Artifact updates

Android

Discord Logged-in Account

Discord Messages

ProtonMail

Samsung Positioning Path History

Signal

VK Messages

iOS

Photos Media Information

Snapchat Chat Messages

TikTok Media

TikTok Messages

WhatsApp Groups

macOS

Photos Media Information

Windows

Chrome Cache

Discord Messages

Discord User NEW

Windows Mail

Save filter sets

Instead of repeatedly selecting the same combination of filters, you can now save filter sets.

Reuse saved filter sets in your current case or export them for use in other AXIOM cases.
When you save a filter set, you can select the current set of filters or select from a history of filter sets that AXIOM saves during your current session.

AXIOM integration with GrayKey AppLogic 3.24 (minimum version)

Automatically process images as AXIOM cases directly from the GrayKey/VeraKey UI.

Supported extractions include: FFS, AFU, BFU and Logical +
Multiple instances of AXIOM can be configured and selected.
Monitor download and processing status through a new web dashboard.

Android keystore processing

You can now optionally provide a keystore file when processing a GrayKey Android image.

Passwords and decryption keys are automatically parsed and applied to select artifacts.
Decrypted values are displayed in AXIOM Examine.

To learn more about Android keystore processing, sign in to the Support Portal to read the following article: Decrypt app data using the Android keystore and GrayKey

View documentation in dark mode

The AXIOM User Guide and Artifact Reference Guide are now available in dark mode! Use dark mode to reduce eye strain when reading the documentation. To view dark mode, click Theme in either of the guides.

Artifacts

Discord Logged-in Account | Android: Updated parsing support to recover accounts. [v185.24]
Discord Messages | Android: Updated parsing support to recover messages. [v185.24]
Discord Messages | Windows: Updated parsing support to improve recovery of reactions, replies, and the local user account.
Discord User | Windows: Added parsing support for Discord User.
Photos Media Information | iOS, macOS: Updated parsing support to recover information about where on the file system the photo came from.
ProtonMail | Android: Updated parsing support to recover passwords from a keystore file when processing a GrayKey Android image.
Samsung Positioning Path History | Android: Updated parsing and carving support to recover passwords from a keystore file when processing a GrayKey Android image.
Signal | Android: Updated parsing support to recover passwords from a keystore file when processing a GrayKey Android image.
Snapchat Chat Messages | iOS: Updated carving support to recover recipient data from group messages. [v12.38.1]
TikTok Media | iOS: Updated parsing support to recover .ffmpeg previews and deduplicate watched videos in the artifact preview.
TikTok Messages | iOS: Updated parsing support to recover the correct message direction. [v29.5.0]
Various Chrome-based artifacts | Windows: Updated parsing support to recover more data from Chrome Cache.
VK Messages | Android: Updated parsing support to recover missing messages. [v8.30]
WhatsApp Groups | iOS: Updated parsing support to recover the correct location data and deduplicate group data.
Windows Mail | Windows: Updated parsing support to recover an email's read status.

Cloud

iMessages can be now be acquired as its own evidence source.

Processing

AXIOM integration with GrayKey AppLogic 3.24 (minimum version) to include supported extractions (FFS, AFU, BFU, and Logical+).
AXIOM now supports GrayKey iOS Logical+ image processing via the Connect to GrayKey workflow.
Improved acquisition of contacts, call logs, and SMS/MMS messages for Android 10+ devices.
Improved Comae memory processing to address reported crashes.
Improved stability while downloading images from GrayKey and VeraKey devices.
Improvements to decryption of identified BitLocker encrypted volumes.
Use Git repositories to add YARA rules to AXIOM Process.
You can have the option to download a keystore file for Android images when using the Connect to Graykey workflow.
You can now optionally provide an Android keystore file when processing a GrayKey Android image.

Examining

You can now save filter sets when filtering evidence in AXIOM Examine.
You can now select and copy text from an evidence source's details.
You can now turn off the preview that appears when hovering over a media thumbnail in Thumbnail view.
You can now view a preview of plist data in the Artifacts explorer.

Bug fixes

When copying and pasting within AXIOM while a different program was heavily using the computer's clipboard, AXIOM would crash. -EXM-2580
Some messages were being missed when Instagram Direct Messages were recovered from iOS. -MARS-1468
The message type for completed or ended calls was being incorrectly reported for Android Snapchat Messages. [v12.38.0.45] -MARS-1267
UTC timestamps from various MPT artifacts were being incorrectly reported as local timestamps. -MARS-1261
When processing evidence with multiple SMS databases for iMessages, AXIOM would time out. -MARS-1364
Previously, BitLocker Volumes may have caused issues acquiring files and folders. -RA-634
You can now use a FQDN when manually defining a Windows endpoint. -RA-183
AWS authentication updated to include support for the sf-south-1 region selection. -CA-1523
Previously, WhatsApp media files could not be downloaded if there was no activity associated with the media file for more than 30 days. -CA-1454
Updated security protocols to include TLS1.3 support. -CA-1540

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.