Artifact updates

Android

Chrome

Facebook Messenger

Instagram

Life 360 NEW

Skype Lite

TamTam Messenger NEW

Tinder

Twitter

iOS

Best Secret Folder NEW

Brave NEW

Chrome

Ecosia NEW

Life 360 NEW

Live Photos NEW

Signal

TamTam Messenger NEW

Whale NEW

Windows

Windows 10 Timeline

Cloud

Gmail

Instagram Warrant Returns NEW

Instagram warrant returns

Instagram warrant returns can contain useful information about a user's activity on the popular social media app.

import and process the Instagram warrant returns as part of your case
see who is following the user, who they follow, and the user's posts, stories, and shares more details...

Find more deleted files

Deleted files can often contain important information for your investigations.

Magnet AXIOM now searches for:

recently deleted files from the Free Queue in APFS filesystems (macOS)
artifacts in deleted archives (such as .zip and .tar files)
more details...

More SQLite improvements

Building on the new and improved SQLite view that was released in 3.1, this release adds some helpful new features.

From within the SQLite viewer, you can change the character encoding of a column in the table to encoding types such as booleans, ASCII text data, date/time formats, and more. This capability helps keep you working in Magnet AXIOM so you don't need to export the data for viewing in another tool. more details...

Artifacts

Best Secret Folder | iOS: Added support for configuration data, including password setup and hidden media folder locations. [6.7]
Brave | iOS: Added support for bookmarks, favIcons, and web and tab history. [1.9.1]
Contacts | macOS: Added support for recovering information about contacts and contact groups in Apple Contacts. [macOS 10.14]
Custom artifacts: Many new custom artifacts have been published from the community over the last few months:
- Windows 10 Timeline - Costas Katsavounidis
- Windows 10 Timeline (v2) - Costas Katsavounidis
- Your Phone (Windows 10) - Costas Katsavounidis
- Windows 10 Notifications - Yogesh Khatri
- Windows 10 Notifications (v2)- Costas Katsavounidis
- Google Drive snapshot.db - Costas Katsavounidis
- Google Docs Local Sync Data - Navid Asgharzadeh
- LG MPT - Cell Towers - Mike Williamson
- See full list
Ecosia | iOS: Added support for bookmarks, web history, and tabs. [4.0.4]
Keychain | macOS: Added support for recovering and decrypting passwords stored using Keychain.
Life 360 | Android: Added support for user accounts, contacts, single/group chats, and locations. [18.6.3]
Life 360 | iOS: Added support for user accounts, contacts, single/group chats, and locations. [18.6.3]
Live Photos | iOS: Added support for recovering the .mov, .jpeg, and .heic files that can be associated with live photos. [iOS 9 to 12]
Recovery Account Information | macOS: Recover information about the user accounts that have privileges to decrypt a FileVault encrypted volume in APFS. [macOS 10.12+]
Safari | iOS: Saved credit card information that’s recovered in Safari will now be extracted into its own Refined Result.
Signal | iOS: Updated parsing support to recover contact information. [2.33 to 2.38]
Skype Lite | Android: Added carving support for messages, group conversations, contacts, and user accounts. [1.73]
TamTam Messenger | Android: Added support for chats, contacts, and messages. [2.5.0]
The Google Searches refined result was displaying false hits on some Google URLs which weren’t from searches.
Tinder | Android: Updated support for accounts, matches, and messages. [10.15.0]
Whale Browser | iOS: Added support for autofill, bookmarks, favIcons, logins, search terms, web history, and web visits. [0.10.1]
WhatsApp | iOS: Updated support for “delivered” and “read” status messages. [2.16 and later]
Windows 10 Timeline | Windows 10: Updated support to help examiners see a timeline of a user’s activity.

Cloud

Gmail messages with labels are now organized into folders in PST exports. For example, if a message has the labels “Inbox” and “Priority,” the message appears in the PST export in folders called “Inbox” and “Priority.”
You can now load a .zip file provided by Instagram for warrant returns as a Cloud evidence source.

