Artifact updates

Android

Signal Stories

Telegram Users

Windows

EML(X) Files

Microsoft Teams Messages

Rebuilt Desktops

Stored Credentials

Various Microsoft Office artifacts

Various OpenOffice artifacts

macOS

EML(X) Files

iOS

Device Information

Facebook Messenger

Instagram Direct Messages

KnowledgeC Siri Intents NEW

Snapchat

TikTok Videos

iOS - Biome

Biome Application Focus NEW

Biome Application Install States NEW

Biome Application Launch NEW

Biome CarPlay Connected Cars NEW

Biome CarPlay Connections NEW

Biome Device Orientation States NEW

Biome Device Plugged-in States NEW

Biome Do Not Disturb Data NEW

Biome Keybag Lock States NEW

Biome Safari History NEW

Biome Safari Page View NEW

Biome Siri Execution NEW

Biome Siri UI Usage NEW

Biome User Activity NEW

Biome artifact support for iOS 16

In this release, we've added new Biome artifacts that provide insight into a user's activity on their iOS device. These new artifacts retrieve data that were migrated to a new location and proprietary container in iOS 16. We've also added several new pattern of life activity artifacts that were discovered in the same area of the iOS file system.

Artifacts

Biome Application Focus | iOS: Added parsing support for Biome Application Focus.

Biome Application Install States | iOS: Added support for the Biome Application Install States artifact. [iOS 16]

Biome Application Launch | iOS: Added parsing support for Biome Application Launch.

Biome CarPlay Connections | iOS: Added parsing support for CarPlay Connections.

Biome Device Orientation States | iOS: Added parsing support for Biome Device Orientation States.

Biome Device Plugged-in States | iOS: Added parsing support for Biome Device Plugged-in States.

Biome Do Not Disturb Data | iOS: Added parsing support for Biome Do Not Disturb Data.

Biome Keybag Lock States | iOS: Added parsing support for Biome Keybag Locked States.

Biome Safari History | iOS: Added parsing support for Biome Safari History.

Biome Safari Page View | iOS: Added parsing support for Biome Safari Page View.

Biome Siri Execution | iOS: Added parsing support for Biome Siri Execution.

Biome Siri UI Usage | iOS: Added parsing support for Biome Siri UI Usage.

Biome User Activity | iOS: Added parsing support for Biome User Activity.

Connected Cars | iOS: Added parsing support for CarPlay Connected Cars.

Device Information | iOS: Updated parsing support to recover more device identification information.

EML(X) Files | macOS, Windows: Updating parsing support to reduce duplicated entries.

Facebook Messenger | iOS: Updated carving support to correctly recover the receiver name for one-on-one messages. [v392.0]

Instagram Direct Messages | iOS: Updated carving support to recover WAL (Write Ahead Log) data.

KnowledgeC Siri Intents | iOS: Added parsing support for KnowledgeC Siri Intents. [iOS 16]

Microsoft Teams | Windows: Updated support to include topic and space name.

Signal Stories | Android: Added support for Signal Stories. [v6.1.4]

Signal Stories | Android: Restored parsing support for Signal Stories. [v16.9.2]

Snapchat | iOS: Updated carving support for Snapchat Memories and Snapchat My Eyes Only to recover WAL (Write Ahead Log) data from the latest version. [v12.12]

Stored Credentials | Windows: Updated parsing support to recover more credentials from Windows 11.

TikTok Videos | iOS: Updated parsing support to reduce draft videos being recovered as duplicate hits, and added new fragments for supporting files, such as sounds and captions.

Various Microsoft and OpenOffice artifacts | Windows: Updated Microsoft Office artifacts to include the name Microsoft, and OpenOffice artifacts to include the name OpenOffice.

Cloud

When providing a password in AXIOM to acquire cloud data, the password will not be saved in the case files.

Processing

AXIOM now supports loading RAR5 images that have a CRC (Cyclic Redundancy Check). -AXP-1263

Case Information now includes picture and video categorization details.

Images or containers such as ZIP files loaded through the Files and Folders workflow will be processed as an image. -AXP-9317

Security - CVE-2021-24112: Patched a .NET vulnerability where a non-Windows system could accept a specially crafted request that could result in remote code execution.

Examining

When a chat preview is loading, a spinner now appears.

When you change the location of an export, you can now re-map the file location so that you can navigate to it from the Case exports / reports section on the case dashboard.

When you upload evidence to Magnet REVIEW, AXIOM Examine now saves the uploaded JSON file to the selected location on your computer so that you can view export summary information later.

You can now add keywords to portable cases.

Data enrichment and analytics

Improvements to the error messaging for Hash Sets Manager hash sets in AXIOM Process.

Bug fixes

Previously, AXIOM Process may have crashed when the search started. -AXP-9054 -ENGN-662

Previously, Process may have failed running PhotoDNA hashing on pictures that exceed 2GB. -AXP-9892 -ENGN-480

Previously, Process would crash if the provided value for Case Details - Folder name contained a trailing space. -ENGN-238

Security - CVE-2021-24112: Patched a .NET vulnerability where a non-Windows system could accept a specially crafted request that could result in remote code execution. -ENGN-444

Keyword searches were taking a long time to complete. -EXM-1885

Sometimes, the list of recent date / time filters was hiding the OK and Cancel buttons. -EXM-1843

The case export / report section on the case dashboard was not displaying the date / time in the same format as the system settings. -EXM-1789

When uploading evidence to Magnet REVIEW, the upload process would take up too much memory and the upload would take a long time. -EXM-1805

Duplicated hits were being acquired from Microsoft Teams Messages. -CARS-15

Microsoft Teams Messages | Windows: Updated support to include the Recipient. -CARS-17

User information wasn't being sufficiently recovered from Android Telegram Users. [v9.12] -MA-4682 -MARS-829

Known and non-relevant hashes uploaded to Hash Sets Manager in upper case were not matched correctly in AXIOM. -DEA-2935

Previously, AXIOM Process could crash if there was insufficient disk space when acquiring an Azure virtual drive or if the connection was unexpectedly closed. -CAO-4039 -CA-325

Previously, if Instagram Public acquisition is interrupted Process would crash without any artifacts. Now, an error is logged and partial hits are captured. -CA-982

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.