Artifact updates

Android

Baidu NEW

Hangouts Dialer

Instagram

Line

Snapchat

Wi-Fi Logs

iOS

Apple Health NEW

Line

PowerLog-Battery Usage NEW

Snapchat

Waze NEW

Windows

Firefox

Cross-platform

Videos

Officer wellness

We've introduced several enhancements to media categorization in AXIOM Examine focused on your wellness. To help reduce your exposure to illicit content while categorizing media, you can now:

Automatically blur or hide content graded as an illegal category as well as mute video previews.
Set a reminder to stop categorizing media after a specified amount of time or after you’ve categorized a specified number of items.
Set a reminder to stop categorizing media at a specified time of day (such as before the end of your work day).
More details...

macOS and APFS support

Magnet AXIOM now includes additional support for macOS computers with APFS:

AXIOM Process can now scan APFS images up to 4x faster.
Magnet AXIOM now surfaces extended attributes from the spotlight database. You can view these attributes in a new Spotlight metadata card in the Artifacts and File system explorers. More details...
You can now search unencrypted images of T2 devices.
You can now search the unallocated space of an APFS image.

More highlights

Other useful features in Magnet AXIOM 3.4 include:

Support for acquiring and processing SD card backups from MediaTek devices. More details...
Support for the new format of warrant returns that Instagram and Facebook began providing in summer of 2019. More details...
Artifact support for Apple Health for iOS devices. More details...

Artifacts

Apple Health | iOS: Added support for steps, distance, and floors travelled. [iOS 11.2.1]
Baidu | Android: Added support for searching using text, audio, and mobile pictures. [11.10]
Custom artifacts: Many new custom artifacts have been published from the community over the last few months:
- Delivery Optimization Service Log – Ola Ekadahl
- Samsung My Files App (Android) – Alexis Brignoni
- Samsung Keyboard Exclusion List (Android) – Alexis Brignoni
- Android Call History – Costas Katsavounidis
- Windows 10 Timeline (v2.1) – Costas Katsavounidis
- Badoo (Android) – Alexis Brignoni
- Google Drive (Desktop) – Alexis Brignoni
- SystemPanel2 (Android) – Costas Katsavounidis
- Apache Access Log Parser – Andrew Thorpe
- See full list
Device Information | iOS: Added support for backup details, such as iCloud and iTunes sync information.
Device Properties | Android: Added support for device properties acquired by Android Quick Acquire.
Firefox | Windows: Updated support for recovering downloads. [68.0.1]
Hangouts Dialer | Android: Added support for incoming and outgoing calls. [14.0]
Instagram | Android: Updated support for recovering Instagram posts.
Powerlog | iOS: Added support for recovering app usage statistics and timezone information.
Recovery Account Information | macOS: Recover information about the user accounts that have privileges to decrypt a FileVault encrypted volume in APFS. [macOS 10.12+]
Snapchat | Android: Added support for My Eyes Only snaps and Memories. Added parsing support for chat messages, contacts, groups, and account information. Updated parsing support for received and sent snaps, and stories. [10.59]
Snapchat | iOS: Add support for chats, messages, saved, messages, and attachments for the latest version. [10.58]
UserAssist: Recovery of Focus Count and Focus Time, allowing you to determine for how long a program was in the foreground on a target’s computer. [Windows]
Videos: Added support for extracting EXIF data from videos.
Waze | iOS: Added support for places, favorites, and events. [4.51.2]
Wi-Fi Statistics | Android: Added support for Wi-Fi statistics acquired by Android Quick Acquire.
WhatsApp | Android: Updated support for messages and accounts information. [2.19]

Cloud

In addition to our current support for Facebook warrant return formats, Magnet AXIOM now includes support for the new format of warrant returns that Facebook began providing in summer of 2019.
In addition to our current support for Instagram warrant return formats, Magnet AXIOM now includes support for the new format of warrant returns that Facebook began providing in summer of 2019.
You can now play audio attachments directly in a chat thread for artifacts recovered from Facebook Warrant Returns.

Processing

AXIOM Process now provides clearer instructions for sending the AXIOMProcessCrashLog.txt file to the Magnet Forensics Technical Support team if you encounter a crash.
Expanded support for categorization of picture and video artifacts.
Performance improvements have been made to make APFS scans up to 4x faster.
You can now search the unallocated space of an APFS image.
You can now load and search unencrypted images of T2 devices that have been converted from the AFF4 format to a supported image format.
AXIOM Process now includes support for acquiring and processing SD card backups from MediaTek devices. MediaTek devices allow you to backup user data on an SD card—including for locked devices. Following a guided workflow, you can generate a backup on the device, and then process the data in AXIOM Process.
By default, the agent will now be uninstalled after quick imaging.
When acquiring Android 9+ devices, you no longer need to manually accept permissions on the device.
You can now acquire additional agent data for Android 9+ devices.

Examining

AXIOM Examine includes several enhancements to media categorization to help reduce your exposure to illicit content:
- Automatically blur or hide content graded as an illegal category.
- Automatically mute video previews.
- Set a reminder to stop categorizing media after a specified amount of time or after you’ve categorized a specified number of items.
- Set a reminder to stop categorizing media at a specified time of day (such as before the end of your work day).
For evidence from macOS computers with APFS, Magnet AXIOM now displays extended attributes from the spotlight database. You can view common attributes of interest in the Spotlight metadata card in the Artifacts explorer and a full list of available attributes in the File system explorer.
In HTML and PDF reports, the Media categorization summary section now includes a column for tracking the number of unique hashes in each category.

Bug fixes

If you attempted to view an encrypted database in the SQLite viewer, AXIOM Examine crashed. -AXE-7027
In some cases, when AXIOM Examine started after completing a scan in, the Quick Tips popup was unresponsive. -AXE-7160
In some cases, when you attempted to acquire a device using EDL mode, AXIOM Process would crash. -AXP-5297
In some cases, when you attempted to process Facebook warrant returns, AXIOM Process would crash. -CAO-2293
In some cases, when you started AXIOM Process or AXIOM Examine, the application crashed and reported a local app data error. -AE-884
In some cases, when you tried to open the Timeline explorer, AXIOM Examine crashed. -AXE-7036
Previously, if you upgraded from an older version (v1.x) to a newer version of Magnet AXIOM, AXIOM reported that it was unable to migrate your hashlist database, and you weren't able to start the application. -AXP-4878
Previously, when you loaded large hash sets in Magnet AXIOM, the spinner appeared for an extended period of time before you could select which hash sets to run on a case. -AXE-7135
When you processed an APFS image in TAR format created using Recon Imager, Magnet AXIOM did not return any results. -AXP-5047
When you tried to categorize picture or chat evidence using Magnet.AI, there are no categorization options available for you to select in AXIOM Process or AXIOM Examine, and the logs reported an SSL certificate error. -AE-893
In some cases, AXIOM Examine incorrectly reported that a search was cancelled. -AXE-7153
Pictures and stickers sent in the Line chat messages artifact could not be recovered. -MA-345
The Shellbag artifact wasn’t recovering data from Usrclass.dat. -COMP-282
User profiles in WhatsApp version 2.19 for Android could not be retrieved. -MA-654
Updated iOS Network Usage hits where results were being incorrectly deduplicated.
If you tried to set up a media categorization list for the first time in Magnet AXIOM 3.4.0, AXIOM Examine would crash. -AXE-7211 New update
In some cases, when you tried to reprocess an evidence source that included thumbnail previews, the search would fail. -AXP-5372 New update
In the Login History artifact on macOS, logout events were being reported as login events. -COMP-291 New update

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.