would be incorrectly reported within an ext4 file system. -ENGN-1636
AXIOM export file names were being changed to remove punctuation. -EXM-2327
Sometimes, plist files couldn't be previewed. -EXM-1924
Sometimes, when filtering on conversations in a communication artifact, no results were being shown. -EXM-2612
Some timestamps for USB Devices were being reported incorrectly. -CARS-508
Sometimes, Device Information wasn't being parsed correctly and was missing from the Artifacts explorer. -MARS-1336
When passwords were added to the Options window for Windows Stored Credentials artifact in AXIOM Process, the passwords would disappear after exiting the window. -CARS-456
Improved detection and identification of BitLocker encrypted drives. -RA-554
Previously, AXIOM may have become non-responsive after scanning the QR Code during a WhatsApp acquisition. -CA-1324
Previously, Google Recent Devices were not included in a Google acquisition. -CA-550
WhatsApp acquisitions will now include documents with captions. -CA-1438
Attachments from .msg files were being incorrectly displayed as emails in the Email explorer. -EXE-259
When a comment was added to a source item in File system explorer, the Tags and comments section on the Case dashboard wouldn't update. -EXE-290

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.