Artifact updates

Android

Android MMS (UFED Agent)

Arlo Secure Cached Media NEW

Arlo Secure Device Information NEW

Arlo Secure User Information NEW

Audio

Blink Cached Media NEW

Blink Device Information NEW

Blink User Information NEW

Chrome Affiliations NEW

Facebook Messenger Messages

Instagram Posts

Installed Applications

Ring Cached Media NEW

Ring Device Information NEW

Ring User Information NEW

Signal Messages

Videos

iOS

Apple Mail

Arlo Secure Cached Media NEW

Arlo Secure Device Information NEW

Arlo Secure User Information NEW

Audio

Blink Cached Media NEW

Blink Device Information NEW

Blink User Information NEW

Chrome Affiliations NEW

Chrome Cache Records

Device Information

EML(X) Files

Facebook Messenger E2EE Chats NEW

iMessage/SMS/MMS

Instagram Direct Messages

Installed Applications

MEGA Chats

Ring Cached Media NEW

Ring Device Information NEW

Ring User Information NEW

Signal Messages

Telegram Users

Unified Logs NEW

Videos

macOS

Audio

Chrome Affiliations NEW

Chrome Cache Records

Unified Logs NEW

Videos

Windows

Audio

Chrome Affiliations NEW

Chrome Cache Records

Chrome Extensions

Chrome Logins

Videos

Windows Search - Calendar NEW

Windows Search - Contact NEW

Windows Search - Document NEW

Windows Search - Image NEW

Windows Search - Internet Explorer NEW

Windows Search - Outlook NEW

Cloud

Instagram Media (Download Your Data)

Comae memory analysis

Support for Comae memory analysis for AXIOM customers with any AXIOM term license.

Acquire AWS EC2 Multi-Volume Snapshots

Acquire snapshots within the same account or a security account context.
Support for Windows instances, encrypted volumes, and volumes exceeding 1 TB, instances with multiple volumes, and more!

New mobile view

The new mobile view in AXIOM Examine shows you a visual representation of a mobile device’s wallpaper and installed apps. Click an app to view its associated artifacts and learn more about the user’s activity.

Improvements to route view

We’ve made improvements to animated maps and routes in the route view of AXIOM Examine.

Choose a default distance and time for your route settings.
Generate as many routes as you want without a limit. Note that generating a large number of routes might take a significant amount of time.

Standalone MFT parsing and file system view (CYBER ONLY)

You can now process standalone MFT (Master File Table) data from Windows machines, and view them in the File system explorer in AXIOM Examine. Use this feature to quickly triage computers with suspicious activity.

Export chats and attachments to RSMF (CYBER ONLY)

Create RSMF (Relativity Short Message Format) exports to upload chat messages and their attachments for legal reviewers on the Relativity e-discovery platform.

Improved performance and data recovery for Chrome Cache Records

We’ve improved performance in AXIOM Process when acquiring data from Chrome Cache Records. Additionally, we’ve updated parsing to recover more data from this artifact.

Introducing Magnet Copilot

In AXIOM 8.0, we’re introducing Magnet Copilot, a free add-on that allows you to gain insights into your AXIOM cases from a pop-up in AXIOM Examine.

Upload conversational, web search, and picture data, and ask questions about it. Answers are returned along with citations that link into relevant data within the case.
Upload a picture for analysis to determine if it was potentially generated by Stable Diffusion, Midjourney, or DALL-E 3.
Analyze a video to determine its origin and authenticity via an integration with Medex Forensics.
Quickly narrow in on results by transforming a natural language query into a set of AXIOM filters.

To get started, click the Magnet Copilot button to the right of the filters bar in AXIOM Examine.

Update to Magnet Exhibit Builder 1.1

We’ve made improvements to Magnet Exhibit Builder for all AXIOM Premier users.

Note that Magnet Exhibit Builder currently requires you to manually update. To learn how, sign in to the Support Portal to read the article Update to Magnet Exhibit Builder 1.1.

