Artifact updates

iOS

Cell Tower Locations NEW

Instagram

Messages

Owner Information

Parked Car Locations NEW

Pinterest NEW

Snapchat

Tumblr NEW

Twitter

WiFi Locations NEW

iOS Backups NEW

Android

Android Backups NEW

LG MPT NEW

Snapchat

Yahoo Webmail

Windows

Cryptocurrency NEW

Google Maps

Passwords and Tokens

macOS

AirDrop NEW

Mobile investigations

We've introduced several enhancements for both Android and iOS mobile investigations:

Support for recovering the metadata from deleted files in EXT file systems on Android mobile devices. For more information about what metadata you can recover from EXT file systems, log in to the Customer Portal to review Understanding support for recovering metadata from ext file systems.
Support for acquiring full images of Pixel 2 and Pixel 2 XL mobile devices. More details...
More support for Huawei mobile devices to include acquiring Huawei devices that do not have SD cards or support ADB backups as well as acquiring backups of Huawei mobile devices created using Huawei Backup version 10. More details...
Support for acquiring iOS devices jailbroken with checkra1n. More details...
Support for recovering more useful location data from full iOS extractions including seen WiFi devices, cell towers, and parked car locations. More details...

Case dashboard summary reports

You can now generate summary reports for the Media categorization and Keyword matches cards in the Case dashboard.

Generate a PDF summary reports directly from the Media categorization and Keyword matches cards in the Case dashboard explorer.
Generate either a PDF or HTML summary report from the Create report / export dialog. In the Items to include step, select the new "Case dashboard cards only."
More details...

More highlights

Other useful features in Magnet AXIOM 3.8.0 include:

Support for processing NTFS images that contain 4K sectors.
When a scan completes, you can now view a summary of any files that were not fully processed due to artifact timeouts. For more information about timeouts, log in to the Customer Portal to review Understanding artifact timeout exceptions.
Improvements have been made to increase the reliability of scans of FAT file systems.
More details...

What's new in the AXIOM Cyber beta program

We've been busy making updates to AXIOM Cyber since our last release. Here are the new features we've introduced and the issues we've resolved:

New features

You can now complete a full-system memory acquisition of a remote computer.
If a Windows Firewall prevents you from connecting to the agent on the remote computer, you will now receive a notification as well as a link to a Knowledge Base article with tips for troubleshooting the connection.

Updated the naming conventions for items you’ve downloaded from the remote computer and added to your evidence sources to include descriptive information such as the computer name and the local date/time the .zip or .bin files were generated.
If AXIOM Process is unable to launch the agent after deploying to the remote computer, the agent is now automatically removed from the remote computer.
When manually launching an agent on a target device, you are now always prompted to run the agent as an administrator.
Increased the number of characters allowed for agent masking details.
You can now acquire Amazon Web Services (AWS) EC2 instances.
When loading a Slack workspace data export, you can now optionally download attachments referenced in the JSON file. View these attachments in the Slack Message Attachment artifact.

Are you part of the Magnet AXIOM Cyber beta program? For current documentation, articles, and information about known issues, visit support.magnetforensics.com/s/axiom-cyber-beta

