Artifact updates

Android

Grindr

Messages

Skype Activity

WeChat

Wickr

Zello Messages NEW

Zello Profiles NEW

iOS

Apple Mail

Apple Notes - Voice

Facebook Messenger Chats

Google Photos

Grindr

Owner Information

Photos

Safari History

Skype Activity

Snapchat

Tumblr

WeChat

Zello Messages NEW

Zello Profiles NEW

Windows

LNK Files

Microsoft Office Backstage NEW

Microsoft Office Documents

Skype Activity

Cloud

Facebook Public Activity Profiles

Find matching identifiers across cases using Magnet Prague (beta)

Magnet Prague allows you to integrate a centralized database in Magnet AXIOM, and begin to search for identifiers of interest across cases.

Integrate Magnet Prague with AXIOM Examine to search for matching identifiers from other cases and upload identifiers from your case.
The Magnet Prague database can store people identifiers, such as email addresses or phone numbers, and device identifiers, such as camera serial numbers or phone IMEIs.
To download the beta version of Magnet Prague and its installation guide, visit Magnet Idea Lab.
More details...

Artifacts

Apple Notes - Voice | iOS: Updated support for recovering the correct file path of the original recording for edited voice notes. [14.0]

Facebook Public Activity | Cloud: Added support for recovering the Facebook profile of the target account.

Grindr | Android: Added support for recovering social network information, including Facebook, Instagram, and Twitter account names for Grindr Buddies.

Grindr | iOS: Updated support for recovering Messages and Group Members. [7.8.0]

Grindr | iOS: Updated support for recovering conversation partner information. [7.6.0]

Microsoft Office Backstage Items | Windows: Added support for recovering information about items found in the Backstage View of Microsoft Office applications. [16.0]

Owner Information | iOS: Added support for recovering Directory Services Identifier (DSID) for.

Photos | iOS: Updated support for Photos Media Information from the latest version. [14.0]

Skype | Android, iOS, and Windows: Updated support for Skype Activity to use Created Date/Time as a fallback fragment for chat threading.

Snapchat | iOS: Added support for carving display names.

Telegram | Android: Updated support for recovering user information from deleted accounts. [7.6]

Tumblr | iOS: Updated support for recovering Chat Messages. [20.1]

WeChat | Android: Improvements to WeChat including recovering more information about call messages, such as when calls are declined or cancelled and the duration of the message, recovering and displaying previews of attachments in chat threads, recovering more message types, and recovering raw XML data for Picture, Location, Notice, and Pay message types. -MA-2616

WeChat | iOS: Improvements to WeChat including recovering the duration of messages, recovering more message types, and recovering raw XML data for Picture, Location, Notice, and Pay message types. -MA-3161

WhatsApp | Android: Updated support to include recovering messages from the latest version. [2.21.9.13]

Wickr | Android: Updated support for file carving. [5.76.5]

Zello | Android: Added support for recovering profiles and messages. [4.96.3]

Zello | iOS: Added support for recovering profiles and messages. [4.98.1]

Cloud

Improvements to timeout and logging when scanning a WhatsApp QR code.

When you right-click a Facebook Cloud Passwords and Tokens artifact and select Add new cloud evidence using passwords / tokens, AXIOM Process will launch and automatically log you in to the selected Facebook account.

You can now check whether the Instagram account you want to acquire exists and if the account is set to private or public.

Processing

Added support for 5 digit extensions for DD raw images.

Custom file type artifacts now include a thumbnail for parsed hits.

Passware SDK has been updated to the latest version. This update also resolves an issue where decryption would fail even when the BitLocker key was correct.

Examining

AXIOM now displays a warning message if short keywords (2 or 3 characters) are being added to a case, as these keywords can return too many irrelevant results.

By default, you can no longer navigate to the internet using links in the Preview card. You can enable internet navigation in Tools > Settings.

In the Media explorer, you can now filter by MIME type.

In the Media explorer, you can now filter for tags and comments.

When you create a VICS export, the file name now matches the case number by default. You can edit the export file name.

You can now build the media explorer from the Tools menu in AXIOM Examine.

You can now create templates to use with KML exports.

You can now integrate a beta version of a Magnet Prague database with AXIOM Examine. After you or someone on your team has installed the beta version of Magnet Prague, configure it in Tools > Settings > Product integrations. Using the Magnet Prague beta, you can search your case for identifier matches to your teammates' cases, and you can also tag identifiers of interest and upload them to your team's database.

Bug fixes

Improved performance when scrolling large numbers of picture or video artifacts in the artifacts explorer. -AXE-9429

In AXIOM Examine 5.1, the world map view was loading very slowly. -AXE-9475

In some cases, keywords or keywords could not be loaded from the application settings database. -AXP-7981

In the media explorer, after you pointed your case to a new source location, the locate source notification would still appear. -AXE-9266

In the text and hex decode view, Mac Absolute timestamps were being displayed with the wrong year. -AXE-9342

PDF reports with large amounts of threaded SMS/MMS message would fail to export. -AXE-8578

PST exports would fail when exporting a large amount of Outlook evidence. -AXE-8997

The media explorer index would fail to build when the language was set to French. -AXE-9432

When a TIF file was exported using the "Save artifact to" feature, the exported file would not match the file in the case. -AXE-8873

When using the Categorize Pictures and Videos by Hash Value feature in Examine, media content was read into memory even though the hash did not need to be calculated. The resolution to this issue has improved processing times with this feature. -AXP-8259

When you would try to update from the AXIOM Examine Help menu, nothing would happen. This issue didn't affect AXIOM installations with the Passware plugin. -AXE-9445

AXIOM was not correctly parsing .msg files from an Encase LX01 image. -COMP-1422

AXIOM was not correctly parsing the embedded target path/filename in LNK files. -COMP-1352

AXIOM would crash with an Access Violation Exception (AVE) when processing certain images. -MA-3189

Android Messages incorrectly represented the Received Date/Time as the Original Transmit Date/Time. -MA-3200

Message data from Apple Mail in iOS 14 was not correctly parsed and HTML previews were not available. -MA-3083

Original Path data was not recovered for Apple Notes Voice for iOS 14 devices. -MA-2240

Safari History incorrectly included default URLs from AutoFillQuirks.plist. -MA-3088

The incorrect physical sector location was displayed for carved legacy Office Document files using the Microsoft Compound File Binary Format. -COMP-1375

Improvements to recovering Google Photos Album Comments and added support for recovering Media ID for iOS. -MA-3172

Box.com file failed to download when path contained non-ascii characters. -CAO-3873

When you clicked the WhatsApp QR code access, the QR code pop-up did not load and AXIOM Process froze. -CAO-3978

AXIOM had frequently missing thumbnails after processing video files using FFMPEG.

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.