Upgrade note: This update is being released to address an issue that was causing crashes in the AXIOM Cyber 7.9.0 release.

Artifact updates

Android

Aloha Browser Autofill Profiles

Aloha Browser Bookmarks

Aloha Browser History

DuckDuckGo Bookmarks

Session Communities NEW

Session Groups NEW

Session Messages NEW

Session Users NEW

Snapchat Messages

Telegram Messages

Telegram Users

Videos

Windows

User Accounts

Videos

iOS

Apple Mail

Biome Safari Page View

Biome Siri Execution

Biome Siri UI Usage

Biome User Activity

Device Information

Facebook Messenger

iCloud Local Files

iMessage/SMS/MMS

Installed Applications

Session Communities NEW

Session Groups NEW

Session Messages NEW

Session Users NEW

Snapchat

Telegram Messages

TikTok Media

Videos

WebKit Browser Web History (Carved)

Automatic image creation when loading evidence from Files and Folders

AXIOM will automatically create an image (.zip) of selected local Files and Folders. Manage and share the case while maintaing a connection to a static evidence source image. Automatic image creation is available for the following sources:

Computer
Mobile
Vehicle

Add custom fields to exports

When you create a portable case or PDF report, you can now add custom fields that will appear along with the default case details. Use these fields to include information that is important to your investigation, such as an outside agency case number, lab case number, reviewing examiner, and more.

Create a report of evidence source details

From the case dashboard, you can now create a PDF report of summary information about an evidence source. Depending on the device type, this report can include device details, wallpaper, user accounts, and an artifact type summary.

Artifacts

Aloha Browser Autofill Profiles, Aloha Browser Bookmarks, Aloha Browser History | Android: Updated parsing support to recover missing data. [v4.1.4]
Biome Safari Page View, Biome Siri Execution, Biome Siri UI Usage, Biome User Activity | iOS: Updated parsing support to recover data from iOS 17.
DuckDuckGo Bookmarks | Android: Updated parsing support to recover data from v5.153.
Facebook Messenger | iOS: Updated carving support to recover the group name. [v408.1] NEW
iCloud Local Files | iOS: Added parsing support to recover iCloud Local Files from iOS devices.
iMessage/SMS/MMS | iOS: Updated the Attachments fragment to Attachment Path, to more accurately reflect the recovered data.
Installed Applications | iOS: Updated parsing support to recover application icons.
Session Communities | Android, iOS: Added parsing support for Session Communities.
Session Groups | Android, iOS: Added parsing support for Session Groups.
Session Messages | Android, iOS: Added parsing support for Session Messages.
Session Users | Android, iOS: Added parsing support for Session Users.
Snapchat Messages | Android: Updated carving support for Snapchat Messages. [v12.68.0.26, v12.20.0.33]
Telegram Messages | Android: Updated parsing support to recover the correct message type.
Telegram Messages | iOS: Updated parsing support to indicate if a message is a secret chat.
Telegram Users | Android: Updated parsing support.
User Accounts | Windows: Updated parsing support to recover whether or not Auto Logon was enabled by the user.
Various artifacts: Minor performance improvements during processing.
Videos | All platforms: Updated parsing support to recover higher quality, dynamic video frames.

Cloud

AXIOM now supports the use of alias email address when acquiring Microsoft 365 and Teams cloud platforms.
The Case folder now contains a Cloud Data Source Selection Summary.txt, detailing the user selected cloud data sources.

Processing

AXIOM will now create an image (.zip) when adding evidence using the Files and Folders workflow for local files.
exFAT source evidence items will now capture: Cluster (Cluster number), Cluster count, Physical location (Offset where the file begins), and Physical sector.
Improved linking to evidence sources that reference 8.3 file paths on Windows filesystems. NEW

Examining

On the case dashboard, portable cases now include a link to Making a Case, a free online training course for investigators and other portable case stakeholders.
You can now add custom fields to PDF reports and portable cases.
You can now create a PDF report of evidence source summary information, which can include device details, wallpaper, user accounts, and an artifact type summary.
When exporting to a load file, you can now choose to export related items for chat artifacts.

Data enrichment and analytics

You can now enable Enhanced picture categorization of video to improve Magnet.AI picture categorization potential. For more information, log in to the Support Portal to read Video thumbnail collage creation process.

Bug fixes

In cases with large amounts of media evidence, performance issues and crashes sometimes occurred when hovering over media to view a preview. -EXM-2934
In some portable cases, the timeline explorer couldn't be built. -EXM-3061
Sometimes, portable cases were missing data and couldn't locate the source if the original source image was moved to a different location. -EXM-2827
Sometimes, the SQLite viewer didn't include the WAL file for a database. -EXM-2568
When saving files and folders as a ZIP file, the timestamps weren't being preserved. -EXM-3181
Some Apple Mail evidence was being duplicated. -MARS-870
Some carved hits weren't being recovered from WeChat Messages for Android. -MARS-1461 NEW
Some iOS TikTok metadata files were being incorrectly recovered as TikTok media files. -MARS-1152
Sometimes, temp files from Snapchat artifact recovery weren't being removed from the AXIOM case folder. -MARS-1508
Sometimes, the title and URL didn't match for Webkit Browser Web History (Carved) artifacts. -MARS-1706
Sometimes, WhatsApp artifacts were being attributed to the wrong user. -MARS-1818
Previously, AXIOM was unable to acquire Google passwords. -CA-1732
Previously, conversations from a WhatsApp QR Code acquisition would not be displayed in Examine if the conversation name was empty. -CA-1733
Previously, conversations in a Google Chat Takeout were not displayed in a thread format. -CA-1638
Previously, O365 Audit log acquisitions may have failed (timed out). -CA-1592
Previously, WhatsApp QR code acquisitions may not have included the message type for a conversation. -CA-549
Resolved chat threading for Snapchat Warrant returns with an updated format. -CA-1168
Updated the Chrome extension to resolve WhatsApp Google Drive backup acquisitions issues. -CA-1729

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.