Artifact updates

Android

Device Information

Google Maps

Instagram

Keystore

TextNow

Tinder

Zalo

iOS

Apple Wallet

Facebook

Facebook Messenger

Instagram

Installed Applications

InteractionC NEW

iOS Notes

iOS Photos Media Information NEW

Signal

Significant Locations

Threema NEW

Yahoo Webmail

Cross-platform

Calendar

Device Identifiers NEW

Google Searches

Outlook

Pictures

Windows

Amcache

OS Information

Prefetch Files

Support for processing DAR images

In Magnet AXIOM 3.11.0 and higher, you can now process .dar images created using Cellebrite for full filesystem extractions of iOS devices (including from CAS and UFED 4PC).

UFD extractions for iOS contain four timestamps: changed, modified, accessed and created. The changed, modified, and accessed timestamps are stored inside the .dar image. However, the created timestamp is stored in a separate file, external to the .dar file, called system_metadata.plist. You can find the .plist file alongside the .dar file in the original extraction folder (where you’ll also find a .udf file).
For information about processing .dar images in Magnet AXIOM, log in to the Customer Portal to review Process a Cellebrite .dar image so Creation times are included in your evidence.

Device Identifiers artifact

You can now associate device information—such as IP addresses and MAC addresses—to a specific person with the Device Identifiers artifact.

The Identifiers refined result has been split into two distinct artifacts: Device identifiers and People Identifiers. Device identifiers include IP addresses, MAC addresses, and SIDs, while People Identifiers include names, usernames, phone numbers, and email addresses.
Use the Device Identifiers artifact to identify the unique devices, networks, IPs, or other Device Identifiers in a case.
Device Identifiers can help across multiple cases. For example, by tying a user to a specific location via Wi-Fi network or SID, or by tying a user to a particular device with a Camera Serial Number.
More details...

Artifacts

Amcache File Entries and Program Entries | Windows: Renamed the Program ID fragment to Program Name.
Apple Wallet Transactions | iOS: Added support to recover transaction histories. [iOS 11]
Calendar Events | All platforms: Updated support to reduce the number of poorly carved hits.
Device Information | Android: Added support for recovering the advertising ID of the device.
Facebook Messenger Messages | iOS: Added support to recover thread keys. [130]
Facebook Messenger | iOS: Updated support to recover messages, contacted users and groups. [255]
Google Maps Business Locations | Android: Added support to recover the Ludocid, Place ID, and FID for a location. [10.32.1]
Google Maps Directions | Android: Added support to recover origin and destination information in the same hit from a single search. [10.32.1]
Google Searches | All Platforms: Updated support to recover the load date and time of the previous page.
Identifiers | All platforms: The identifiers refined result has been split into two distinct artifacts: Device identifiers and People Identifiers. Device identifiers include IP Addresses, MAC Addresses and SIDs, while People Identifiers include names, usernames, phone numbers and email addresses.
Instagram Profiles | iOS: Updated support for recovering profiles in the latest version. [127]
InteractionC | iOS: Added support for recovering contacts and interactions. [iOS 12]
Keystore | Android: Updated support to recover keystore entries for all the accounts a user has logged in with for an app. [Android 10]
LinkedIn Searches | Android: Added support for recovering a user's search queries.
Notes | iOS: Added support for decrypting Notes using encryption keys recovered in the Apple Keychain Generic Passwords artifact. [iOS 13]
Outlook Emails | Windows: Added support for recovering sensitivity flags.
Photos | iOS: Added support to recover photo and photo album data. [iOS 13.1]
Pictures | All Platforms: Added null checks to ignore pictures that are null.
Prefetch Files | Windows: Updated support to display application paths even if the Application fragment is not complete.
Signal Messages | iOS: Updated support for recovering and decrypting messages. [3.2]
Significant Locations | iOS: Added support to recover the location of address, city, country and more. [iOS 13]
Telegram | Android: Updated support to recover all media types, messages and attachments. [5.15.0]
TextNow Contacts | Android: Updated support to recover contact information. [6.50.2]
TextNow Profiles | Android: Updated support to allow the Profile artifact to populate a null value for the phone number when there is no assigned number. [20.0.1+]
Threema Messages | iOS: Added support for recovering and decrypting sent and received messages. [10]
Threema Users | iOS: Added support for recovering user information. [10]
Tinder Accounts | Android: Updated support to recover a user’s biography, last activity date/time, and distance preference. [11.2.1]
VK Messages | Android: Updated support for displaying attachment types. [5.47]
VK Messages | iOS: Added support to preview picture and video attachments from messages in chat threads. [5.0+]
Yahoo Webmail | iOS: Updated support to recover contact information. [6.0.8]
Zalo Messages | Android: Updated parsing support for recovering messages. [20.01.01]
Zalo Messages | Android: Updated support to recover message type information, including system messages, GIFs, stickers and more. [20.01.01]
Zalo Messages | iOS: Updated support to recover message type information, including GIFs, link previews and more. [19.12.03]

Cloud

You can now acquire WhatsApp accounts that use two-factor authentication.
You can now process the newest form of Snapchat warrant returns.

