Release Notes

Magnet AXIOM 4.6.0.21968 October 16, 2020

Artifact updates

Android

Facebook Messenger

Firefox

Instagram

Slack

Uber

WhatsApp

Windows

Calendar Events

EML(X) Files

Outlook

Windows Mail

iOS

Google Calendar Reminders NEW

Google Docs NEW

Google Drive NEW

Google Sheets NEW

Google Slides NEW

Photos Media Information NEW

Apple Maps

Application Permissions

DuckDuckGo

Ecosia

Facebook Messenger

iOS

Google Photos

iMessage

Lyft

PowerLog

Signal

Twitter

macOS

Photos Media Information NEW

Rebuilt Desktop NEW

Apple Mail

Calendar Events

Artifacts

• Apple Maps | iOS: Updated artifacts to support iOS 14.
• Application Permissions | iOS: Updated to recover permissions in the latest version of iOS. [iOS 14]
• DuckDuckGo Current Tabs | iOS: Updated to support the latest versions. [7.5.1]
• Ecosia | iOS: Updated to support the latest versions. [4.0.25]
• Email artifacts: Recovered emails are now hashed if hashing is turned on in AXIOM Process.
• Facebook Messenger | Android: Update support to recover audio and video messages.
• Facebook Messenger | iOS: Updated to recover audio and video messages.
• Firefox | Android: Update support for the latest versions. [80.1.3]
• Google Calendar | iOS: Added support for recovering calendar reminders. [20.29]
• Google Drive | iOS: Updated to include support for offline files. [4.2020.34203]
• Google Meet | Android: Updated support to recover meeting history from the latest version. [45.0]
• Google Productivity apps | iOS: Added support for recovering items from Google Docs, Google Drive, Google Slides, and Google Sheets.
• iMessage Chats | iOS: Updated support to recover mentions from messages. [iOS 14]
• imo Messages | Android: Updated to include the message types.
• Instagram | Android: Updated support for the latest version. [159.0.40]
• Lyft Accounts | iOS: Updated support to include profile photos. [6.51.3]
• Photos Media Information | iOS, macOS: Updated to include the media file attachments.
• Plists: Improvements to processing plists that source linking from an artifact to the plist source.
• PowerLog | iOS: Updated to recover information from system diagnostic logs that are generated by the user from the device.
• Rebuilt Desktop | macOS: Added support for rebuilding an approximation of the user's desktop, including the background, icons, and taskbars. [macOS 11, 10.15, 10.14]
• Signal | iOS: Improvements to decryption and the handling of multiple keys.
• Signal | iOS: Updated support to carve database files for deleted messages. [4.21.6]
• Slack | Android: Updated support to recover Slack Channel Messages, Slack Channels, and Slack Direct Messages from the latest version. [20.9.10.0]
• Spotlight Shortcuts | macOS: Updates to support Big Sur. [macOS 11]
• Twitter Users | iOS: Updated to include the full name of the user. -MA-1946
• UFD files: Updated support to properly parse SMS/MMS messages from UFD acquisitions.
• Uber | Android: Updated support for the latest version. [4.333.10003]
• VK Users | Android: Updated support for the latest version. [6.13]
• Wi-Fi Profiles | Android: Updated support to recover Wi-Fi profiles for Android 11.

Cloud

• Due to changes made to the iCloud Backup protocol by Apple, support for iCloud Backup acquisition has been temporarily removed from Magnet AXIOM while we research a solution.
• Facebook Timeline artifacts now include the Title of the post.
• The names of time stamps for Box User Event Logs, Enterprise Logs, and Files have been updated for clarity. “Created Date/Time” is now “Server Created Date/Time” and “Recorded Date/Time” is now “Server Recorded Date/Time.”
• You can now acquire data from MEGA The Privacy Company.

