Release Notes

Magnet AXIOM 6.2.0.31740 May 31, 2022

Artifact updates

Android

Android Call Logs

Android Contacts

Android Messages

Android SMS/MMS

Textfree Messages / Calls

iVE

Files

All Platforms

Audio

Email Attachments Refined Result

Pictures

User Accounts Refined Result NEW

Video

iOS

Apple Mail

Apple Maps Searches

Apple Maps Trips

Apple Notes

iOS iMessage/SMS/MMS - App Intents NEW

iOS Maps

iOS Wi-Fi Profiles

Signal Messages

Signal Group Members

SIM Card Activity

Snapchat Cached Videos

Snapchat Chat Messages

Wallet Transactions

Wallet Payment Cards

Cloud

Cloud MBOX Emails

Cloud WhatsApp Chats

macOS

Apple Keychain

iCloud

iCloud Devices NEW

iCloud Server Files NEW

Windows

User Accounts - Windows NEW

Operating System Information

Apple Mail improvements

Artifacts

• Android Call Logs | Android: Updated carving support for Android Call Logs. [Android 12]
• Android Contacts | Android: Updated parsing and carving support for Android Contacts. [Android 12]
• Android Messages | Android: Updated parsing and carving support as well as updated support for previewing attachments in the chat thread. [Android 12]
• Android SMS/MMS | Android: Updated support for previewing attachments in the chat thread. [Android 12]
• Apple Keychain | macOS: Updated logging to indicate which password was used to decrypt the keychain successfully or which password did not work for decryption.
• Apple Mail | iOS: Improvements to previewing emails so that marked up emails appear as they would on the phone and combined Apple Mail and Apple Mail Fragment into a single artifact to make reviewing the evidence easier.
• Apple Maps | iOS: Updated support for recovering address and search term information for Apple Maps Searches and Apple Maps Trips. [iOS 15]
• Apple Notes | iOS: Updated support for recovering attachments and encrypted picture attachments from secured Apple Notes and updated support for recovering Created Date/Time. [iOS 15]
• Apple Notes | iOS: When you include the Apple Keychain when processing an iOS image, the product can decrypt secure Apple Notes from devices configured with biometric authentication. [iOS 15.4.1]
• Apple Wallet | iOS: Updated support for recovering Wallet Transactions and Wallet Payment Cards. [iOS 15]
• Cloud WhatsApp Chats | Android and iOS: Updated support for WhatsApp chats obtained from the cloud.
• Email Attachments | Refined Result: Empty email attachments are no longer reported in the Email Attachments refined result.
• iCloud Devices | macOS: Added support for recovering a list of devices that have access to the iCloud.
• iCloud Server Files | macOS: Added support for recovering information about files that have been imported from the local computer or synced remotely from the iCloud Drive folder on a macOS machine.
• iCloud | macOS: Updated the application name of iCloud Local Files to iCloud.
• iOS iMessage/SMS/MMS - App Intents | iOS: Information recovered about application intents can now be found in its own artifact. Additionally, updated support to recover more iOS iMessage/SMS/MMS - App Intents hits from the KnowledgeC database.
• iOS Maps | iOS: Updated support for the latest version, including support for recovering the map tile image and accessed date/time. [iOS 15]
• iOS Wi-Fi Profiles | iOS: Updated support for recovering iOS Wi-Fi Profiles from the latest version. [iOS 15]
• iVe | Vehicle: Updated instances of "phone" to "devices" in the Artifact Reference guide to more clearly indicate that other types of devices could be connected to the vehicle.
• Operating System Information | Windows: Added support for recovering information about the domain that the computer is currently connected to.
• Operating System Information | Windows: Updated support for correctly recovering product name information for computers running Windows 11.
• Signal | iOS: Updated support for recovering messages and group members. [5.29.0]
• SIM Card Activity | iOS: Updated carving support for SIM Card Activity. [iOS 15]
• Snapchat | iOS: Updated support for recovering attachments from deleted Snapchat Chat Messages and renamed Snapchat Received Videos to Snapchat Cached Videos.
• Textfree | Android: Updated support for recovering attachment files. [8.76+]
• User Accounts | Refined Result: Added a new refined result that contains all of the local user's application accounts that are found on the system.
• User Accounts - Windows | Windows and Windows Phone: Updated the name of the User Accounts artifact to User Accounts - Windows.

Cloud

• You can now acquire the last three months' of WhatsApp messages and conversations using the QR code method.

Processing

• SQLite errors and exceptions for the attachments database will now be logged in the log.txt file.

Examining

• Snapchat messages are now readable in Dark mode as they no longer appear with a transparent background.
• The appearance of the AXIOM Examine Settings window has been improved to allow for more user-friendly navigation.
• When you export evidence to a portable case, AXIOM Examine now creates an .exe file instead of a .bat file to open the portable case.
• When you perform an advanced keyword search, matching keywords in the results are now highlighted.
• Using Magnet.AI categorization, you can now search for pictures that contain handwriting.

Bug fixes

• Korean text was not being rendered correctly in document previews. If you copied and pasted this text and used it to search your evidence, the results would be found but not highlighted in the document. -AXE-10374
• .m4a and .m4r files were incorrectly categorized as Video artifacts instead of Audio artifacts. -COMP-1729
• Connections for some iVe artifacts did not build properly in the Connections explorer. -MA-4208
• Improvements to the Cloud MBOX Emails to prevent redundant carving and duplicate hits. -COMP-1786

Known issues

• To search for information about known issues, visit the knowledge base at support.magnetforensics.com.