Release Notes

Magnet AXIOM 4.5.0.21589 September 18, 2020

Artifact updates

Android

Google Calendar NEW

Google Duo

KakaoTalk

Mi Browser NEW

Mint Browser NEW

Wickr Me

Windows

FeatureUsage NEW

Signal NEW

Wickr NEW

iOS

Apple Maps

Google Meet NEW

Google Calendar NEW

Safari

Secret Photo Vault

Snapchat

TextMe

TikTok

Twitter

Yahoo Mail

macOS

Application Permissions NEW

Cross-platform

Magnet Web Page Saver

Improved keyword search capabilities

Artifacts

• Apple Maps Favorites | iOS: Added support for recovering favorite locations. [iOS 11]
• Apple Maps | iOS: Updated artifacts to support iOS 11.
• Application Permissions | macOS: Added support for recovering information about application permissions. [macOS 10.15]
• FeatureUsage | Windows: Added support for recovering app usage information from the FeatureUsage registry keys. [Windows 10]
• Google Calendar Events | iOS: Added support for recovering calendar events. [20.29]
• Google Calendar | Android: Added support for recovering calendars and calendar events.
• Google Calendar | iOS: Added support for recovering a user's calendars. [20.29]
• Google Duo Messages | Android: Now includes support for chat threading.
• Google Duo Messages | Android: Updated to include support for reactions to messages.
• Google Duo Messages | iOS: Now includes support for chat threading.
• KakaoTalk Messages | Android: Updated to include support for recovering attachments. [8.9.6]
• Mi and Mint browsers | Android: Added support for recovering browser history data. [Mi 12.1.14, Mint 3.4]
• Private Photo Vault | iOS: Updated to include support for the Pro version of the app.
• SQLite carving: Improved performance while carving SQLite data.
• Safari History | iOS: Updates support to include the last visited date for web pages. [iOS 13]
• Safari Website Preferences | macOS: Added support for recovering a user's preferences for website permissions. [Safari 14]
• Secret Photo Vault | iOS: Added support for recovering photos taken for break-in attempts. [2.4]
• Signal Messages | Windows: Added support for recovering messages. [1.25.3]
• Snapchat Stories | iOS: Updated to support the latest version. [10.85]
• TextMe | iOS: Updated support for the latest version. [3.23.6]
• TikTok | iOS: Updated support for the latest version. [17.3]
• Twitter Users | iOS: Updated for the latest version. [8.35]
• UFD files: Updated support to properly parse SMS/MMS messages from UFD acquisitions.
• Wickr Me | Android: Updated to include support for parsing decrypted messages and contacts.
• Wickr Messages | Windows: Added support for recovering messages. Decryption is attempted without having to provide a password. [5.60.16]
• Yahoo Mail Messages | iOS: Updated support for the latest version. [6.14]

Cloud

• Added support for preservation*.html files in Facebook and Instagram Warrant Returns.
• Improvements to Facebook Friends acquisition.
• When you load a cloud image created in Magnet AXIOM 3.3 or earlier, the dates might appear incorrectly. You can verify the date/time format before you process the image. To learn how to solve the issue, see the article “Date/time data in old cloud image is incorrect.”
• You can now load Skype Exports.

Processing

• AXIOM Process now caches data to improve performance when loading, scanning, and examining images.
• You can now load AFF4-L images that were created using AXIOM Cyber Remote Acquisition.

Examining

• AXIOM Examine now keeps a search history for each case. When you use the search bar, suggested terms will appear based on the column names and search history in the current case.
• The Case dashboard is now available in portable cases. HTML, PDF, and Excel exports are still available. The Timeline explorer and the option to save files from the case have been removed.
• When performing an advanced search, AXIOM Examine now uses fast searching using the Lucene.NET integration to improve search time.
• You can now perform a keyword search within Preview card for artifacts, including all types of documents, that have an HTML-based Preview card. Matching keywords are highlighted in the Preview card, and you can click back or next to review all matching hits.
• You can now set a default time zone in AXIOM Examine as an application setting.

Bug fixes

• When processing English data with a non-English locale in AXIOM Process, some data would be misrepresented. When converting English data to non-English data, AXIOM Process searches for delimiters that would identify a certain type of number (e.g. a decimal) in the set language. If certain delimiters were missing according to the set language, AXIOM Process would sometimes misrepresent the value in the converted data. -AXP-6998
• Cloud Google Activity artifacts were not being recovered consistently. -CAO-3214
• In IMAP/POP acquisitions, support for the following servers has been added: SSL2, SSL3, TLS1, TLS1.1, TLS2. -CAO-3261
• Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
• Scans would sometimes encounter an error that prevented them from continuing, but the logs would indicate that the scans finished successfully. -AXP-7087
• Sometimes when finishing a scan, AXIOM Process would crash and an “Access denied” error would appear. -AXP-7061
• Sometimes, Twitter Direct Messages could not be acquired. -CAO-3181
• Sometimes, previews wouldn't appear for AFF4 and archive files due to temp file errors. -AXP-7311
• Sometimes, when creating a portable case that included media attachments, the export would fail. This failure might still occur when copying large media attachments to the portable case, with increased logging to help you troubleshoot. -AXE-7315
• Sometimes, when creating a portable case, an error message would incorrectly state that the system didn’t have enough memory and the export would fail. -AXE-8322
• Sometimes, when you opened a portable case, a "CreateCards" exception appeared in the log files. -AXE-8466
• The Google Photos Warrant Return artifact wasn’t properly parsing quotations and commas from the evidence source. -CAO-3126
• The “Save artifact to” option was not available for individual audio files. -AXE-7919
• When exporting media items to a PDF export, multiple error messages were appearing. -AXE-8066
• When searching a table in the SQLite viewer using a search term that included an asterisk (*), the query would fail. -AXE-8080
• When updating Magnet AXIOM through the update prompt in the application, the update would sometimes fail and AXIOM Process would fail to open. -AXP-7214
• When viewing a PDF report, you were unable to open chat thread preview links. -AXE-8344
• Full email bodies could not be recovered from Windows 10 Mail. -COMP-680
• Google Accounts were sometimes being wrongly attributed as Google Meet Accounts. -MA-2327
• In reports, the Magnet Web Page Saver artifact would display the database name in place of file names. Now, the hash value of the file is displayed instead. -MA-2296
• TikTok Messages weren't reporting data for the Media URL fragment. -MA-2326

Known issues

• To search for information about known issues, visit the knowledge base at support.magnetforensics.com.