Artifact updates

Android

Facebook Events NEW

ProtonMail Decryption NEW

Windows

Hangul Word

Microsoft Office Documents

RTF Documents

Text Documents

Windows Event Logs

Windows Event Logs - Storage Device Events NEW

Cloud

Cloud Passwords and Tokens

Cloud Service URLs

iOS

Facebook Posts NEW

Photos Media Information

Private Photo Vault

Safari Browser State Tabs

Viber

iCloud Backups

iCloud Backups are now supported up to and including iOS 15. Data that can be acquired in an iCloud backup includes:

App data
Apple Watch backups
Device settings
Home screen and app organization
iMessage, SMS, and MMS messages
Photos and videos on your iPhone, iPad, and iPod touch2
Purchase history from Apple services
Ringtones
Visual Voicemail password

Artifacts

Facebook Events | Android: Added support for Facebook Events.

Hangul Word Processor | All Platforms: Updated support to add MD5 and SHA1 hash fragments.

Multiple artifacts | Cloud: Updated Cloud Service URLs to add more URLs including MEGA.

Multiple artifacts | Cloud: Updated support for Cloud Passwords and Tokens analyzer to include Twitter, Apple, Uber, and Lyft. Also added Package Name, Created Date/Time, and Modified Date/Time.

Private Photo Vault | iOS: Added support for the latest versions of Private Photo Vault. [12.8]

Proton Mail | Android: Added support for decryption of email body, attachments, and contact details.

RTF Documents | All Platforms: Updated support to add MD5 and SHA1 hash fragments.

Text Documents | All Platforms: Updated support to add MD5 and SHA1 hash fragments.

Viber | iOS: Updated support for recovering messages and attachments.

Windows Event Logs - Storage Device Events | Windows: Added support for recovering event logs related to storage device events.

Cloud

You can now load Google Warrant returns that include many .zip files

You can now parse location history in a Google Warrant return

iCloud Backups are now supported up to and including iOS 15.

Processing

AXIOM Process now supports Cellebrite's UFDX file format

Examining

If you've expanded the World map preview for an artifact, the preview window will remain expanded when you switch to a different artifact.

You can now find similar pictures from the Preview card in the Media explorer.

Bug fixes

AXIOM Process and Acquire couldn't acquire images from iOS devices -AXP-9079

AXIOM Process could not process iOS backups that were decrypted to a BitLocker encrypted drive -AXP-6373

Improvements to handling Unicode characters in file names of GrayKey extractions -AXP-8739

In AXIOM Process, when you loaded two evidence items with the same name, the Evidence filter in AXIOM Examine would only list one evidence item for both images and the source, location, evidence and details sections within Examine would be empty for many artifacts. -AXP-2227

Scanning two encrypted iOS backups with the same name would cause all evidence to be associated with both evidence sources -AXP-9015

Sometimes, when applying filters to evidence, AXIOM Examine would close, or freeze and then close. -AXE-9814

Sometimes, when switching to the Registry explorer from another explorer, AXIOM Examine would crash. -AXE-9832

When carved Word documents were exported, the file extension would be incorrect. -AXE-9499

When media items were stacked in the Media explorer, and then exported to Project VIC, a duplicate attachment would be exported. -AXE-9851

When parsing the file system of an exFAT formatted partition, if AXIOM was unable to parse an item, all other items within the file's directory, up to the root, would fail to parse. Missed items would appear in carved results but may not have been accessible or visible in the file system view of the evidence. -AXP-8839

Previews of photos for Photos Media Information artifacts were not displayed. -MA-3053

Safari Tabs artifact has been renamed to Safari Suspended State Tabs. The artifact description, Last Interaction Date/Time, and Visit Order have been updated in the Artifact Reference Guide to better reflect the data acquired. -MA-3770

Some fragments in Event Logs were not completely parsed. -COMP-1633

Previously, you were unable to acquire Google Drive backups of WhatsApp accounts. -CAO-3163

The acquisition of a Mega account would fail when an encrypted shared key from Mega was not a valid length. -CAO-4126

Public Twitter account Posts could not be acquired. -CAO-4328

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.