Artifact updates

Android

DJI Media NEW

DJI User Information NEW

Facebook Messenger Messages

Instagram Direct Messages

Windows

Edge Chromium Autofill

Executive Object Callbacks (Memory)

ICQ 10 Messages

macOS

Edge Chromium Autofill

Find My Items

iOS

Device Information NEW

DJI Media NEW

Facebook Messenger Messages

Find My Items

Instagram Direct Messages

iOS Message Preferences

Network Interfaces NEW

Private MAC Addresses NEW

Various Biome artifacts NEW

New iOS Device Information artifact

AXIOM now includes the iOS Device Information artifact, which recovers data from iOS 15 devices, including IMSI, Advertising ID, Time Zone, Airdrop ID, and MAC Address.

Upload AXIOM cases to Magnet REVIEW SaaS

Upload your AXIOM case to Magnet REVIEW SaaS to instantly collaborate with others online. Your case will be stored in a secure US-based server hosted by Magnet Forensics. To create an account and start your free trial with Magnet REVIEW SaaS, visit our website.

Artifacts

Device Information | iOS: Added parsing support for iOS Device Information.
DJI Media | Android: Added parsing and carving support for DJI Media.
DJI Media | iOS: Added carving support for DJI Media.
DJI User Information | Android: Added parsing support for DJI User Information.
Edge Chromium Autofill | macOS, Windows: Updated parsing support to decrypt plaintext values.
Executive Object Callbacks | Windows Memory: Added parsing support for Executive Object Callbacks.
Facebook Messenger Messages | Android: Updated carving support. [v386]
Facebook Messenger Messages | iOS: Updated carving support to recover Group Name in Group Messages. [v408.1]
Find My Items | iOS, macOS: Updated parsing support to include the owner.
ICQ 10 Messages | Windows: Updated parsing support to include the ICQ ID of the sender or recipient.
Instagram Direct Messages | Android, iOS: Updated parsing support to recover Chat ID and Thread ID.
iOS Message Preferences | iOS: Updated parsing support to include blocked users and whether SMS forwarding is enabled.
Network Interfaces | iOS: Added parsing support to recover data from iOS Network Interfaces.
Private MAC Addresses | iOS: Added parsing support for Private MAC Addresses - iOS.
Various Biome artifacts | iOS: Added parsing support for iOS 17.

Remote acquisition

AXIOM Cyber now supports TLS 1.3 authentication.
The AXIOM Cyber agent template is now a signed binary, reducing the occurrences of being quarantined by antivirus tools.

Cloud

Added support for parsing hits for Google Chat from Google Takeout.

Processing

AXIOM GRAYKEY/VERAKEY Discovery service updated to restart automatically.
Enhanced capabilities with exFAT and Recovered deleted files.
Improvements to processing of .zip files with long file names.

Examining

You can now upload cases from AXIOM Examine to Magnet REVIEW SaaS.

Data enrichment and analytics

Improved Magnet.AI picture categorization of video still frame collages.

Bug fixes

Improved YARA Rules logging to capture long running processes. -ENGN-10419
Previously, AXIOM Process may have crashed during attempts to process temp files that were removed prematurely. -ENGN-10593
Previously, VERAKEY devices were unable to register with the AXIOM GRAYKEY/VERAKEY Discovery service. -ENGN-10424
Security - CVE-2023-4863/CVE-2023-5217: Updated CefSharp libraries to address vulnerabilities where a crafted HTML page could allow an attacker to perform an out of bounds memory write, or potentially exploit heap corruption. -ENGN-10452
Data from multiple Signal artifacts wasn't being correctly decrypted or acquired. -MARS-1686
Some Android Signal temporary files weren't being acquired. -MARS-1696
Some data was being incorrectly included in the Text column for iOS Facebook Messenger Messages. -MARS-1690
Some iMessages/SMS/MMS for iOS 17 weren't being parsed. -MARS-1671
Added support for Apple Warrant Return Contact cards (.vcfs). -CA-450
Previously, AXIOM may not have recovered all media from a Snapchat warrant return due to updated warrant return format. -CA-295
Previously, AXIOM was unable to acquire iCloud backups. -CA-1612
Previously, AXIOM would not allow multiple iCloud backup evidence sources in a single case. -CA-1519
Previously, AXIOM would not reattempt an acquisition if an internal server error response was received from the provider. -CA-1518
Previously, you could not sign into Slack to perform a live acquisition. -CA-1216
Excluded fields were still being displayed in load file exports. -EXE-279

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.