Artifacts
- Device Information | iOS: Added additional information about the OS and iTunes versions, and the presence of iCloud and Find my phone.
- Messages | Android: Added support for recovering messages and attachments that use the RCS protocol.
- Messages | Android: Attachments can be recovered and displayed in chat threading. [3.5+]
- Notes | iOS: You can now decrypt locked notes by specifying the encryption password for the app. To specify the password in AXIOM Process, see Artifact Details > Notes > Options.
- Outlook | Android: Added support for parsing email, calendar, contacts, and accounts information.
- Outlook | iOS: Added support for parsing email, calendar, contacts, and accounts information.
- Pictures: Improvements to how pictures are recovered, including more hits and better picture quality on some raw pictures.
- Samsung Internet | Android: Added support for recovering bookmarks. [9.0]
- Skype Lite | Android: Added support for recovering messages, conversations, contacts, and user accounts. [1.75]
- Viber Chat Messages | Windows: Updated existing support for the latest version. [8.5-9.9]
- WebKit Browsers: Artifacts hits that were sometimes attributed to Safari are now properly attributed to WebKit.
- WebKit Browsers: Chrome, Opera, and 360 Browser artifacts are replaced with a WebKit Browsers artifact that includes hit from all apps.
Processing
- Two new case types are now available when setting up your case details: "probation/parole violation" and "drug offenses".
Examining
- When you open a case from AXIOM Examine, you now select the case.mfdb file instead of the case folder.
Bug fixes
- If you attempted to acquire a mobile device through MTP, an error message appeared. -MMI-1004
- Attachments were not showing up in the chat threading view for any messaging artifacts. -MA-121
Known issues
- In some cases, if a case is processed in a newer version of AXIOM and actions are later performed in an older version of AXIOM, an error message might appear or you might experience unexpected behavior. Workaround: Update Magnet AXIOM to the latest version.
- In some situations, antivirus software is known to prevent Magnet AXIOM from creating a portable case. For example, if Malware URLs are part of the evidence being exported, the portable case might not get created successfully. Workaround: Turn off the antivirus software and create the portable case. Turn on the antivirus software again.
- Magnet AXIOM crashes when out of disk space. Workaround: Check the amount of disk space available for the case and acquisition directories before you start processing.
- When you process an encrypted iTunes backup and provide the password to decrypt it, the data might still appear in its encrypted form in AXIOM Examine. Workaround: Extract the iOS image from the compressed container to a different location on your computer. In AXIOM Process, perform a Files and Folders scan. (In the Evidence sources section, click Mobile > iOS > Load evidence > Files and Folders.)