Artifact updates

Android

Device Information NEW

Digital Wellbeing Events

Facebook Messenger Groups

Facebook Messenger Users Contacted

MMS/SMS

Samsung Device Health Services CPU Data NEW

Samsung Device Health Services Network Stats NEW

Samsung Positioning Path History NEW

Snapchat Group Members

WhatsApp Chats

WhatsApp Messages

All platforms

PDF Documents

Pictures

Videos

iOS

Apple Health Distance

Apple Health Floors

Apple Health Heart Rate

Apple Health Steps

Apple Health Workout NEW

Device Information

Dropbox

Snapchat Group Members

Windows

Autorun Items

Email Attachments

Installed Programs

Outlook Emails

Startup Items

Windows Notification Center

View device wallpapers on the evidence source dashboard

You can now view a device's lock screen and home screen wallpapers on the device's evidence source dashboard in AXIOM Examine.

Enhancements to thumbnail view

We've made the following enhancements to the thumbnail view in the Artifacts explorer:

Hover your mouse over a video thumbnail to view a preview of the video.
Sort multiple artifacts at a time by MD5 hash or evidence source.

Remove keywords from cases

You can now remove keywords and keyword lists from your AXIOM cases.

Export tags and comments to a JSON file

AXIOM Examine has a new JSON export type that allows you to export tags and comments for ingestion into a third-party tool.

Artifacts

Apple Health Distance, Floors, Heart Rate, and Steps | iOS: Updated parsing support to include originating app details.
Apple Health Workout | iOS: Added support for Apple Health Workout.
Autorun Items, Installed Programs, Startup Items | Windows: Updated parsing support to include digital signatures where applicable.
Autorun Items, Startup Items | Windows: Updated parsing support to recover the executed application's digital signatures and their hashes.
Device Information | Android: Updated parsing support to include multiple users on a device.
Device Information | Android: Updated parsing support to recover more data from additional files.
Device Information | iOS: Updated parsing to recover current home screen and lock screen.
Digital Wellbeing Events | Android: Updated parsing to recover more accurate event type data.
Dropbox | iOS: Updated parsing and carving support to recover Dropbox data that was missing. [v302.2]
Facebook Messenger Groups | Android: Updated parsing and carving to improve the recovery of Sender and Participant user names from a chat.
Facebook Messenger Groups | Android: Updated parsing support to recover data that was missing. [v410.0.0.17]
Facebook Messenger Users Contacted | Android: Updated parsing support to recover data that was missing in previous versions of AXIOM. [Facebook v410.0.0.17, Android 13]
MMS/SMS | Android: Updated carving support to properly deduplicate data from multiple sources. [Android 13]
Outlook Emails | Windows: PST exports now include Read status data for Outlook Emails.
Outlook Emails | Windows: Updated parsing support to recover data about whether or not an email was read or opened.
Outlook Emails, Email Attachments | Windows: Updated support to include HEIC previews in AXIOM Examine.
PDF Documents | All platforms: Updated parsing support to correctly recover metadata.
Samsung Device Health Services CPU Data | Android: Added parsing support.
Samsung Device Health Services Network Stats | Android: Added parsing support.
Samsung Positioning Path History | Android: Added parsing and carving support.
Snapchat Group Members | Android, iOS: Updated parsing and carving to recover user ID.
Videos | All platforms: Improved thumbnail creation using video frames for FFMPEG videos.
Videos | All platforms: Updated parsing support to recover thumbnails for large video files.
WhatsApp Chats, WhatsApp Messages | Android: Updated support to recovery more data from encrypted sources.
Windows Notification Center | Windows: Added carving support.

Processing

A note will be included in the scan summary if hash matched artifacts were found but excluded from the Artifacts explorer due to being outside of the date range filter.

Examining

In the Thumbnail view of the Artifacts explorer, you can now hover your mouse over a video thumbnail to preview the video.
When creating exports in AXIOM Examine, you can now select items to exclude.
When viewing multiple artifacts at a time in Thumbnail view, you can now sort by evidence source.
When viewing multiple artifacts at a time in Thumbnail view, you can now sort by MD5 hash.
You can now create a JSON export that contains tags and comments to import into a third-party tool.
You can now filter by media type in the Media explorer left navigation pane.
You can now remove keywords and keyword lists from your cases.
You can now view a device's lock screen and home screen wallpapers on the evidence source dashboard.

Bug fixes

Previously, AXIOM Process may have incorrectly determined a Cellebrite UFD(x) image was corrupted. -ENGN-1557
Sometimes, picture categories marked as 'Illegal' wouldn't be blurred in HTML reports. -EXM-2393
Sometimes, when categorizing media quickly, the categories weren't being applied to media. -EXM-2381
Timeline evidence couldn't be filtered by evidence source. -EXM-2443
When merging a portable case that contained a new tag that was identical to a tag in the original case, the original case would become unusable. -EXM-1906
When viewing multiple artifacts at once in the Artifacts explorer, data wouldn't appear if the case was auto-launched after processing completed. -EXM-2395
When merging a portable case, if there were tag merge conflicts, the “Next” button in the merging dialog was unavailable until an action was selected for all tags. -EXM-1939
In the Timeline explorer, timeline categories weren't being applied to iOS Snapchat Stories. -MARS-1260
The user receiving a message was being incorrectly labeled as the sender for Android Signal messages. [v6.20.4] -MARS-1256
WebP picture carving was taking a significant amount of time. -COMP-1692 -CARS-464
Sometimes, hash sets from Hash Sets Manager would fail to load. -DEA-3088
Evidence couldn't be added from the Cloud Insights Dashboard. -CA-1369
Previously, AXIOM could appear non responsive while acquiring large Google Drive accounts. -CA-207
Previously, AXIOM was unable to acquire Google timeline locations. -CA-403
Some timeline data was missing from Office365 Audit Logs. Additionally, the artifact has been renamed to Cloud Microsoft Unified Audit Logs. -CA-169

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.