Artifact updates

Android

Cake NEW

Chrome

Glide NEW

Instagram

Line

Signal

Sim Card NEW

SMS and MMS

TamTam Messenger

TikTok

Verizon Messages NEW

iOS

Chrome

Glide NEW

KnowledgeC

Line

Significant Locations

Sim Card NEW

TamTam Messenger

Twitter

Windows

Real Player NEW

Skype

macOS

QuickTime Player NEW

Snapchat warrant returns

Snapchat warrant returns can contain useful information about a user's activity on the popular social media app.

import and process the Snapchat warrant returns as part of your case
recover messages, group chat details, and any media that was included with the return
more details...

Recover SIM card data

Following up the 3.2 release and the introduction of SIM card acquisitions, 3.3 brings additional artifact support.

Magnet AXIOM can recover the following artifacts from SIM cards:

recover SMS messages, service provider information, phone numbers, IMSI numbers, and ICCID numbers
supported on all mobile operating systems (Android, iOS, Kindle, and Windows Phone)
more details...

Artifacts

Cake | Android: Added support for recovering messages and user account information. [1.9.1]
Chrome | All platforms: Updated support for the ranked listing of top sites.
Glide | Android: Added support for video chat and texting messages. [10.3]
Glide | iOS: Added support for video chat and texting messages. [6.3]
Instagram | Android: Updated support for posts and profiles. [90]
Instagram | Android: Updated support for the groups artifact. [90]
KnowledgeC | iOS: Added parsing support for recovering Do Not Disturb and Siri UI usage. [iOS 12]
QuickTime Player | macOS: Added support to recover the file name, path, volume UUID and volume name for played files. [10.14]
Real Player | Windows: Added support for recovering video history and library assets. [18.1]
Recovery Account Information | macOS: Recover information about the user accounts that have privileges to decrypt a FileVault encrypted volume in APFS. [macOS 10.12+]
Significant Locations | iOS: Updated support to account for changes in the latest version. [iOS 12]
Skype | Windows 10: Updated support for viewing pictures in chat threads. [14.4]
TamTam Messenger | iOS: Added support for messages, groups, and channels. [2.6.1]
TikTok | Android: Updated carving support for contacts. [11.6.4]
Verizon Messages | Android: Added support for incoming and outgoing messages. [10.3]
Viber | Android: Updated support for the participant and messages. [10.8.0 to 10.9.0] New update

Cloud

Earlier this year, Google announced that it will no longer allow you to sign in to Google services through embedded browser frameworks beginning in June 2019. Due to this change, Magnet AXIOM might not be able to support WhatsApp and the following data sources for Google accounts: Google Activity, Google Timeline Locations, Google Connected Apps, Recent Devices, Passwords, and Google Hangouts. For more information, log in to the Customer Portal to review the following article: Changes to supported data sources for Google accounts.
You can now load a .zip file provided by Snapchat for warrant returns as a Cloud evidence source. This release includes artifacts for recovering messages, group chat, friends list, IP history, and account information in addition to processing all media files that are included as a part of the return. New update

Processing

AXIOM Process now includes support for bypassing the lock screen for many LG Android devices. After bypassing the lock screen, you can perform an acquisition of the device without needing the passcode. Note: AXIOM Process does not support bypassing the lock screen for LG Nexus devices.
AXIOM Process now includes support for processing artifacts from SIM cards including ICCID, IMSI, stored phone numbers, service provider name, and some SMS messages.

Examining

AXIOM Examine now automatically applies the same media category to any other media items in the case with a matching MD5 or SHA1 hash.
AXIOM Examine now includes a log file that tracks when you add or remove tags from items in a case. You can find the new log file, TagsLog.txt, in your Case folder.
For all views in the Artifact explorer as well as the Timeline explorer, you can now use the “Save artifact to” option for any type of artifact with attachments in a case.
We have removed the following feature that we weren't quite ready to ship: "In HTML and PDF reports, the Media categorization summary section now includes a column for tracking the number of unique hashes in each category." If you updated to Magnet AXIOM 3.3.0 and are using media categorization—specifically, the unique hash count for CAID categories—the information that appears in the Unique hashes column for PDF and HTML reports is incorrect. Please reprocess the case with AXIOM 3.3.1. For more information, log in to the Customer Portal to review the following article: Unique hash count for CAID categories is incorrect in PDF and HTML reports. New update
In the SQLite viewer, you can now build and execute queries that contain JSON features enabling you to look into JSON data within a cell and return data from inside that text block.
Performance improvements for case load, searching, filtering, and sorting with large data sets in AXIOM Examine.
When exporting evidence using the VICS 1.3 and 2.0 JSON formats, you can now choose to include attachments for reviewer graded media items only.

Bug fixes

Chat artifacts did not display in Conversation view in a Portable case. -AXE-6313
In addition to supporting Facebook warrant returns provided by Facebook between January 2017 and April 2019, Magnet AXIOM now includes support for the new format of warrant returns that Facebook began providing in mid-April of 2019. -CAO-2234
In some cases, when you tried to categorize picture or chat evidence using Magnet.AI, there are no categorization options available for you to select in AXIOM Process or AXIOM Examine. -AE-860
Previously, when you tried to acquire an Apple iCloud account using a known user name and password, AXIOM Process indicated that the Apple ID or password was incorrect. -CAO-2240
VICS 1.3 and 2.0 JSON exports generated in AXIOM Examine now calculate counts for the TotalMediaFiles and TotalPrecategorized attributes based on total content in the case file. -AXE-7015
When you set a specific date and time format in AXIOM Examine, dates and times were displayed using an incorrect format in the absolute and relative date/time filters. -AXE-6138
In some cases, when you attempted to acquire a device using EDL mode, AXIOM Process would crash. -MMI-1047
After extracting data from Android 5.1.1, deleted messages were not appearing in the mmssms.db when viewing the file in the Hex view. -MA-543
Resolved an issue in Examine where audio (.MP3) attachments were not playable. -MA-579
Telegram 5.1.1 on iOS 12.0.1 was not parsing conversations. -MA-460
When viewing the Application Install States artifact, the value for the Date/Time attribute was appearing under the Item attribute. -MA-490
MIME types for Facebook Messenger attachments were reported incorrectly. -MA-592 New update
Some Snapchat memories for Android could not be recovered. -MA-556 New update
System messages in Kik (version 11.19) for iOS were not being carved correctly. -ART-8365 New update

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.