Upgrade note: This update is being released to address an issue that was preventing access to the Email Explorer in the AXIOM 7.10.0 release.

Artifact updates

Android

Audio

Call Logs

Chrome Web Visits

Digital Wellbeing Events

Facebook Messenger Messages

Various Chrome artifacts

Chrome Current Sessions
Current Tabs
Last Sessions
Last Tabs

WeChat

iOS

Apple Mail

Audio

Chrome Cookies

Chrome Web Visits

Instagram Direct Messages

Journals NEW

Various Edge Chromium artifacts NEW

Edge Chromium Current Session
Current Tabs
Last Sessions
Last Tabs

Various Telegram artifacts

Telegram Chats
Messages
Users artifacts

Voice Mail NEW

Linux

Chrome Web Visits

macOS

Chrome Cookies

Chrome Web Visits

Various Edge Chromium artifacts NEW

Edge Chromium Current Session
Current Tabs
Last Sessions
Last Tabs

Windows

Chrome Cookies

Chrome Web Visits

Chrome Logins

Various Edge Chromium artifacts NEW

Edge Chromium Current Session
Current Tabs
Last Sessions
Last Tabs

New features and licensing options

New AXIOM term license packages can offer access to new features, add-ons, and exclusive features once only available to AXIOM Cyber customers:

Animated map routes NEW | ALL TERM LICENSES
Email explorer | ADVANCED, PREMIER, CYBER
Access to Magnet OUTRIDER | PREMIER
Access to MAGNET Exhibit Builder NEW | PREMIER

See the AXIOM 7.10 User Guide topic, Available features for more information about the available features by license type.

Follow a user’s movements with animated map routes

In AXIOM Examine, you can now use route view to follow the movement of target users, for example to confirm if a suspect and victim crossed paths. Routes generate a series of possible paths based on artifacts with geographical data from a particular evidence source. Using route view, you can:

Generate routes based on a particular date and time, or other available filters in AXIOM Examine.
Watch an animated playback of up to five routes simultaneously.
Record and export the route playback to share as an MP4 file.

Artifacts

Apple Mail | iOS: Updated parsing support to remove duplicated hits and to correctly display EMLX files and their attachments.
Audio | Android, iOS: Updated carving support to remove false positives for AMR files.
Call Logs | Android: Updated carving support to recover WAL files from Android 9 devices.
Call Logs | iOS: Updated carving support to recover more WAL data from iOS 13 and later.
Chrome Cookies | iOS, macOS, Windows: Updated parsing support to decrypt cookie data.
Chrome Logins | Windows: Updated support to recover more accurate user login data.
Digital Wellbeing Events | Android: Updated parsing support.
Facebook Messenger Messages | Android: Updated carving support to recover WAL files.
Facebook Messenger Messages | Android: Updated parsing support to recover and provide previews for video attachments.[v333 and later]
Journals | iOS: Added parsing support for the Journals application.
Various Chrome artifacts | Android: Updated parsing support to recover Android data for Chrome Current Sessions, Current Tabs, Last Sessions, and Last Tabs.
Various Edge Chromium artifacts | iOS, macOS, Windows: Added parsing support for Edge Chromium Current Session, Current Tabs, Last Sessions, and Last Tabs.
Various Telegram artifacts | iOS: Updated parsing support to recover system messages from Telegram Chats, Messages, and Users artifacts.
Voice Mail | iOS: Added parsing support for Voice Mail recovered from iOS 17 devices.
WeChat | Android: Updated carved hits weren't being recovered. -MARS-1461
Instagram Direct Messages | iOS: Updated parsing plist data. -MARS-1460
Chrome Web Visits | iOS, macOS, Windows, Linux: Updated to remove inaccurate title. -MARS-1909

Cloud

AXIOM now supports the use of Session credentials and External IDs for AWS acquisitions.

Examining

Using Route view in the Artifacts explorer, you can now view a target's movements on an animated map route.
In addition to AXIOM Cyber users, the Email explorer is now available to AXIOM users with Advanced and Premier term licenses.

Data enrichment and analytics

We've updated Magnet.AI categorization to use the latest Thorn CSAM models, which provide greater accuracy in the detection of illegal content. This update includes fewer false positives in problem areas, and improved recall precision.

Bug fixes

Previously, AXIOM Process may have cancelled the scan without user interaction. -ENGN-10595
Previously, AXIOM Process may have closed while scanning a virtual machine image. -ENGN-10876
Data in the SQLite viewer in AXIOM Examine was being truncated. -EXM-2577
Portable cases were experiencing errors while checking for updates. -AXE-8698 -EXM-590
When creating an Excel report from a portable case, Hangul file attachments were not being exported. -EXM-3184
If a relative date/time filter was applied before the timeline was built, that filter wouldn't be applied in the timeline explorer. -EXM-2726
Sometimes, viewing the timeline explorer caused errors or the data would disappear from AXIOM Examine. -EXM-2487
HTML exports would fail if they contained a file with the # symbol in the file name. -EXM-2675
Apple Mail EMLX files and their attachments weren't being displayed correctly. -MARS-1962
Some carved hits weren't being recovered from WeChat Messages for Android. -MARS-1461
Some plist blob data wasn't being acquired for Instagram Direct Messages. -MARS-1460
The title fragment for Chrome Web Visits artifacts wasn't accurate and has been removed. -MARS-1909
Additional language localization support for Microsoft cloud acquisitions. -CA-688
Previously, a Google warrant return containing a corrupted .zip could cause AXIOM Process to crash. -CA-1646
Previously, decryption of iCloud backup acquisitions of iOS 17 devices may have failed. -CA-1670
Previously, Facebook Download Your Information evidence sources may not have recovered all messages. -CA-1704
Previously, Google Connected Apps could not be acquired. -CA-1334

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.