Artifact updates

Android

Discord Channels and Servers NEW

DJI Flight Logs NEW

iOS

DJI Flight Logs NEW

iMessage/SMS/MMS

Spotlight Searches NEW

Telegram Messages and Users

Significant updates to iOS 17 data recovery

We've updated existing artifacts and added new artifacts to recover important data from SEGB v2 databases in iOS 17. These updates include:

The new Spotlight Searches artifact allows you to see which apps and information a user was searching for on their phone.
Recover audio iMessage transcripts, even though the audio messages themselves are deleted from the user's device after a few minutes.

Artifact timestamps now include milliseconds

For all artifacts with integer timestamp data acquired in AXIOM Process 7.8.0 or later, timestamps are now accurate to the millisecond. On a target's device, certain system events might occur multiple times per second. With this update, AXIOM can accurately place those events on a timeline and help you to better understand a user's activity.

Artifacts

Discord Channels | Android: Added parsing support for Discord Channels. [v201.13]
Discord Servers | Android: Added parsing support for Discord Servers. [v201.13]
iMessage/SMS/MMS | iOS: Updated parsing support to recover the transcript for audio messages.
Spotlight Searches | iOS: Added parsing and carving support for Spotlight Searches. [iOS 17]
Telegram Messages | iOS: Updated parsing support to recover system messages.
Telegram Users | iOS: Added carving support for Telegram Users.
DJI Flight Logs | Android, iOS: Added parsing support for DJI Log Files. To recover data from this artifact, AXIOM must make a call to the DJI server. To learn more, sign in to the Support Portal and read the article Decrypt DJI Flight Logs.

Cloud

Added date support for Apple Warrant Return Contact cards (.vcfs).
Deleted message recovery is now supported in Slack archives (JSON).

Processing

AXIOM now acquires timestamp data accurate to the millisecond. This update applies to all evidence acquired in AXIOM Process 7.8.0 or later, for all artifacts with integer timestamp data.

Examining

Sometimes, building the media explorer or creating a VICS export would fail when attempting either action in a case with a large amount of media.

Bug fixes

When using AXIOM Examine in a language other than English and applying the date/time filter, the date/time data was formatted incorrectly. -EXM-3040
In the Telegram Messages for iOS artifact, secret messages were being incorrectly reported as sent messages. -MARS-1723
Recorded Date/Time data for iOS User Notification Events was being reported incorrectly. -MARS-1689
Sometimes, the sender field for Signal Messages - iOS wasn't being populated. -MARS-1637
When data from Android Discord Messages v201+ were recovered, some messages were missing. -MARS-1751
Previously, AXIOM was unable to acquire iCloud backups. -CA-1689
Previously, O365 Audit log acquisitions may have failed (timed out). -CA-1592

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.