Magnet.AI

Magnet.AI can now search evidence for pictures of possible bedrooms.

Processing

You can now recover artifacts from deleted archives and mobile backups.
You can now search the free queue of an APFS image.
You can now set the priority of your hash sets when categorizing pictures and videos by hash value. The order of the hash sets determines how AXIOM Process categorizes pictures and videos when a matching hash value appears in more than one hash set and has different categories applied to it. AXIOM Process will apply the assigned category from the hash set with a higher priority.
In AXIOM Process, you can now acquire mobile phone SIM cards. The processed image will be available in the Case Evidence folder. Note: Magnet AXIOM does not parse artifacts from the SIM card.

Examining

HTML and PDF exports now include a summary of media categorization results if your case includes media categorizations.
Improvements were made to exporting evidence using the VICS 1.3 and 2.0 JSON formats. You can now select the media items you want to include in the export. For reviewer graded media, select which media you want to include hashes and attachments for in the export. If you've enabled a pre-set media categorization profile for Canada (Project VIC), the United States (Project VIC), or the United Kingdom (CAID), AXIOM Examine automatically selects categories of interest for each profile by default.
Improvements were made to the SQLite viewer including the ability to change the encoding of columns in a table, the ability to open BLOB data in an application of your choosing, and more.

Bug fixes

For some content in the Details card, you could not select the content and then right-click to copy it. -AXE-6169
If you attempted to open the SQLite viewer in a separate window, AXIOM Examine crashed. -AXE-6896
If you changed the time zone in Magnet AXIOM and exported evidence from conversation view to PDF, the chat preview report did not reflect the correct time zone. -AXE-6954
In some cases, Magnet AXIOM did not report consistent MAC times for GrayKey images. -AXP-4661
In some situations, AXIOM Examine was unable to create a portable case and reported an out of memory error. -AXE-4911
In some situations, when processing E01 images, AXIOM Process did not complete verification. -AXP-5027
In some situations, when you attempted to build the timeline after processing your case, AXIOM Examine reported an exception and crashed. -AXE-6915
Previously, when you attempted to acquire a Box.com account using the user name and password authentication option, the authentication window closed after you provided the login information, and you were unable to choose the services or content you wanted to acquire. -CAO-2178
Previously, when you attempted to acquire a Microsoft account using the user name and password authentication option, the spinner indicating that you were signing into the account appeared to spin indefinitely. -CAO-2168
Previously, when you saved a video artifact, the still frames of the video were saved instead of the video file. -AXE-6834
When attempting to sort pictures, some sorting options were unavailable. In some cases, selecting an available sort option caused AXIOM Examine to crashed. -AXE-6718
When loading an image, the "Select the image" dialog did not display all supported image types for virtual machines images. -AXP-4380
When some issues arose, AXIOM Examine crashed instead of logging the error and resuming analysis. -AXE-6725
Contact cards were not being recovered from carved WhatsApp Chat artifacts. -MA-372
In MBOX Email artifacts, the subject line would display an incorrect character encoding. -COMP-65
In some versions of Signal on iOS the source and location for the “Group Name” was not present for every hit where a group name was recovered. -MA-437
In the artifact explorer of AXIOM Examine, the file offset for a carved video didn’t link to the correct location in the file. -COMP-68
Signal artifacts were not being recovered for GreyKey images that were processed as an Image in Magnet AXIOM. -MA-445
The AmCache Program Entries artifact was displaying an invalid SHA1 Hash. This attribute has been removed. -COMP-18
WhatsApp geolocation messages were not including latitude/longitude and location information. -MA-42

Known issues

Here’s some information about known issues that were recently discovered:

In some cases, Chinese characters might not display properly in Outlook email previews and PST exports. For more information, log in to the Customer Portal to review the following article: Some Chinese characters display incorrectly in Outlook email previews and PST exports.

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.