Artifact updates

Android

Beam Transactions NEW

Coinbase NEW

Exodus NEW

Grindr

ProtonMail Contacts NEW

ProtonMail Emails NEW

Signal

Wickr

macOS

PowerLog Battery Shutdown NEW

PowerLog Application State NEW

Trash Items

iOS

Beam Transactions NEW

Coinbase NEW

Exodus NEW

Facebook Messenger

PowerLog Battery Shutdown NEW

PowerLog Application State NEW

Signal

Snapchat

Wickr

Windows

Rebuilt Desktops

Upload evidence from Magnet AXIOM to Magnet REVIEW

If your organization has a Magnet REVIEW server, you can now integrate Magnet AXIOM with Magnet REVIEW for a streamlined upload experience.

Integrate Magnet REVIEW using your organization's server address in Tools > Settings > Product integrations
Using the AXIOM exporting wizard, select the evidence you want to upload directly to a new or existing Magnet REVIEW case
Learn more about Magnet REVIEW

Automatically decrypt iOS artifacts using GrayKey Keychain data

When loading a GrayKey iOS image manually or by using the Connect to GrayKey workflow, you now have the option of adding a keychain file to decrypt the data. Including the keychain allows AXIOM to attempt to automatically decrypt some mobile artifacts, leading to more evidence in your case data.

Acquire and process Android images directly from GrayKey devices

After acquiring an Android image using GrayKey, you can now connect directly to the GrayKey box from AXIOM and copy the device data to your AXIOM workstation for processing. This workflow eliminates the need to manually download the files from GrayKey prior to loading the image into AXIOM.

Artifacts

BEAM Wallet | iOS and Android: Added support for recovering information about transactions and addresses from BEAM Wallet.
Coinbase | iOS and Android: Added support for recovering transactions, addresses, and purchases made using Coinbase.
Exodus | iOS and Android: Added support for recovering information about transactions made using Exodus.
Facebook Messenger | iOS: Updated support to improve carving on Users Contacted fragment. [334.2]
Facebook Messenger | iOS: Updated support to recover artifact hits that were previously being dropped. [334.2]
Grindr | Android: Updated support for the latest version of Grindr Messages. [7.18]
PowerLog Application State | iOS and macOS: Added support for parsing information about application states from the PowerLog.
PowerLog Battery Shutdown | iOS: Added support for recovering information about the device when the battery died.
ProtonMail Emails | Android: Added support for ProtonMail Emails and ProtonMail Contacts.
Rebuilt Desktops | Windows: Updated support to add a standardized date in the taskbar date/time fragment.
SMS/MMS | Android: Added support to parse SMS/MMS messages from the Message table in the mmssms.db.
Signal and Wickr | iOS and Android: Updated support to improve SQLite WAL Files decryption algorithm.
Signal | Android: Messages that are sent as group updates can now be decoded.
Signal | iOS: Updated support to recover missing hits for corrupted WAL File. [5.21.1, 5.23.1+]
Snapchat | iOS: Updated support to retrieve missing hits from multiple artifacts.
Telegram | macOS: Added support for parsing the database through manual decryption with an option to enter the password in the options dialog if one was used to encrypt the local database.
Trash Items | Apple: Updated support for macOS Trash Items to fix the Added Date/Time fragment.
WeChat | Android: Updated support by providing WeChat password in the logs.
WhatsApp | iOS: Added support for Accounts Information artifact.
Updated support to enable performance improvements for scanning PST files.

Processing

Improved workflow for loading an Android GrayKey image into AXIOM.
When loading an iOS GrayKey image, you now have the option of adding a keychain file. You can also add the keychain file when using the Connect to GrayKey feature for iOS images.

Examining

When you create a CSV, HTML, Excel, Load File, PDF, or XML report, there is now a column that displays the Item ID for each artifact.
When you create a VICS export, you can now choose to export attachments for media items that are missing from the CAID database.
When you upload evidence from Magnet AXIOM to Magnet REVIEW, you can view details about the upload progress and the log files.
When you view evidence in the Artifacts explorer, there is now a column that displays the Item ID for each artifact.
You can now integrate Magnet REVIEW to upload evidence directly from Magnet AXIOM to your organization's Magnet REVIEW server.
You can now set a default explorer to view similar pictures when you use the Find similar pictures feature from the Artifacts explorer or Media explorer.
You can now upload evidence directly from the AXIOM Examine exporting wizard to your Magnet REVIEW cases.

Bug fixes

AXIOM Process was unable to open .zip files with comments at the end of the file over 0x3740 bytes or .zip files with non-zip data at the beginning of the file. -AXP-8437
After similar pictures were searched for, the Media explorer would automatically apply the Related artifacts filter. -AXE-9127
If you opened the Media explorer after performing a global search, the search would disappear from the Filters bar, but would still be applied to the evidence. -AXE-9673
Sometimes, when performing an advanced search, AXIOM Examine would crash. -AXE-9802
When a case had no geolocation data, World map view would keep loading, and AXIOM Examine had to be closed. -AXE-9718
When a global search filter was applied in the File system explorer, the sort settings were ignored and other filters couldn't be added. -AXE-9736
When creating a VICS export in the exporting wizard, if there were media items that were both precategorized and reviewer graded in the same category, the media count would appear doubled. -AXE-9812
When the Media explorer was built using Magnet AUTOMATE, it would fail. -AXE-9823
AXIOM Process would sometimes hang when searching a migration.db file from a GrayKey image. -COMP-1544
When decrypting Wickr Messages for Android, if you entered more than one key in the options dialog, only one was getting saved. -MA-3509
Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163
The Dropbox screen would appear blank after authenticating. -CAO-4190
Twitter public cloud collection would fail with the error "Completed with errors". no artifacts are inserted into the case. -CAO-2599
Valid Facebook profiles would not validate. -CAO-4144
When acquiring OneDrive, not all files would be acquired. -CAO-3790
When you clicked the WhatsApp QR code access, the QR code pop-up did not load and AXIOM Process froze. -CAO-4211

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.