Artifacts
- Application Install States | iOS: Recover logging information for applications that are installed and uninstalled on an iOS device. [iOS 11.1.2] New update
- Device Information | iOS: Added additional information about the OS and iTunes versions, and the presence of iCloud and Find my phone.
- Facebook Messenger | Android: Now includes evidence from Facebook Messenger Kids. New update
- Facebook Messenger | iOS: Now includes evidence from Facebook Messenger Kids. New update
- Grindr | iOS: Updated support for parsing buddies and messages. [5.0.0] New update
- KakaoTalk | Android: Updated support for decrypting messages. [8.2.6] New update
- Messages | Android: Added support for recovering messages and attachments that use the RCS protocol.
- Messages | Android: Attachments can be recovered and displayed in chat threading. [3.5+]
- Notes | iOS: You can now decrypt locked notes by specifying the encryption password for the app. To specify the password in AXIOM Process, see Artifact Details > Notes > Options.
- Outlook | Android: Added support for parsing email, calendar, contacts, and accounts information.
- Outlook | iOS: Added support for parsing email, calendar, contacts, and accounts information.
- Pictures: Improvements to how pictures are recovered, including more hits and better picture quality on some raw pictures.
- Samsung Internet | Android: Added support for recovering bookmarks. [9.0]
- Skype Lite | Android: Added support for recovering messages, conversations, contacts, and user accounts. [1.75]
- Viber Chat Messages | Windows: Updated existing support for the latest version. [8.5-9.9]
- WebKit Browsers: Artifacts hits that were sometimes attributed to Safari are now properly attributed to WebKit.
- WebKit Browsers: Chrome, Opera, and 360 Browser artifacts are replaced with a WebKit Browsers artifact that includes hit from all apps.
Processing
- Two new case types are now available when setting up your case details: "probation/parole violation" and "drug offenses".
Examining
- When you open a case from AXIOM Examine, you now select the case.mfdb file instead of the case folder.
Bug fixes
- If you attempted to acquire a mobile device through MTP, an error message appeared. -MMI-1004
- Attachments were not showing up in the chat threading view for any messaging artifacts. -MA-121
- In some cases, hits were missed for artifacts that are based on recovering information from ESE databases. New update -MA-185
Known issues
- In some cases, if a case is processed in a newer version of AXIOM and actions are later performed in an older version of AXIOM, an error message might appear or you might experience unexpected behavior. Workaround: Update Magnet AXIOM to the latest version.
- In some cases, if you configured AXIOM Process so that AXIOM Examine begins categorizing evidence immediately after your case finishes processing, or if you configured AXIOM Examine to automatically build connections at case open, evidence classification and connection building will fail. Workaround: After you start your scan in AXIOM Process, immediately close AXIOM Examine. When your scan completes, restart AXIOM Examine.
- In some situations, antivirus software is known to prevent Magnet AXIOM from creating a portable case. For example, if Malware URLs are part of the evidence being exported, the portable case might not get created successfully. Workaround: Turn off the antivirus software and create the portable case. Turn on the antivirus software again.
- Magnet AXIOM crashes when out of disk space. Workaround: Check the amount of disk space available for the case and acquisition directories before you start processing.
- When you process an encrypted iTunes backup and provide the password to decrypt it, the data might still appear in its encrypted form in AXIOM Examine. Workaround: Extract the iOS image from the compressed container to a different location on your computer. In AXIOM Process, perform a Files and Folders scan. (In the Evidence sources section, click Mobile > iOS > Load evidence > Files and Folders.)
