Artifact updates

Android

Android Keystore NEW

Android Usage History

Chrome

Discord NEW

Gmail

TikTok NEW

WeChat

iOS

Discord NEW

Reddit NEW

TikTok NEW

WeChat

Uber

Windows

Calendar (ICS) NEW

Cloud

Slack NEW

Twitter

Facebook

macOS

Apple Accounts NEW

Bash Sessions NEW

Bluetooth Devices NEW

Calendar (ICS) NEW

CoreAnalytics NEW

Daily Logs NEW

Deleted Accounts NEW

macOS continued

Dock Items NEW

File System Events NEW

Finder MRU NEW

Finder Sidebar Items NEW

Installed Applications NEW

KnowledgeC NEW

Menu Bar Apps NEW

Network Interfaces NEW

Operating System Information NEW

Resumed Apps NEW

Startup Items NEW

Trash NEW

Wi-fi Logs NEW

macOS and APFS support

AXIOM Process now includes processing workflows specifically for macOS computers with APFS.

Support for macOS also includes:

Decryption of containers and volumes encrypted using FileVault2.
Support for dozens of user and operating system artifacts.
Support for browsing APFS filesystems in the Filesystem explorer in AXIOM Examine.

Enhanced timeline capabilities

Use the Timeline explorer to see a single flat timeline of all timestamped data in a case (includes both artifacts and files).

Data is visualized on a graph and categorized based on the type of timestamp (for example, deleted file, device interaction, or file download).

To make your analysis more focused, you can filter by date/time ranges, specific artifacts, items of interest, keywords, and more. More details...

Improved media categorization (Project VIC/CAID)

Magnet AXIOM now comes with more capabilities for categorizing pictures and videos. While AXIOM Process already supported using Project VIC and CAID hash sets in scans, there's a lot more you can now do with media categorization in AXIOM Examine.

Improvements to media categorization allow you to:

Create and manage media profiles.
Categorize files while in thumbnail view.
Save manually categorized evidence back to your hash sets.
More details...

AXIOM Cloud updates

The AXIOM Cloud module has added support for new Facebook, Twitter, and Slack sources.

With AXIOM Cloud you can:

Process warrant returns received from Facebook.
Pocess locally downloaded Facebook user data.
Acquire public Twitter data, such as tweets and users.
Recover messages, users, channels and other data from a Slack user's account.
More details...

More highlights

Other useful features in Magnet AXIOM 3.0:

Samsung recovery image acquistions can now be decrypted.
Performance improvements to Magnet.AI scans.
Changes to Dynamic App Finder to locate relevant data more reliably. More details...