Artifacts

Arlo Secure Cached Media | Android, iOS: Added parsing support for Arlo Secure Cached Media.
Arlo Secure Device Information | Android, iOS: Added parsing support for Arlo Secure Device Information.
Arlo Secure User Information | Android, iOS: Added parsing support for Arlo Secure User Information.
Audio, Videos | All platforms: Updated parsing support to recover .ogg, .oga, and .opus files.
Blink Cached Media | Android, iOS: Added parsing support for Blink Cached Media.
Blink Device Information | Android, iOS: Added parsing support for Blink Device Information.
Blink User Information | Android, iOS: Added parsing support for Blink User Information.
Chrome Affiliations | Android, iOS, macOS, Windows: Added parsing support for Chrome Affiliation.
Chrome Cache Records | iOS, macOS, Windows: Updated parsing support to improve performance and recover more data.
Chrome Logins | Windows: Updated parsing support to allow for password extraction and decryption of data.
Device Information | iOS: Updated parsing support to recover the IMSI associated with the device.
EML(X) Files | iOS: Added parsing support for EML(X) Files from iOS devices.
Facebook Messenger End-to-End Encrypted Chats | Android, iOS: Added parsing support for Facebook Messenger End-to-End Encrypted (E2EE) chats.
iMessage/SMS/MMS | iOS: Updated parsing and carving support to recover message reactions.
Instagram Direct Messages | iOS: Updated parsing support when recovering attachments, and updated information in the Artifact Reference Guide.
Instagram Posts | Android: Updated parsing support to recover missing data. [v224.2.0.20]
Installed Applications | iOS: Updated parsing support to remove duplicate hits.
MEGA Chat | iOS: Updated parsing support to recover missing data. [v8.1.1]
Ring Cached Media | Android, iOS: Added parsing support for Ring Cached Media.
Ring Device Information | Android, iOS: Added parsing support for Ring Device Information.
Ring User Information | Android, iOS: Added parsing support for Ring User Information.
Signal Messages | Android: Updated parsing support to recover sender name and recipient name.
Signal Messages | iOS: Updated parsing support to recover more accurate sender and recipient data about local users.
Unified Logs | iOS, macOS: Added parsing support for Unified Logs. Note that enabling this artifact can significantly increase processing time, so it is deselected by default in AXIOM Process.
Windows Search - Calendar | Windows: Added parsing support for Windows Search - Calendar.
Windows Search - Contact | Windows: Added parsing support for Windows Search - Contact.
Windows Search - Document | Windows: Added parsing support for Windows Search - Document.
Windows Search - Image | Windows: Added parsing support for Windows Search - Image.
Windows Search - Internet Explorer | Windows: Added parsing support for Windows Search - Internet Explorer.
Windows Search - Outlook | Windows: Added parsing support for Windows Search - Outlook.

Cloud

AXIOM now supports acquiring AWS EC2 instances as snapshots.
Updated the Download Your Data import process for Instagram to capture Media hits from the new format.

Processing

The option to use Comae for memory analysis has been extended to AXIOM term licenses.
AXIOM Cyber now offers processing standalone MFT files as a new evidence source.

Examining

The default color for CAID Category 8 has been changed to white, for consistency with CAID standards.
The preview of audio files now plays correctly.
The version of Magnet AXIOM is now included in PDF and HTML reports.
There is no longer a limit to the number of routes you can generate at a time in route view.
You can now edit evidence numbers after adding evidence sources to a case.
You can now set a default distance and time setting when generating routes.
You can now export chat messages and attachments to RSMF and upload them to Relativity for legal reviewers.

Bug fixes

Previously, AXIOM Process may not have automatically detected the keychain from a Fastrak extraction. -ENGN-11374
Previously, parsing volume shadow copies within an E01 image may not have completed if the volume shadow copy's catalog was corrupt. -ENGN-11323
Previously, the CSAM category may have been included when importing a CAID hast list. -ENGN-11089
Sometimes, in Project VIC exports, the total media files count was showing the number of files in the case rather than in the export. -EXM-2988
Sometimes, removing evidence from a case wasn't working. -EXM-3420
Sometimes, the download button for PDF previews wasn't working. -EXM-3308
Sometimes, when opening a .db file in the File system explorer, AXIOM Examine would crash. -EXM-2664
Sometimes, when trying to open a case, an error message would appear that the case couldn't be found at the selected location. -EXM-2936
When trying to filter on evidence source in the Media explorer, a warning would appear to reselect the filter. -EXM-3388
iVe Events, Trackpoints, and Waypoints were not being correctly tracked in route view. -MARS-2102
Some hits were being incorrectly reported as Chrome Extensions. -CARS-775
Sometimes, data from Edge Chromium Autofill Profiles wasn't being decrypted. -CARS-33
Sometimes, the direction of incoming or outgoing Android MMS messages from UFED Agent evidence sources was being incorrectly reported. -MARS-2057
Previously, AWS Authentication using External ID may have failed to authenticate. -CA-1893
Previously, Slack attachments may have have failed to download due to authentication token refresh errors. -CA-730
Updated the Instagram, Download Your Data import process to capture Instagram Comments from the new format. -CA-1196

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.