Artifacts

Additional sources: A new artifact category has been added called Additional sources. This category collects artifacts that may require additional processing, such as mobile backups and virtual machines.
AirDrop Activity | macOS: Added support for recovering Airdrop activity, including incoming and outgoing transfers, discoverability, and background activity.
Android Backups: Added a new artifact that contains information about an Android backup.
Cell Tower Locations | iOS: Added support for identifying the locations of cell towers that a device pings.
Cryptocurrency: Recover information about cryptocurrency clients and wallets recovered on the system.
Google Maps | Windows: Recover Google Maps data from the web cache for IE 11.
Instagram Profiles | iOS: Added support for recovering profile information. [111 and later]
LG MPT | Android: Added support for recovering data from the MPT log on LG devices, including app details and history, cell towers, Wifi events, and recent activity.
Messages | iOS: Recovered messages now indicate if they are Sent by Siri.
Owner Information | iOS: Updated support to properly recover the Apple ID fragment in some versions. [iOS 13.1]
Parked Car Locations | iOS: Recover parked car locations stored on the device (requires that the feature be enabled in the iOS Location Services).
Pinterest | Android: Recover information about messages, following / followers, boards and pins.
Pinterest | iOS: Recover information about messages, following / followers, boards and pins.
SnapChat | iOS: Decrypt Memories recovered from images acquired using GrayKey. My Eyes Only snaps can also be recovered and decrypted if the snaps have been viewed locally and are available in the application's media cache.
Snapchat | Android: Updated support to recover attachments from messages and memories on some versions. [10.68, 10.69]
Snapchat | iOS: Added support for recovering and decrypting MEO pictures and the opening frames of videos.
The Passwords and Tokens artifact now identifies recovered hashes for Windows users accounts (NTLM, LM) and password hashes for macOS user accounts.
Tumblr Chat Messages | iOS: Added support for parsing sent and received messages, posts, tags, followed blogs, and blocked blogs.
Twitter Friends | iOS: Updated support for recovering friends on latest versions. [7.56]
WiFi Locations | iOS: Recover the locations of WiFi connections that the device has detected.
Yahoo Webmail | Android: Updated support to recover account information on some versions. [6.1.2]
iMessages/SMS/MMS | iOS: Attachments recovered from messages now properly link to the source message.
iOS Backups: Added a new artifact that contains information about an iOS backup.

Cloud

When acquiring a Slack account, you can now select Public Channels, Private Channels, Direct Messages, and Direct Group Messages as individual data sources.
When acquiring a Slack account, you can now specify if you want to download attachments for each data source.

Processing

AXIOM Process now includes support for scanning NTFS images that contain 4K sectors.
For Android mobile devices, AXIOM now includes support for recovering the metadata from deleted files in EXT file systems including basic file timestamps, the inode number (unique identifier), and the status of the deletion (overwritten or deleted).
When a search completes, you can now view a summary of any files that were not fully processed due to artifact timeouts. Additionally, files that are not processed due to artifact timeouts are now tagged in AXIOM Examine as Exceptions.
When creating a new case, the Case type field is now optional. Additionally, you can now set a default Case type.
Added support for acquiring Huawei mobile devices that do not have SD cards or support ADB backups.
Added support for acquiring backups of Huawei mobile devices created using Huawei Backup version 10.
Added support for acquiring full images of Pixel 2 and Pixel 2 XL mobile devices.
Added support for acquiring iOS devices jailbroken with checkra1n.

Examining

Magnet AXIOM is now available in Thai.
You can now generate a keyword match summary report in PDF and HTML formats without having to generate a full report. You can also generate the media categorization summary report from the Keyword matches card in the Case dashboard.
You can now generate a media categorization summary report in PDF and HTML formats without having to generate a full report. You can also generate the media categorization summary report from the Media categorization card in the Case dashboard.

Bug fixes

If you processed multiple Facebook warrant returns in the same case, conversation threads that appeared in both warrant returns appeared as duplicate messages in AXIOM Examine. -CAO-2560
If you tried to export evidence using the Magnet REVIEW export type, and there was an invalid character in the source path, the export would fail. -AXE-7507
Improvements have been made to increase the reliability of scans of FAT file systems. -AXP-5805
In VICS 1.3 and 2.0 JSON exports, the FilePath attribute included only the file name rather than the full file path for parsed media. -AXE-7546
Tweets longer than 140 characters were truncated in the Details card in AXIOM Examine. -CAO-2558
When processing an AD1 image that contained a .zip file, AXIOM would report an error while processing the .zip file, and the search would not complete fully. -AXP-4889
When you acquired a target’s Facebook Messenger messages and viewed the messages in Conversation view, AXIOM reported that attachments were not recovered for media files. -CAO-1454
In the Locally Accessed Files artifact, some internal resources did not keep their URLs intact, and prefixes such as :host: were being stripped out. -COMP-580
No results could be recovered for Outlook 2016 if the PST file was open in Outlook at the time of acquisition. -COMP-527
Picture overlays were not be applied to Snapchat memories. -MA-1241
Pictures recovered by the iOS Snapshots artifact weren't also showing up under the Pictures artifact. -MA-1187

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.