More updates

Artifacts

Android Keystore | Android: Added support for parsing tokens and credentials. [Android 6.0+]
Android Usage History: Updated support to recover information from multiple user accounts and package and configuration events. [Android 9.0]
Apple Accounts | macOS: Recover information about external accounts that were configured on the macOS device, including local account, user name, account ID, account added date/time, account type, and more. [macOS 10.14]
Bash Sessions | macOS: Recover information about bash sessions including session ID, user, start date/time, end date/time, and session command history. [macOS 10.14]
Bluetooth Connection History | macOS: Recover Bluetooth connection history such as address, type, last seen date/time, and UUID. [macOS 10.14]
Calendar | macOS, Windows: Recover information from calendar files such as event name, description, date/time, location, and more.
Chrome | Android: Updated support to recover Sync Data and Sync Accounts. [Chrome 59.0.3071.125]
Chrome Autofill | Windows: Now includes an attribute that indicates the date that the autofill value was last used. [61.0] New update
CoreAnalytics | macOS: Recover up to a month of information about system and application usage. [macOS 10.13, 10.14]
Deleted Accounts | macOS: Recover deleted Mac user account information, such as user name, real name, date and time of deletion, unique user ID, and more. [macOS 10.13, 10.14]
Device Information | iOS: Improved existing support and updated support to recover device information such as model, OS version, passcode set, and more. [iOS 12.1]
Discord | Android: Added support recovering information from the Discord app, including account info, conversations, call logs, and channels. [8.3.3]
Discord | iOS: Added support recovering information from the Discord app, including account info, conversations, call logs, and channels. [2.4.2]
Disk Status Daily Log, Network Status Daily Log, Local System Status Daily Log. | macOS: Added support to recover daily logs of a macOS device. [macOS 10.14]
- Disk Status Daily Log: Recover disk status information such as log date/time, disk device, disk size, and more.
- Network Status Daily Log: Recover network interface status information such as log date/time, BSD name, MTU, network, and more.
- Local System Status Daily Log: Recover local system status information such as log date/time, system up time, number of logged in users, and more.
Dock Items | macOS: Recover information about items located on the user's dock, including application name, package name, state, user name, folder path, and GUID. [macOS 10.14]
Facebook Messenger | Android: Updated to indicate whether a message was deleted by the user. [201.0.0] New update
File System Events | macOS: Recover file system event information such as file name, file path, flags, event ID, file ID, file system created date/time, and file system last modified date/time. [macOS 10.11.6, 10.13.2, 10.14.1]
Finder MRU, Recently Used Items, Spotlight Shortcuts | macOS: Added support to parse the most recently used items. [macOS 10.14]
- Finder MRU: Recover information about recently accessed paths in the Finder application on macOS devices, the path, accessed order, MRU type, and creator name.
- Recently Used Items: Recover information about the most recently accessed items from many sources, including file name, file path, UUID, MRU type, accessed date/time, creator date/time, creator name, file system, and more.
- Spotlight Shortcuts: Recover information about user searches in the Spotlight application, including the search query, display name, accessed date/time, and the URL from applications, files, or websites.
Finder Sidebar Items | macOS: Recover information about items located in the sidebar, including name, type, category, and bookmark data. [macOS 10.14]
Gmail | Android: Updated existing support for the latest version. [9.1.13.233495724 to 9.2.3.235065705]
Google Play | Android: Updated carving support to better recover WAL files from SQLite databases.
iMessage Chats | macOS: Added support to parse archived chats. [macOS 10.14]
Installed Applications | macOS: Recover information about installed applications such as application name, bundle name, version, icon, and more. [macOS 10.14]
Login History | macOS: Recover login date/time, user names, and success or failure of logins. [macOS 10.11+]
KnowledgeC | iOS: Updated support to recover missed hits on some iOS versions. Applies to KnowledgeC Application Focus, Device Lock States, Device Orientation States, Device Plugged-in States, and Screen Backlight States. [iOS 10]
Mail | macOS: Added support for recovering emails and attachments. [macOS 10.14]
Menu Bar Apps | macOS: Added support to parse menu bar items and recover the timestamp of the last menu bar notification. [macOS 10.14]
Network Interfaces | macOS: Recover network interface information such as network interface name, network type, BSD name, service path details, Mac address, and USB product name. [macOS 10.14]
Network Profiles | macOS: Recover saved network information such as BSSID list, channel history, last connected time, SSIDstring, securitytype, sharemode, userrole, and more. [macOS 10.14]
Network Utilities | macOS: Recover information about network utilities such as utility tab, search query, and last modified date/time. [macOS 10.14]
Operating System Information | macOS: Recover system information such as time zone, computer name, localhost name, installation date, and more. [macOS 10.14]
Quarantined Files | macOS: Added support to recover information about files that were downloaded and attachments that were saved to the macOS device. Recovered information includes quarantine date/time, bundle identifier, application name, and more. [macOS 10.9, 10.13, 10.14]
Resumed Apps | macOS: Recover information for applications that are set to reopen after a macOS computer wakes up or restarts. [macOS 10.14]
Skype Notifications | Android: Added support for recovering notifications in the latest Skype updates. [8.1 to 8.15] New update
Startup Items | macOS: Added support to recover information about items that open when a macOS device starts. Recovered information includes application package name, startup process arguments, type, and more. [macOS 10.14]
Telegram | Android: Updated support to recover user contact information. [5.4.0]
TikTok | Android: Added support to recover chats and saved media. [10.1.10]
TikTok | iOS: Added support to recover chats and saved media. [10.3.0]
Trash | macOS: Added support for recovering files that the user has sent to the trash [macOS 10.14]
Twitter | Android: Improvements to carving, resulting in more hits. New update
USB Connection History | macOS: Recover USB connection history such as connection date/time, USB serial number, vendor ID, product ID, and device release number. [macOS 10.13+]
Uber | iOS: Merged Uber Profiles and Accounts and added support for Cached Locations and Rider Payment Details. [3.340]
User Accounts | macOS: Recover user information such as user name, real name, user picture, home directory, date and time of account creation, and more. [macOS 10.14]
Verizon Messages | Android: Added support to parse SMS messages.
Volume Information | macOS: Recover information about volumes that were connected to the iOS device such as volume name and creation date/time. [macOS 10.14, 11-13]
WeChat | iOS: Updated support to differentiate between group chats and one on one chats. [6.6.5]
Wi-Fi Logs | macOS: Added support to recover information about networks that the macOS device connected to but did not save. Recovered information includes the line, network name (SSID), type, date/time, event, and original text of connected networks. [macOS 10.14]

