Artifact updates

Android

Account Autofill NEW

Activity Manager History NEW

Application Power Usage NEW

Camera History NEW

Device Information

Evernote NEW

Installed Apps

Last Known Locations NEW

Snapchat

iOS

Device Information

Powerlog Process Data Usage NEW

Snapchat

Telegram NEW

Windows

Cross-platform

Pictures

Apple warrant returns

Apple warrant returns can contain useful information about a user's synced media and iCloud drive contents.

Import and process the Apple warrant returns as part of your case.
Automatically decrypt iOS device backups that are included with the return.
Recover additional content such as iCloud drive conents that were included with the warrant return.
Note: The return package must be decrypted using the instructions provided by Apple prior to processing with AXIOM.
More details...

Magnet.AI

We've introduced three new picture categorization options with Magnet.AI to help you identify more pictures that might be relevant to your investigation. Magnet.AI picture categorization can now detect possible pictures in the following categories:

Human faces
Hate symbols known to be used by white supremacist groups
License plates on vehicles such as cars, trucks, and vans
More details...

Advanced keyword search enhancements

In this release, AXIOM Examine includes several enhancements to advanced keyword searching from the Artifacts explorer:

Search for multiple words or search terms and choose whether you want to see results for all (and "AND" search) or any (and "OR" search) of the search terms.
Specify if you want to search for items that include or exclude the search term.
Optionally limit the search to whole words only or search for instances of the word with the same letter case.
More details...

Artifacts

Activity Manager History | Android: Added support for recovering information about application usage. Also added support to show a running log of package times and the actions on a phone.
Bluetooth Devices | Android: Updated support to recover information about previously connected Bluetooth devices, as recovered during Quick imaging.
Camera History | Android: Added support to recover camera access times and a list of last known locations of a device.
Device Information | Android: Updated support to display a device’s Bluetooth ID.
Device Information | Android: Updated support to recover timezone information.
Device Information | iOS: Updated support to recover iOS device model information, IMEIs, software version, and timezone information.
Evernote | Android: Added carving support for notes, attachments, work chat, account details, and timestamps. [8.11]
Evernote | Android: Added parsing support for account details, contacts, notes, attachments, timestamps, and work chat. [8.11]
Installed Applications | Android: Updated support to recover information about installed apps when performing a Quick image.
Last Known Location | Android: Adds a list of the last known locations of the Android device, as tracked by the GPS receiver.
Pictures: Added support for recovering serial numbers from EXIF data.
PowerLog Process Data Usage| iOS: Added support for recovering start and end dates and times, bundle IDs, process names, mobile bytes sent and received, and wifi bytes sent and received.
PowerLog | Android: Updated support to recover information on application power usage.
Recovery Account Information | macOS: Recover information about the user accounts that have privileges to decrypt a FileVault encrypted volume in APFS. [macOS 10.12+]
Snapchat | Android: Added support for recovering recipient lists from chat messages. [10.59.0+]
Snapchat | iOS: Updated support for Conversations and added support for Group Chats. [10.59.0]
Telegram | iOS: Updated to recover missing fragments, including message sent, date/time, images, message status, read status, flags, and attachment name(s). [5.1.1-5.9.1]
Usage History | Android: Added support for recovering autofill information.
WeChat | Android: Added support for recovering WeChat data from backups created using Xiaomi devices. New update
WhatsApp | Windows: Added support to recover chat type information, sender and recipient IDs, and messages.

Cloud

You can now load a .zip file provided by Apple for warrant returns as a Cloud evidence source. In addition to processing synced media and iCloud drive contents, Magnet AXIOM can fully decrypt iOS device backups that are included in the warrant return package. Note: Warrant returns provided by Apple are encrypted, and Apple provides instructions to decrypt the package. After you've decrypted the package, Magnet AXIOM can decrypt encrypted backups contained within the decrypted warrant return.

Magnet.AI

Magnet.AI can now search picture evidence for possible faces of humans, hate symbols, and license plates on vehicles such cars, trucks, and vans.

Processing

AXIOM Process now includes support for processing physical images (.mdf files) of Android devices created with Hancom GMD mobile forensics tool.

Examining

In some cases, when AXIOM Examine started after completing a scan in, the Quick Tips popup was unresponsive.
To help you manage disk space requirements, you can now specify the location on your computer where you want to store the Magnet AXIOM hash database.
When viewing a video in AXIOM Examine, you can now use the mouse wheel to change the playback speed.
When you search the evidence using an advanced keyword search, you can now search using multiple words or search terms and choose whether you want to see results for all (and "AND" search) or any (and "OR" search) of the search terms. For each keyword that you specify, you can choose to show only the items that include or exclude that word. You can further specify if you want to search for the whole word only as well as match the case.
You can now export evidence using the Excel export type up to 50% faster.
You can now navigate in the File system and Registry explorers using breadcrumb navigation.

Bug fixes

If you tried to set up a media categorization list for the first time in Magnet AXIOM 3.4.0, AXIOM Examine would crash. -AXE-7211
In some situations, if you expanded a preview of a picture artifact, AXIOM Examine crashed. -AXE-7288
In some cases, after starting a search, AXIOM Process would crash and report that it could not find the log.txt file. -AXP-5368
In some cases, when you tried to reprocess an evidence source that included thumbnail previews, the search would fail. -AXP-5372
In some cases, while processing an image, AXIOM Process would crash and reported an Passware plugin exception. -AXP-1824
In some cases, while processing an image, AXIOM Process would crash and incorrectly report that the search was cancelled. -AXP-5409
Previously, if you disconnected from your network licensing server, AXIOM Examine crashed. -AXE-7169
Previously, when you tried to do a files or folder search of an image and selected multiple files in the same directory, the search would fail. -AXP-5341
When you exported evidence from the File system explorer using the CSV export type, AXIOM Examine incorrectly reported that the export was ready before it finished compiling. -AXE-6098
When you tried to decrypt an APFS image with a known password, AXIOM Process reported that the password was incorrect. -AXP-5118
In some cases, when you attempted to acquire an iOS device, AXIOM Process would crash and reported an object reference exception. -MMI-1117
In the Login History artifact on macOS, logout events were being reported as login events. -COMP-291
Snapchat for Android wasn’t recovering video thumbnails. -MA-751
Timeouts were occurring while recovering Windows 7 Prefetch Files. -COMP-167
Timeouts were occurring while recovering Windows 8 Prefetch Files. -COMP-236
In the Windows Event Logs artifact, event log ID 10016 was reporting additional erroneous text. -COMP-402 New update
If your case included multiple evidence sources with the same name, and you tried to view the evidence in the File system explorer, AXIOM Examine would freeze. -AXE-7314 New update

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.