Processing

• AXIOM Process now caches data to improve performance when loading, scanning, and examining images.
• Added support for Quick Acquisition of Android 11 devices.
• Magnet AXIOM now acquires .zip files as read-only files, which significantly improves the scan times.
• You can now clear the list of recent cases in AXIOM Process.
• When you connect to Magnet AXIOM for the first time with a new or renewed dongle license, paste an activation code (received in an email from Magnet Forensics) directly into the Magnet License Manager. Access the License Manager by clicking Help > Licensing > Dongle in Magnet AXIOM. For more information about activating a dongle license, review Activate a Magnet AXIOM license in the Customer Portal. If you previously received a .bin file from Magnet Forensics to renew your license and already updated to 4.6, contact support@magnetforensics.com to receive an activation code.
• You can now copy your licensing dongle IDs from the “Update dongles” table in the Magnet License Manager.

Examining

• AXIOM Examine now keeps a search history for each case. When you use the search bar, suggested terms will appear based on the column names and search history in the current case.
• When creating an export that includes chat threads, the settings have been updated for clarity. You can now select whether you want to include only the messages you selected, or the full conversation history.
• You can now clear the list of recent cases in AXIOM Examine.
• You can now use templates when creating a portable case.

Bug fixes

• AXIOM Process would report that it had shut down Windows Defender, but active protection was still running. -AXP-6416
• After updating to Magnet AXIOM 4.5, AXIOM Examine would crash the first time a keyword search was performed. -AXE-8546
• Artifacts could not be added to the case if they contained special characters in their file names. -AXP-7293
• Box.com timestamps were appearing in local time instead of UTC. -CAO-3285
• Exports would fail when they included tag names that were identical to artifact categories but with different capitalization (for example, FACEBOOK URLS was the tag name, and Facebook URLs was the artifact category). -AXE-6780
• If there was an apostrophe in the case folder path, when building the timeline, AXIOM Examine would encounter an error and prompt the user to close the program. -AXE-7167
• In IMAP/POP acquisitions, support for the following servers has been added: SSL2, SSL3, TLS1, TLS1.1, TLS2. -CAO-3261
• Office 365 Mail acquisitions were only acquiring messages from within the last three years. -CAO-3255
• On the “Items to include” screen in the exporting wizard, when all tagged items were selected, the individual tags would appear in the dropdown list. -AXE-8562
• Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
• Sometimes, XML exports would fail when they included large amounts of message attachments. -AXE-7946
• Sometimes, exports were failing when they contained deleted media files. -AXE-8347
• Sometimes, previews wouldn't appear for AFF4 and archive files due to temp file errors. -AXP-7311
• Sometimes, when pulling SD card data from an emulated card, AXIOM Process would get stuck on this step indefinitely during processing. -AXP-7411
• The file and folder icons were missing from the Registry explorer. -AXE-8571
• The “Date Taken” time stamp for Instagram has ben updated to “Posted Date/Time UTC,” which reflects the date and time that the post was created. -CAO-3302
• When Facebook Timeline posts contained multiple media attachments, they were not being linked as separate files. -CAO-3139
• When adding evidence to a case, if file hashing was enabled, this setting was not applied to the new evidence. -AXP-5376
• When the option to automatically check for updates was turned off, AXIOM Process would continue to check for updates and notify the user. -AXP-7440
• When updating Magnet AXIOM through the update prompt in the application, the update would sometimes fail and AXIOM Process would fail to open. -AXP-7214
• Calendar artifacts were logging unnecessary warnings. -COMP-1100
• Case numbers in Magnet AXIOM were using times formatted in the 12 hour clock rather than 24 hour. -MA-2429
• Full email bodies could not be recovered from Windows 10 Mail. -COMP-680
• In conversation view, all WhatsApp messages for Android devices appeared as received even though the message status correctly indicated the message was Sent Successful or Received by Recipient. -MA-2413
• macOS mail attachments weren't displaying any data in AXIOM Examine. -COMP-1160

Known issues

• To search for information about known issues, visit the knowledge base at support.magnetforensics.com.