Cloud

You can now acquire a user’s Slack account including public channel discussions and private messages.
You can now acquire public Twitter activity, including Tweet and user information, without requiring login information for specific users.
You can now load a .zip file generated from the Download Your Data (JSON format) option in Facebook as a Cloud evidence source.
You can now load a .zip file provided by Facebook for warrant returns as a Cloud evidence source.

Magnet.AI

In AXIOM Process, you can now click the “Select all” option to quickly select all picture and chat categories when categorizing evidence with Magnet.AI.
Magnet.AI can now search picture evidence for possible militants.
Magnet.AI has improved accuracy, increased performance for categorization of images up to 5 times on systems with a supported GPU, and can now categorize a piece of data with multiple labels.
When you categorize evidence with Magnet.AI, you can now configure AXIOM Examine to either prioritize the speed of categorizing evidence or prioritize multi-tasking.

Processing

AXIOM Process now includes support for loading images, files, and folders from macOS computers with the APFS file system. Support for APFS includes:
- The ability to decrypt FileVault2-encrypted containers and volumes for supported evidence sources using a user password or recovery key.
- The ability to search for more macOS artifacts including user account information, file system events, connected devices, and more.
AXIOM Process now includes support for parsing VICS 2.0 JSON files.
This release includes several improvements to the Dynamic App Finder including:
- The ability to analyze text in text-based SQLite columns to detect the following data: country names, timestamps, email addresses, coordinates, KML, phone numbers, state and province names, street names, and URLs. Now, the Dynamic App Finder will find more tables and automatically map more columns per table.
- General improvements such as the ability to copy SQLite database table values by right-clicking a value.
- Improvements to the State/Province mapping option resulting in significantly fewer false positives.
You can now more easily manage your hash sets in AXIOM Process—including the ability to organize your hash lists into hash sets for easy selection when processing evidence and make updates to your hash sets such as incremental updates of Project VIC and CAID hash sets downloaded from Hubstream. When you upgrade to Magnet AXIOM 3.0,
- Consider removing your existing hash lists and add them as new hash sets to take advantage of the full set of VICS metadata.
- Any previously loaded .txt files for hash matching are migrated to the “Tag files with matching hash values” table in “Calculate hash values”. To continue using these hashes for picture and video categorization, please load these hash lists to a new hash set.
In AXIOM Process, under evidence sources added to case, the evidence number for an iOS image now matches the iOS device’s model number.
Performance for acquiring E01 images is now improved.
You can now acquire empty folders from SD cards using the ADB acquisition method. New update

