Artifact updates

Android

Group Me NEW

Snapchat

TextFree

TextNow

Tumblr NEW

Windows

Defender Logs

Dropbox

Firefox

McAfee Logs

Rebuilt Desktops

Recycle Bin

iOS

AirDrop NEW

Call Logs

Dropbox

Facebook Messenger

GroupMe NEW

Installed Applications

KnowledgeC

Screen Time

Signal

Significant Locations

Skype

TextFree

Tinder

WickrMe

Yahoo Webmail

macOS

AirDrop NEW

Cross-platform

Chrome Extensions

Pictures

Magnet AXIOM Cyber is here!

We’re proud to announce that Magnet AXIOM Cyber is now available! AXIOM Cyber is an innovative new solution, purpose-built for organizations that need to perform remote acquisitions as well as collect and analyze evidence from cloud sources, computers, and mobile devices.

AXIOM Cyber enables you to remotely collect evidence from target endpoints on an as-needed basis—without the need for additional infrastructure. Using AXIOM Cyber, you can:

Covertly deploy a remote agent to a remote computer to acquire drives, memory, and logical files from the file system—even if the drive is encrypted.
Automatically resume collection of data from the point where the agent left off if connectivity is lost.
Provide known decryption credentials for supported encryption types.
Automatically detect memory profiles and load RAM capture dumps in Volatility.

AXIOM Cyber also helps you quickly understand what happened by acquiring and analyzing data across all evidence sources—including cloud, computer and mobile phones. These evidence sources include brand new Cloud-related features, such as:

Using admin credentials to access Office 365, G Suite, and Box.com.
Acquisition from Enterprise cloud services AWS S3 buckets and EC2 instances, Microsoft Teams, and Slack (including Slack's JSON exports).

To request a free trial of Magnet AXIOM Cyber today, visit magnetaxiomcyber.com/

Rebuilt Desktops artifact

Rebuilt Desktops is an artifact that allows you to view an approximation of what a user’s most recent desktop looked like. Magnet AXIOM recovers configuration data – such as wallpaper, monitor configuration, and icon positioning – from targeted registry keys in the registry, as well as the user’s files and folders. By recovering, processing, and visualizing this data, Magnet AXIOM can replicate the appearance of a user’s desktop on their live Windows machine without having to virtualize it.

For more information about the Rebuilt Desktops artifact, log in to the Customer Portal to review Artifact profile: Rebuilt Desktops.

Syncing tags between Artifacts and File system explorers

For cases processed in Magnet AXIOM 3.9 and higher, tags that you apply to evidence now automatically sync between the Artifacts and File systems explorers.

When you tag an artifact in the Artifacts explorer, AXIOM Examine automatically applies the same tag to both the artifact and a corresponding file in the File system explorer if there is a single source for the hit.
When you tag an artifact in the File system explorer, AXIOM Examine automatically applies the same tag to both the file and a corresponding artifact if there is a one-to-one relationship between the file in the File system explorer and a parsed artifact hit. If there are multiple artifact hits for the file, AXIOM Examine automatically creates a new artifact from the file and applies the same tag to both—you can quickly view these artifacts in the Tagged from file system artifact category in the Artifacts explorer.
For complete details about tag syncing, please review the Tagging evidence topic in the Magnet AXIOM User Guide.

More highlights

Other useful features in Magnet AXIOM 3.9.0 include:

AXIOM Process will now automatically attempt to recover a clear key from the MBR and decrypt the drive when BitLocker Device Encryption is detected.
AXIOM Process now supports acquiring devices jailbroken with checkra1n without requiring additional software to be installed on the device.
File and folder data loading has been improved, allowing you to select which files you want to process much more quickly.
More details...

Artifacts

AirDrop | macOS: Added support for recovering available recipients, including contacts and nearby users.
Chrome | All platforms: Updated support to recover information about Chrome Extensions from additional locations.
Facebook Messenger | iOS: Groups now list sender names instead of IDs.
Firefox | Windows: Updated support for recovering favIcons.
GroupMe | Android: Added support for groups, accounts and contacts. [5.40.3]
GroupMe | iOS: Added support for accounts, groups, messages, and contacts. [5.35.1]
Installed Applications | iOS: Added support for displaying version number and the install date. [iOS 10]
KnowledgeC | iOS: Added support for reporting when a device is locked or unlocked.
McAfee | Windows: Added support to pull A/V logs from McAfee anti-virus providers.
Notes | iOS: Added support for parsing embedded attachments from notes. [iOS 13]
Pictures | All platforms: Picture artifacts that had incorrect or missing extensions can now be parsed (previously, these pictures were always carved). This allows the artifact to retain date/timestamps, file paths, and previews in the Artifacts explorer.
Prefetch Files | Windows: Added support for recovering application paths. [Windows 10-XP]
Prefetch Files | Windows: Prefetch artifacts that are parsed are now displayed as such (previously, all were labeled as being carved).
Rebuilt Desktops | Windows: You can now see an approximation of what a user’s desktop looks like, including icons, wallpapers, and monitor and display information. [Windows 10 build 14393 and later]
Recycle Bin | Windows: Added parsing support for items recovered from $RECYCLE.BIN.
ScreenTime | iOS: Added support for recovering visited domains.
Signal | iOS: Updated support to recover the sender ID. [2.43.3.1]
Skype | iOS: Updated support for recovering contacts and group chats in the latest versions. [8.53.102]
TextFree | Android: Updated support to retrieve group and attachment information. [8.53.1+]
TextNow | Android: Updated support to recover attachments in chat and call, including pictures, videos and voicemail. [6.49.0.1]
Tinder | iOS: Updated support to retrieve information on all matches and viewed users. [11.1.1]
Tumblr | Android: Added parsing support for blogs and tags. [10.0]
Tumblr | Android: Added parsing support for chat messages. [14.8]
Unified Logs | iOS: Added support for recovering the unified logs on iOS.
Updated artifact keychain regex to process any keychain ending in “.plist” and with “keychain” in the name, regardless of case. Also added custom hit validation for both general and internet passwords.
VK | Android: Updated parsing support for recovering messages and user information. [5.47]
VK | iOS: Updated parsing support for recovering messages and user information. [5.47]
WickrMe | iOS: Added support for passcode-based decryption.
Windows Defender | Windows: Added support for recovering logs that contain lists of files that triggered (or didn’t trigger) antivirus filters.
Yahoo | iOS: Updated support for webmail messages. [6.0.8+]

