Artifact updates

Android

Breadwallet Events NEW

Breadwallet Transactions NEW

Coinomi Transactions NEW

Discord

Facebook Comments NEW

Facebook Messenger

Facebook Posts NEW

Facebook Tags NEW

Signal

Signal Decryption Validation for Media decryption

Signal Options Dialog

macOS

Facebook Messenger - Calls NEW

Facebook Messenger - Groups NEW

Facebook Messenger - Users Contacted NEW

Facebook Messenger - Messages NEW

File System Events

iOS

Breadwallet Transactions NEW

Coinomi Transactions NEW

Contacts

iMessage

Messages

Snapchat

Viber

Windows

Facebook Messenger - Calls NEW

Facebook Messenger - Groups NEW

Facebook Messenger - Messages NEW

Facebook Messenger - Users Contacted NEW

Telegram Media NEW

Preview geolocation data with the map preview card

For artifacts that contain geolocation data, you can now view world map previews from different explorers in AXIOM without having to open World map view. From the preview, you can open World map view with the artifact of interest shown on the map.

Artifacts

Breadwallet Events | Android: Added support for Breadwallet Events.

Breadwallet Transactions | iOS and Android: Added support for Breadwallet transactions.

Chrome | Windows: Updated support to include the new "Login Data for Accounts" file location. [96.0.4664.93]

Coinomi Transactions | iOS and Android: Added support for Coinomi Transactions. [1.12.0 (iOS) and 1.24.2 (Android)]

Discord | Android: Updated support for recovering new messages and calls in the latest version. [85.13]

Facebook Messenger Calls | macOS: Added support for parsing call data recovered from Facebook Messenger.

Facebook Messenger Calls | Windows: Added support for parsing call data recovered from Facebook Messenger.

Facebook Messenger Groups | macOS: Added support for parsing data about group chats on Facebook Messenger.

Facebook Messenger Groups | Windows: Added support for parsing data about group chats on Facebook Messenger.

Facebook Messenger Messages | macOS: Added support for Facebook Messenger Messages.

Facebook Messenger Messages | Windows: Added support for Facebook Messenger Messages.

Facebook Messenger Users | macOS: Added support for parsing information about users contacted from the device using Facebook Messenger.

Facebook Messenger Users | Windows: Added support for parsing information about users contacted from the device using Facebook Messenger.

Facebook Posts | Android: Added support for Facebook Posts.

Facebook Tags | Android: Added support for Facebook Tags.

File System Events | macOS: Updated support for recovering file system events from devices with M1 chips.

iMessage | iOS: Updated support to recover iMessage Data in AppIntent folder.

Signal | Android: Added support to validate media decryption.

Signal | Android: Updated support for options dialog to accept media decryption key.

Telegram Media | Windows: Added support for Telegram Media.

Viber | iOS: Updated support for recovering attachments in messages from the latest version.

WhatsApp Messages | iOS: Updated support to parse the local user data for version 2.17 and 2.18.

WhatsApp | iOS: Updated support for Messages to recover local user information.

Cloud

Dropbox sessions will no longer expire during account acquisitions.

Processing

Improvements to how GrayKey keychain files are managed. These improvements include:

Keychain path now defaults to the last used path if no setting is found
Focus is now placed on the GrayKey password when it formally was not.

In AXIOM Process, sealed volumes are no longer selectable as they contain read only data that is not pertinent to a case.

Performance improvements for processing volumes containing a large number of deleted files.

Examining

In the Media explorer, you can now filter for evidence that is missing from the CAID database.

In the Media explorer, you can now view the Artifact type in the Details card.

When keyword search results were highlighted, SMS/MMS text wasn't readable in the Preview panel.

When you create an HTML report, you can now choose to remove attachments for contraband media from the report.

You can now filter on Evidence sources from the Filters bar in the Media explorer.

You can now view a World map preview for artifacts with geolocation data.

Bug fixes

AXIOM Process would sometimes fail when processing a macOS sealed volume. -AXP-7642

After the keyword post-processing job finished, the Artifacts left pane wouldn't refresh to display keyword snippets. -AXE-9892

An error would occur when AXIOM extracted files from some segmented ZIP files -AXP-4269

Sometimes, chat threads were not appearing properly. -AXE-9955

Sometimes, in PDF reports, email bodies were appearing blank. -AXE-8920

Sometimes, when a case was opened, AXIOM Examine wouldn't display all the evidence that was processed. -AXE-9929

The search would sometimes fail when hits were found in the $I30 index but not in the Master File Table. -AXP-7583

When a PDF report was created that included carved and parsed hits, the attachments for parsed hits would not be included. -AXE-9866

When a VICS export was created that contained a .tiff file, the file size reported in the exported .json file didn't match the file size reported in AXIOM or in Windows File Properties. -AXE-9784

When a column filter, then a basic filter, then an advanced filter were applied, AXIOM would crash. -AXE-9720

When processing macOS Big Sur images, the Spotlight attributes panel would not appear. -AXP-8184

When the UI language was set to anything other than English, evidence could not be successfully uploaded to Magnet REVIEW. -AXE-9864

When trying to view some XML .plist files in the File system explorer, an error message would appear in the Preview window. -AXE-9835

When you changed the time zone setting in AXIOM Examine and created an export, the evidence would be set to UTC+0:00, rather than the time zone you selected. -AXE-9709

The Message Sent/Received Date and Time from Signal.db's SMS Table was incorrectly reported for Signal for Android. [5.25.8] -MA-3695

Updated support to recover hits from Facebook Messenger 313.0. -MA-3600

Updated support to remove duplicate hits for Messages and Contacts. -MA-3698

Video attachments were missing for Facebook Messenger for Android. [333] -MA-3691

Updated support for Recycle Bin to reduce scan times and false positive hits. -COMP-1598

In a Google Warrant Return, the UTC was misrepresented as local time. -CAO-3798

In a MEGA download, attachments would fail to write to a temp directory -CAO-3613

Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163

The acquisition sometimes fails when acquiring Uber trip history. -CAO-4077

Uber acquisition would fail when acquiring an account with a large amount of data. -CAO-3014

When viewing Snapchat data, AXIOM Examine would not show the correct data for the column heading -CAO-4031

When you clicked the WhatsApp QR code access, the QR code pop-up did not load and AXIOM Process froze. -CAO-4211

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.