Processing

After a search completes, the Exceptions section appears even if there were no exceptions during the search.
After a search completes, you can now view a list of your scan settings.
After a search completes, you can now view the Start time, End time, and Duration of the search for the entire search, as well as for each source that was processed.
When you enable the Dynamic App Finder, AXIOM Process displays the “Search complete” screen so that you can immediately view the scan summary.
You can now process .dar images created using Cellebrite. Processing the Cellebrite .dar image with the system_metadata.plist will allow for Creation times to be included in your evidence while processing the .dar image without the accompanying system_metadata.plist file will result in a fully processed case without Creation times. To load both the .dar and system_metadata.plist files, please point AXIOM Process to the .ufd file when loading your evidence. For more information, log in to the Customer Portal to review Process a Cellebrite .dar image so Creation times are included in your evidence. Note: At this time, Magnet AXIOM does not support .dar images generated using Linux.
When you acquire a quick image of an Android device, you can now choose whether or not you want to acquire live data, perform an ADB backup, run the acquisition agent, and acquire data from the SD card.
When you attempt to acquire two identical devices using the same imaging type, you will receive a warning message that the settings of the second acquisition will override the settings of the first acquisition.

Bug fixes

AXIOM Process was unable to acquire data from Google Activity. -CAO-2717
Attachments from PST emails in HTML exports were not being properly rendered because they were being incorrectly saved as .pst files. -AXE-7922
BlackLight L01 images were not able to be processed. -AXP-6297
Chat thread video attachments in HTML exports could not be viewed because there were no clickable links. -AXE-7918
Email attachments in Excel exports could not be viewed because there were no clickable links. -AXE-7883
Email attachments in HTML exports could not be viewed because there were no clickable links. -AXE-7878
Facebook Messenger Messages and Facebook Messages sometimes carved hits from incorrect sources. -MA-1647
Google Drive file names in Korean, Chinese, and Japanese were appearing as underscores in the File system explorer. -CAO-2569
HFS+ files with colons in their file names were not being searched for in keyword searches. -AXP-4908
IMAP/POP mail acquisition has been improved to capture messages in all selected top level folders and one level of subfolders. -CAO-2729
Image hash verification end times were appearing incorrectly in AXIOM Process logs. -AXP-6471
Recent Devices were unable to be acquired from Google Accounts. -CAO-2804
Sometimes, portable case files were very large because Magnet AXIOM was attempting to locate the source ID multiple times for artifacts that appeared both in Refined Results and their original categories. -AXE-7916
Sometimes, portable cases would fail to be created when they contained a large amount of media items or chat threads. -AXE-7817
Sometimes, videos could not be viewed in portable cases, PDF exports, and HTML exports. -AXE-7896
Sometimes, when creating a PDF or HTML export, an error message would appear indicating that the process could not access the file, even though the export was completed successfully. -AXE-7889
When scanning HFS+ drives, some data, such as pictures and user data, was not being recovered. -AXP-5895
When selecting which Box.com data to acquire, the Select all and Clear all buttons were not working correctly. -CAO-2808
When selecting which IMAP email folders to acquire, only the selected folder and one level further would be selected, even if more folder levels existed. -CAO-2769
When you checked for Magnet AXIOM updates on an offline computer, the correct URL was not provided. -AXP-6167
When you saved an artifact that was an attachment from a PST email, the file was being incorrectly saved as a .pst file. -AXE-7860
When you tagged files with matching hash values in AXIOM Process, these tags would appear in the File system explorer in AXIOM Examine, but the corresponding artifacts would not get tagged. -AXE-7812
For Installed Applications on iOS 12.2 and later, the content that was found in the “Internal Version” fragment in earlier versions, was being displayed in the “Display Version” fragment. Additionally, the content found in the “Display Version” fragment in earlier versions, was not being recovered. -MA-1549
Full email bodies could not be recovered from Windows 10 Mail. -COMP-680
If a user had more than one Yahoo Webmail account, some emails might be flagged as duplicates if they’re received by both accounts. -MA-1514
In Signal 2.36.1 for iOS, the number of recovered contact hits was incorrectly reported. -MA-1592
In the Instagram Posts for Android, the Poster ID and Post ID fragments did not accurately describe the data that was recovered. -MA-1310
Some portable cases that were getting created were substantially larger in size than the original case. -COMP-767
The Receiver ID was not displayed for Facebook Messenger Messages for Android. -MA-1675
The Last Accessed Time Enabled values that were recovered from Windows OS Information were being displayed as negative numbers. -COMP-602

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.