Release Notes

Magnet AXIOM 4.1.1.20153 June 11, 2020

Artifact updates

Android

Android SMS/MMS

Burner

Chromium

Grindr

Houseparty

Sim Card Information (Android 10)

Telegram

TextFree

Tinder

Yahoo Webmail

Zoom

iOS

Best Secret Folder

Burner

Chrome

Discord

Edge Chromium

Facebook Messenger

Grindr

Houseparty

Microsoft Edge Browser NEW

Safari

Slack

TextFree

Zoom

Cross Platform

Latent Wireless Wifi Hotspots NEW

Custom Artifacts

Python Artifacts

Windows

Apple Disk Images

Autorun

Firefox Passwords and Tokens NEW

Safari

Shellbags

Stored Credentials (Windows 10)

TeamViewer

Zoom

MacOS

Apple Disk Images

Houseparty

Safari

Artifacts

• Apple Disk Images | macOS, Windows: Added support for recovering information about Apple disk images (.dmg and .img files).
• Autorun Items | Windows: Updated support for displaying registry value information in the Artifacts view.
• Best Secret Folder Albums | iOS: Updated support to recover photo, file, and video albums. [6.19] NEW
• Burner | iOS: Updated support to recover Burner messages, contacts, numbers, and phone numbers that were used to sign up on the Burner application. [4.1.2] NEW
• Burner Contacts | Android: Added support for recovering contact information. [4.2.13]
• Burner Numbers | Android: Updated support to list number file names and their locations, and to include recovered numbers in passwords and tokens. [4.2.13] NEW
• Chromium Tab History | Android: Added support for recovering tab history from the following Chromium based browsers: Brave, Ecosia, Edge, Iron, Kiwi, Samsung and Whale.
• Chrome Tab History | iOS: Updated support for recovering tab history. [81.0.4] NEW
• Custom artifacts: Added support for latitude and longitude in the World Map view for Python custom artifacts.
• Discord Messages | iOS: Updated support to recover direct messages and text channel messages. [21.0] NEW
• Edge Chromium Logins | iOS: Updated support to recover login data. [45.3.19] NEW
• Facebook Messenger | iOS: Updated carving support for all supported Facebook Messenger artifacts. [255]
• Firefox Logins | Windows: Added support for recovering login information. [76]
• Houseparty | macOS: Added support for recovering messages and users. [1.14.8] NEW
• Houseparty Messages and Users | Android: Added support for recovering messages and user information. [1.41.1]
• Latent Wireless Geolocated WiFi Hotspots | Android, iOS, macOS, Windows: Added support for recovering Wifi hotspot data generated using Latent Wireless.
• Microsoft Edge Browser | iOS: Added support for recovering bookmarks, web history and favicons. [45.3.19]
• Private Photo Vault | iOS: Added support to recover albums and media information. [10.5]
• SMS/MMS Messages | Android: Updated parsing support for SMS and MMS messages. [Android 10]
• Safari Bookmarks | iOS, macOS: Updated parsing and carving support for local and synced bookmarks. [iOS 13, macOS 10.12]
• Safari Downloads | iOS: Updated support to recover .plist files. [iOS 13]
• Shellbags | Windows: Updated support to recover first interactions and MFT record numbers. [Windows 7] NEW
• Sim Card Information | Android: Added support for recovering SIM card information. [Android 10]
• TeamViewer Activity | Windows: Added support to recover TeamViewer activity data. [15 and earlier]
• Telegram Users | Android: Added support for recovering Telegram users. [5.13.1]
• TextFree Messages | Android and iOS: Updated support to recover attachment information with messages data. [6.12 for Android and 11.52 for iOS] NEW
• Windows Stored Credentials: Added support for recovering and decrypting account information from Windows credential files. [Windows 10] NEW
• Yahoo Webmail | Android: Updated support to recover email attachment data. [6.1.2] NEW
• Zoom | Windows: Updated support for recovering messages and user data. [4.6] NEW
• Zoom Chat Messages | iOS: Updated support to recover call details as a part of the Chat Messages artifact. [4.6.11]
• Zoom Channels | Android and iOS: Updated support to recover channel information. [4.6.11 for Android and iOS] NEW
• Zoom Contacts | Android: Added parsing support for the Contacts artifact. [4.6.11]

Cloud

• You can now acquire all trip data from a Lyft account. Previously, you were only able to acquire the last 50 rides from an account. NEW

Magnet.AI

• When you find similar pictures using Magnet.AI, you can now select the number of pictures to show in order of similarity to the reference picture.
• You can now find similar pictures from the File system explorer.