Cloud

Information has been added to the sign-in screen to clarify that you must provide a decryption key in order to acquire a WhatsApp account.
When a Google Warrant Return package can’t be validated, you can now continue processing the warrant return, but you’ll receive a warning message that AXIOM Process might not be able to recover all artifacts.

Processing

AXIOM Process now recovers the long file name for deleted files on FAT file systems.
File and folder data loading has been improved, allowing you to select which files you want to process much more quickly.
For searches of NTFS file systems, AXIOM Process will now automatically deduplicate results from unallocated space if they are covered by a range of space that's occupied by a known deleted file. Only the deleted file hit with an existing $MFT record will be shown in AXIOM Examine. If no $MFT record exists, the hit will be carved from unallocated space.
Performance improvements for NTFS file system searches.
When AXIOM Process detects BitLocker Device Encryption on a Windows 10 device (such as Microsoft Surface Pro), it will automatically attempt to recover a clear key from the Master Boot Record (MBR) and decrypt the drive.
You can now acquire devices jailbroken with checkra1n without requiring additional software to be installed on the device.

Examining

For cases processed in Magnet AXIOM 3.9 and higher, tags that you apply to evidence automatically sync between the Artifacts and File systems explorers. For more information about tag syncing, please review the Tagging evidence topic in the Magnet AXIOM User Guide.

Bug fixes

AXIOM Process would crash when attempting to process some UNC mapped network paths and files with long names. -AXP-5400
When you set the language in AXIOM Process to any language other than English, AXIOM Process could crash when a scan took longer than 24 hours to complete. -AXP-6007
If one case was closed and another case was opened by clicking Open recent, the Text and hex from the previous case would be displayed. -AXE-7702
In conversation view, some chat messages from Instagram Warrant Returns were being displayed as individual messages rather than threaded conversations. -CAO-2641
Some .zip files, including Google Takeout and Warrant Return files, were missing Created and Modified date stamps after being processed. -AXP-5954
Some Google Warrant Returns were not being successfully processed. -CAO-2668
Some portable cases with a large number of artifacts were failing to export and an out of memory exception error is reported. -AXE-7678
Sometimes, iCloud Drive data was not being fully acquired, and AXIOM Process would display an error message. -CAO-2111
When Timeline evidence was filtered based on certain criteria, and then filtered a second time with additional criteria, the Matching results number would not update to reflect the additional criteria. -AXE-7669
When system tags were applied to evidence, and a filter for these tags was applied in the Timeline explorer, the tagged evidence would not appear. -AXE-7680
When you set the language in AXIOM Examine to any language other than English, the “Filter by” option in the Thumbnail view would result in zero search results. -AXE-7766
In the KnowledgeC Application Activities artifact for iOS, some activity descriptions, types, and URLs were not being displayed. -MA-1345
In the KnowledgeC Application Intents artifact for iOS, bundle IDs were not being displayed. -MA-1346
Signal encryption keys recovered from the Passwords and Tokens artifact contained a trailing space that prevented decryption when the key was copied.
In unallocated space, the end of some pictures weren’t being detected due to the picture metadata. -COMP-694
The DHCP Server fragment in the Operating System Information artifact was labelled incorrectly. The fragment has been renamed to DHCP DNS Server(s) to more accurately describe its contents. -COMP-617
The User Account artifact for Windows indicated that accounts are password protected even when they’re not. -COMP-176
Using GroupMe Accounts for Android, the login timestamp changed if the user switched over to another account. -MA-1421
When parsing group Facetime data from the call log database, the user’s location of recovery was not displayed. [iOS 13] -MA-1295
When searching a zipped filesystem on macOS 10.13 and 10.14, deleted account and identifier hits were lost. -COMP-637
When using AirDrop for macOS, hits were lost when attempting large outgoing transfers. -COMP-627
With macOS version 10.11, login history entries from the previous year were displaying the current year. -COMP-682

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.