Artifact updates

Android

Gmail

LinkedIn NEW

MEGA NEW

Snapchat

TextNow

Waze NEW

WeChat

iOS

Bluetooth Devices

EverNote NEW

Facebook Messenger

iMessage

KakaoTalk NEW

LinkedIn NEW

MEGA NEW

Owner Information NEW

PowerLog NEW

Safari

Snapchat

TextNow

Twitter

Windows

Firefox

Jump Lists

Locally Accessed Files NEW

macOS

DSStore NEW

Operating System Information

Safari

Cross-platform

File Signatures NEW

Magnet AXIOM Cyber beta program

We’re getting ready to release a digital forensics solution tailored to meet the needs of organizations that perform remote acquisitions and collect and analyze evidence from cloud storage services.

To prepare for the official launch of Magnet AXIOM Cyber we’re inviting you to participate in a free beta program. As a participant in the beta program, you will get early access to the most modern solution for your cybersecurity investigations including:

Point-to-point remote acquisition: Remotely acquire evidence from target endpoints, even if they are not connected to your corporate network.
Acquisition from more cloud services: Acquire evidence from cloud storage services like Amazon Web Services S3 buckets and Microsoft Teams, and load standard or corporate exports from your Slack workspaces.

For more information or to sign up for the Magnet AXIOM Cyber beta program, visit magnetforensics.com/axiom-cyber-beta

macOS and iOS support

Magnet AXIOM now includes even more support for macOS and iOS devices:

Processing support for iOS 13 and macOS 10.15 devices.
Support for recovering device backups from iCloud accounts with two-factor authentication enabled for devices running up to iOS 12. More details...
Enhancements to support for encrypted iOS backups. More details...
Support for viewing additional extended attributes from evidence from macOS computers with APFS in the APFS metadata card. More details...

Instagram public activity

Collect public-facing Instagram posts using a user name or a hashtag—without requiring login information for specific users.

Collect post information and associated media as artifacts and investigate the evidence in AXIOM Examine.
When acquiring public Instagram activity, narrow the date range to decrease the amount of time the acquisition takes and to find the most important evidence.
More details...

File Signature Mismatch artifact

File Signature Mismatch artifacts highlight files whose extension and file signature do not match. File Signature Mismatch artifacts contains identified mismatches between a known file signature header and the extension (or lack thereof) for an audio file, container, document, picture, or video. A mismatch might occur when a user changes or removes the extension for a file as a way to avoid detection.

Artifacts

.DS_STORE | macOS: Recover information about the display properties of folders.
Bluetooth Devices | iOS: Now includes information about Bluetooth low-energy devices.
Enhancements have been made to acquiring unlocked Android devices to allow you to retrieve more data from Xiaomi and Huawei devices.
Evernote | iOS: Recover accounts, contacts, notes, and work chat.
Facebook Messenger | iOS: Updated support to recover missing data in the Users, Groups, and Messages artifacts. [224.0]
KakaoTalk Messages | iOS: Messages and user’s phone numbers can be decrypted in the latest versions. [8.3.2, 8.5.0]
LinkedIn | Android: Added support for recovering profiles, connections, and messages.
Locally Accessed Files | Windows: Recover information about local files that were accessed by the File Explorer.
Mega | Android: Added support for recovering accounts, chats, and contacts. [3.6.0]
Mega | iOS: Added support for recovering accounts, chats, and contacts. [3.6.0.227]
Owner Information | iOS: Now includes the setup date and type of setup for the device. [iOS 12]
PowerLog Battery Level | iOS: Recover battery level information.
PowerLog Camera State | iOS: Recover information about the camera state.
PowerLog Screen Autolock | iOS: Recover information about when the device’s screen autolocks.
PowerLog Screen Autolock | iOS: Recover information about when the device’s screen autolocks.
Refined Results: Updates to URL lists for Classified Ads, Cloud Services, Dating Sites, Social Media Sites, Tax Sites, Shipping Sites, and Web Chat.
Safari Recently Closed Tabs | macOS: Recover visited websites from closed tabs.
Snapchat Friends | iOS: Added parsing support for Snapchat Friends.
Snapchat Messages | Android: Recovered messages now come with metadata about any media that they include.
Snapchat Stories | iOS: Added parsing support for stories.
Telegram Channel Chats | iOS: Some of the fragments in this artifact have been renamed to more accurately describe their contents. Started By (Peer User Name) has been updated to Last Sender. Started By (Peer ID)has been updated to Last Sender ID. Start Date/Time has been updated to Last Message Date/Time. First Message has been updated to Last Message.
Telegram Chats | iOS: Updated to support missing fragments. [5.1.1 - 5.9.1]
Telegram Messages | iOS: Added thumbnail previews for video attachments.
Telegram Messages | iOS: Recover audio file attachments.
Telegram Users | iOS: Updated to support missing fragments. [5.1.1 - 5.9.1]
TextNow | iOS: Updated support to properly parse evidence again.
Twitter Direct Messages | iOS: Updated support to recover messages from the new location. [7.56]
Waze | Android: Recover information about saved events, favorite locations, and places. [4.5.4]
WeChat | Android: Updated support to decrypt friends and messages in the latest updates. [7.0.6]
WhatsApp Messages | Android, iOS: Updated to indicate whether a message was forwarded.
When acquiring an iOS 13 device, you are now prompted to provide a PIN code on the device after you’ve provided the backup password.
iMessage | iOS: Improvements to carving offsets to remove unwanted characters from message bodies.