Processing

• AXIOM Process can now detect whether a PIN code is present on devices with the latest versions of iOS 13.
• AXIOM Process now uses the latest version of the Passware SDK to improve McAfee encrypted drive decryptions, as well as resolve the issue of unencrypted HFS+ drives being falsely detected as encrypted.
• During a scan, backlog items that have multiple nested files from different platforms (for example, a .zip file in a mobile backup found on a computer drive) will be searched for the platform-specific artifacts.
• When a case is created or opened, the username of the current user and the host name of the computer will be added to the case log.
• When a search completes, you can view a more detailed summary of the completed search. If a search is completed with errors or the search fails, you’ll now be provided with more detailed messaging about why scanning an evidence source might have failed, and troubleshooting steps where possible. For example, you’ll be notified if AXIOM Process encounters an error while using the Dictionary Attack method to decrypt the evidence source because the list of potential passwords did not include the correct password.
• When processing Cellebrite advanced logical images, AXIOM will prompt you to decrypt any nested backups that it detects. NEW

Examining

• Exports that included categorized media would display inaccurate counts if they included video or image fragments.
• Videos with no available thumbnail will now appear with a default picture in the Thumbnail view.
• When saving files to a .zip file, you now have the option to export to a single folder or maintain the original folder structure.
• When you create a portable case to share with stakeholders, the Portable Case Quick Start Guide will now be included in the portable case folder as a PDF.
• You can now take snapshots from the Preview of a video artifact.
• In the media categorization summary, you can now view the number of categorized items found in each evidence source. NEW

Bug fixes

• Data from Snapchat Warrant Returns wasn’t being recovered because some file names had changed. -CAO-2883
• HTML, PDF, and PST exports were failing when a case contained many emails. -AXE-7698
• In cases with large numbers of media items, tagging in the Thumbnail view was taking a long time. -AXE-7780
• Logical image formats (LX01, AD1, and L01) were not being properly displayed in the File system explorer. -AXP-6765
• Some data from Box.com accounts was not being successfully acquired. -CAO-2891
• Sometimes, Project VIC exports were failing to be created. -AXE-8045
• Sometimes, text and hex cards weren’t appearing in the Registry explorer. -AXE-8077
• Sometimes, when trying to view the Registry, AXIOM Examine would crash. -AXE-6838
• Exports that included categorized media would display inaccurate counts if they included carved video or picture fragments without thumbnails. -AXE-7743
• When you saved an Email Attachment to the Saved Files folder, the file name and extension were incorrect. -AXE-8086
• When you exported categorized pictures to an HTML export using the "Items in the current view" option, the pictures weren't appearing in the export or in the Attachments folder. -AXE-8138
• When a folder in an APFS source had no name (i.e. was named as ' ', or a space), AXIOM Process would crash and data from that folder would not be acquired. -AXP-5099
• When attempting to acquire a cloud Twitter account, the search would be completed with errors and some data would be missing. -CAO-2948
• When exporting media items to a PDF export, multiple error messages were appearing. -AXE-8066
• When you attempted to load an iCloud Backup, AXIOM Process would crash. -CAO-2669
• Biography information from Tinder 11.3 for Android was not being recovered. -MA-2016
• False positive hits were being recovered for the TextFree Contacts artifact. -MA-1810
• Full email bodies could not be recovered from Windows 10 Mail. -COMP-680
• Hits were not being recovered for Houseparty 1.42.2 and 1.43.0 for Android. -MA-1964
• Notification Center | Windows: Updated support for recovering notifications. [Windows 10] -COMP-952
• Parsed hits from the Grindr Buddies artifact were sometimes being dropped. -MA-1928
• Slack artifacts for iOS were not being recovered. -MA-1999
• Snapchat data was not being recovered if the Android user had an additional account set up on their device. -MA-1877
• Telegram data was not being recovered if the Android user had an additional account set up on their device. -MA-1943
• The Registered Date/Time fragment name of the SIM Card Activity artifact did not accurately describe its contents. The fragment has been renamed to Updated Date/Time. -MA-1916
• The directions of recovered Zoom chat messages were not being reported. -MA-1882
• .mbox files could not be processed using the Google Takeout workflow. -CAO-3000 NEW
• Picture and video previews weren't appearing in HTML and PDF exports. -AXE-8053 NEW
• When exporting media items to a PDF export, multiple error messages were appearing. -AXE-8066 NEW
• When orphaned files were found in multiple sources in a case, only the first source was listed for all subsequent orphaned files. -AXP-6848 NEW
• When scanning a computer drive, an error message would appear after the scan was complete and indexing would be interrupted. -AXP-6631 NEW
• Account information from Tinder 11.10.0 for Android was not being recovered. -MA-2025 NEW
• Full email bodies could not be recovered from Windows 10 Mail. -COMP-680 NEW
• Hits were not being recovered for Houseparty 1.43.5 and later for iOS. -MA-2024 NEW
• In Safari Preferences, the default values for Download Location, Removed Download Items Frequency, and Clear History Frequency were not being reported correctly. -COMP-996 NEW

Known issues

• To search for information about known issues, visit the knowledge base at support.magnetforensics.com.