Examining

In AXIOM Examine, support for Project VIC and CAID now allows you to:
- Manually categorize or grade pictures and videos in the Thumbnail view including the ability to quickly grade media using new keyboard shortcuts and bulk categorization options.
- Manage your media categorization profile by selecting which media categories you want to apply for each case. Choose pre-set media categorization profiles for Canada (Project VIC), the United States (Project VIC), and the United Kingdom (CAID), or you can add a new list or import a list of media categories.
- View details about media categorization—such as hashes, categorization source, VICS metadata, and more—in the new Media categorization details card.
- Filter evidence based on which hash set categorizations were assigned to an item during pre-processing.
- Filter for items that have additional VICS data such as tags, series, distributed media, identified victims, and more.
- Add reviewer graded media back to your hash sets in the Magnet AXIOM hash database for use with future cases.
In the new Timeline explorer, you can see all timestamped evidence from the Artifacts and File systems in a flat timeline. In the Timeline explorer, you can:
- See a visualization of time in an interactive graph where you can examine specific timeframes, identify spikes in activity, and establish patterns in behavior.
- Analyze hits in activity by clicking a node in the timeline graph. The Timeline explorer automatically takes you to the first timestamped item for the activity spike in the evidence table below the timeline graph.
- Quickly browse between multiple timestamps for a single hit item with multiple timestamps.
- Apply filters—such as data types, timeline categories, date/time ranges, and more—to help decrease the scope of evidence to search.
- Share evidence from the timeline by exporting timeline data in a CSV file.

Bug fixes

In some cases, after upgrading to Magnet AXIOM 3.0, you weren't able to see tags you previously applied to evidence. -AXE-6716 New update
If your organization used Windows AppLocker, you weren’t able to create or work with a portable case. -AXE-6520
Previously, if you configured AXIOM Process so that AXIOM Examine began categorizing evidence immediately after your case finished processing, or if you configured AXIOM Examine to automatically build connections at case open, evidence classification and connection building sometimes failed. -AE-782
When servers denied data acquisition for iCloud Backups, iCloud Drive, and iCloud Photos for no reason, the data acquisition failed without restarting the acquisition or continuing acquisition for the next set of data. -CAO-1906
When zip files had no value for the Access Time and Modified Time, AXIOM incorrectly displayed Access Time and Modified Time as having a timestamp from the time of processing. -AXP-3929
Chat threads were not being created for Slack messages. -MA-188
In some cases, iMessages displayed several characters before a message, sometimes resulting in incorrect date/time reporting. -MA-224
Messages weren’t being decrypted in WeChat 7.0 on Android. -MA-47
When exporting from Outlook messages, the PST export option was unavailable. -MA-210
Media that was shared on Kik Messenger were not displayed in the chat threads on AXIOM Examine. -MA-204

Known issues

In some cases, if a case is processed in a newer version of AXIOM and actions are later performed in an older version of AXIOM, an error message might appear or you might experience unexpected behavior. Workaround: Update Magnet AXIOM to the latest version.
In some situations, antivirus software is known to prevent Magnet AXIOM from creating a portable case. For example, if Malware URLs are part of the evidence being exported, the portable case might not get created successfully. Workaround: Turn off the antivirus software and create the portable case. Turn on the antivirus software again.
Magnet AXIOM crashes when out of disk space. Workaround: Check the amount of disk space available for the case and acquisition directories before you start processing.
When you process an encrypted iTunes backup and provide the password to decrypt it, the data might still appear in its encrypted form in AXIOM Examine. Workaround: Extract the iOS image from the compressed container to a different location on your computer. In AXIOM Process, perform a Files and Folders scan. (In the Evidence sources section, click Mobile > iOS > Load evidence > Files and Folders.)