Cloud

You can now acquire public Instagram posts using user name or hashtag, without requiring login information for specific users. AXIOM will collect the post information, and associated media as artifacts within AXIOM.

Magnet.AI

Improvements were made to the human faces, hate symbols, and license plates picture categorization options in Magnet.AI to reduce false positive results.

Processing

Enhancements have been made to support for encrypted iOS backups. You can now view the unhashed and decrypted friendly files and paths—as they appear in the iOS backup manifest—in the File system explorer. You can now also view the files as they were stored on the device rather than how they display in the backup.
For evidence from macOS computers with APFS, you can view additional extended attributes in the APFS metadata card. For attributes that have binary information, you can view the attribute text and hex data in the Text and hex viewer.
The Case Information.txt file now includes the evidence number.

Examining

AXIOM Examine now includes support for parsing and displaying the categorization scheme used for media categories in VICS 2.0 JSON files. If you have not already set a media categorization profile and you import a VICS 2.0 media categorization list, AXIOM Examine will display the categories included in the JSON file.
In some cases, you were unable to open evidence from the File system and Artifacts explorers using an external application.
When opening a database from the File system view, AXIOM Examine now shows the last three database viewers you’ve used.
When using Column view in the Artifacts and File systems explorers, you can now filter numeric and string columns using advanced search term methods and regex pattern matching. You can also view and edit advanced search criteria you applied using column filters.
When you search the evidence using an advanced keyword search, you can now specify if you want to search for the term if it appears near another word or set of characters.
You can now play OPUS audio files in the media player.
You can now view and edit advanced search criteria you applied using advanced keyword search.

Bug fixes

AXIOM Examine no longer includes artifacts from Refined results when counting the total number of categorized media files in VICS JSON exports. -AXE-7397
If your case included multiple evidence sources with the same name, and you tried to view the evidence in the File system explorer, AXIOM Examine would freeze. -AXE-7314
In some cases, when you acquired a Google account, a dialog appeared indicating that the Magnet Forensics application was not verified by Google. -CAO-1973
In some cases, when you created a PDF report from Chat thread view, AXIOM Examine would report an out of memory error. -AXE-3964
In some cases, when you tried to create a portable case, AXIOM Examine reported an out of memory error. -AXE-7041
In some situations, when you viewed a OneDrive folder in the File system explorer, you were unable to see all symlinked folders. -AXP-5461
Performance improvements have been made to scanning EXT file systems. -AXP-2077
Previously Chinese, Japanese, and Korean characters did not display properly in the Connections explorer. -AXE-5843
Previously, when you added a large number of keywords to a search, AXIOM Process was slow to start analyzing the evidence. -AXP-5478
Previously, when you tried to relocate a source in a directory, AXIOM Examine indicated the source could not be located. -AXE-5934
Previously, you were unable to acquire Google Activity. -CAO-2350
Previously, you were unable to acquire Google Passwords. -CAO-2386
Previously, you were unable to acquire Google Recent Devices. -CAO-2378
You can now recover device backups from iCloud accounts with two-factor authentication enabled for devices running up to iOS 12. - CAO-1636
When saving an artifact, AXIOM Examine no longer shortens longer file names. -AXE-3293
When viewing a conversation thread in Conversation view, incorrect text was shown for the evidence number in the Details card. -AXE-7405
When you tried to acquire a Dropbox account, the authentication dialog incorrectly reported that there were too many login attempts. -CAO-2122
When you tried to acquire a Microsoft account using AXIOM Cloud, you were prompted to provide permission to the Magnet Forensics app even when an administrator had already provided approval. -CAO-2408
When you tried to acquire audit logs for all users in a large Office 365 environment, AXIOM Process appeared to stop responding and Microsoft reported internal server errors. -CAO-1682
In some cases, when you tried to acquire a full image of an MTK device, the acquisition workflow would hang while waiting for the device to be detected. -MMI-1135
In some cases, you were unable to image a jailbroken iOS 12.4 device. -MMI-1137
Previously, the link to download device drivers for LG devices was broken. -MMI-1129
Carved data from TextNow on Android was displaying unwanted characters and no values were being displayed for dates/times. -MA-853
Cypher.exe was erroneously being flagged as an encryption / anti-forensics tool when it was detected on a computer. -COMP-409
Gmail user accounts aren’t always being recovered on iOS and Android. -MA-796
In some cases, when you tried to acquire a full image of an MTK device, the acquisition workflow would hang while waiting for the device to be detected. -MMI-1135
In some cases, you were unable to image a jailbroken iOS 12.4 device. -MMI-1137
Previously, the link to download device drivers for LG devices was broken. -MMI-1129
USB history wasn’t being recovered on macOS 10.14. -COMP-265

Known issues

Here’s some information about known issues that were recently discovered:

If you remove and re-add an AXIOM Cloud license (for example, removing and reconnecting a dongle or disconnecting and reconnecting to the license server), the Cloud evidence source option appears greyed out in AXIOM Process. Workaround: Although the Cloud evidence source appears greyed out, the option still functions normally. Click the Cloud evidence source to proceed with the acquisition.

To search for information about more known issues, visit the knowledge base at support.magnetforensics.com.