Artifact updates

Android

Contacts

Signal

Snapchat

Zello Audio Messages NEW

Windows

Signal

EML(X) Files

iOS

Apple Keychain

PowerLog In Call Service NEW

Signal

Zello Audio Messages NEW

Chromebook

Device Information NEW

Downloads NEW

Extensions NEW

Offline Storage NEW

Recent Tasks NEW

Trash Items NEW

Google Workspace acquisition enhancements

We've redesigned the Cloud acquisition workflow for Google Workspace! Updates include:

Improved authentication method selection to better understand the type of data you can expect to acquire based on the method you choose with improved authentication method selection.
Updated options to customize the Google account, Google Drive, and application data you want to acquire—including more information about the type of data you can expect to acquire with each option.

Chromebook artifacts

We're introducing even more support for Chromebook images. When you load Chromebook images in AXIOM Process, retrieve data from new, dedicated Chromebook artifacts, including Device Information, Downloads, Extensions, Offline Storage, Recent Tasks, and Trash Items.

For more information about these new artifacts, and all supported artifacts, review the Chromebook section of the Artifact Reference Guide.

Artifacts

Contacts | Android: Updated support to include roaming artifacts from calllog.db, including total contact call duration and the picture associated with the contact.
Device Information | Chromebook: Added support for recovering information about the physical device, such as model information, the software version, region information, and the latest Chrome OS version.
Downloads | Chromebook: Added support for recovering file download information from a recovered Chromebook device.
EML(X) Files | Windows: Performance improvement when carving the EML(X) Files artifact.
Extensions | Chromebook: Added support for recovering information about the permissions a plugin or extension has, such as active, granted, or withheld permissions.
Offline Storage | Chromebook: Added support for recovering files that primarily exist online but have also been saved to local storage on the Chromebook device for offline use.
PowerLog In Call Service | iOS: Added support for recovering information about when an application on the device was used to perform a call service.
Recent Tasks | Chromebook: Added support for recovering recent OS tasks recovered from a Chromebook extraction.
Signal Messages | Android: Updated support for Groups to parse Group Update messages.
Signal Messages | iOS: Updated support to parse missing Recipients data in messages. [5.21.0]
Signal | Android: Updated support for the latest version and added support for decrypting WAL files. [5.23.8]
Signal | Windows: Updated support for recovering more data from messages.
Snapchat | Android: Updated support to retrieve snaps and other media files. [11.4]
Trash Items | Chromebook: Added support for recovering information about the items that a user has sent to the trash.
WhatsApp | Android: Updated support for Live Location media caption. [2.21.14.24]
WhatsApp | Android: Updated support for recovering messages, chats, and groups. [2.21.15.20]
Zello | iOS and Android: Added support to recover the audio for sent messages.

Cloud

Improved workflow for Google workspace account authentication and data selection.

Processing

In AXIOM Process, you can now add your own case types to the list of types.

Examining

AXIOM Examine now switches to Software rendering mode when it detects a crash while trying to render the UI. You can turn off Software rendering mode in Tools > Settings. To learn more, see Running AXIOM Examine in Software rendering mode.
In the Media explorer, the number of artifacts now appears next to the Related artifacts heading, rather than the hit count.
In the Media explorer, you can now filter for Accessible and Inaccessible items.
When you create a Project VIC export, you can now see the number of separate graded media items, rather than the artifact count.
In the Magnet.AI categorization section on the Case dashboard, there is now a column for Media tags. When you click one of these numbers, it will take you to the results in the Media explorer.
Magnet.AI media categorization now applies categories to all items in a stack for faster categorization of duplicated items.

Bug fixes

In Timeline view, when a tag was applied to multiple selected items, it would take a significant amount of time and not all of them would be properly tagged. -AXE-9433
Sometimes, AXIOM Examine would crash when trying to play videos. -AXE-9520
When trying to build the Media explorer index in a very small case, the index would fail. -AXE-9682
Sometimes, when creating a Project VIC export, the option to upload media missing from the Project VIC database was unavailable. -AXE-9723
Sometimes, when media evidence in your case was recovered from internet browser artifacts, the Media explorer index would fail to build and the Media explorer would crash. -AXE-9696
When a carved picture was exported using the "Save artifact to" feature, two duplicate picture files were being created. -AXE-8409
When the time zone was adjusted in AXIOM Examine, the scan date was being incorrectly adjusted to reflect this setting, rather than displaying the correct time when the scan took place. -AXE-9521
When you changed the time zone setting in AXIOM Examine and created an export, the evidence would be set to UTC+0:00, rather than the time zone you selected. -AXE-9709
When you went from the World map view in the Artifacts explorer to the Timeline explorer, and then back to the World map view, AXIOM Examine would crash. -AXE-9705
EXIF data for videos was incorrectly processed as Local time instead of UTC. -MA-3428
Updated support for carvers to retrieve missed hits from a calllog.db-wal by processing database support files. -MA-3381
When processing an iOS keychain file, some keys in the plist file were not parsed. -MA-3480

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.