Eufy Cached Media | Android
Signal Groups | iOS
WeChat Accounts | Android
Samsung Rubin Commute Logs | Android: Added support for Samsung Customization Service Location Logs.
WhatsApp | Android, iOS: Added parsing support for WhatsApp Calls.

Eufy | iOS: Updated support to recover more user information.
iOS Home Screen Items | iOS: Updated parsing functionality to address changes made to the home screen items on iOS 17+ devices.
Facebook | All: Updated parsing support to include Facebook Download Your Data (DYD) exports in HTML format.
Slack | iOS: Updated parsing functionality for new schema (Accounts, Channel Messages, Channels, Direct Messages, Users).
Chrome, Edge, 360 Safe Browser, Opera | iOS (APFS): Updated parsing for the each brower's respective Cache Records.

Magnet Axiom now supports Facebook Download Your Data (DYD) exports in HTML format.
You can now acquire Facebook Private timeline Image Album and More Text.
Axiom Process now acquires Facebook Public Timeline.
Axiom Process now supports the acquisition of Google Chat Direct Messages and Google Spaces.

Axiom Examine remains open after displaying the media categorization prompt to prevent unintended closures.
Keyword searching is now supported in MFT parsing. Cyber
Right-click and choose to collapse items in the Filesystem explorer to optimize your workflow.
You can now right-click on location data to view it with external sources like Google Maps directly from Magnet Axiom.
Discord Warrant Return Process information is now formated based on header to accurately retrieve and display your data.
*From the Case Dashboard, you can now manage and generate new tags for keyword search hits. Additionally, you have the option to exclude any hits from the keyword search when exporting your case.

Axiom Process may have crashed while parsing dates on files within a .zip file. -ENGN-11620
Previously, empty devices were acquired, causing crashes or failures where null values were present. -ENGN-11003
When selecting individual files to include in an image acquisition, Axiom Process would fail to include the selected files in the image. -ENGN-11206
An Android device may not be selectable as an evidence source during mobile acquisition if the iSerial property has been modified. This is to prevent an attacker from leveraging a command injection vulnerability. -ENGN-11954
Facebook .html previews would not appear with proper website styling. -EXM-3717
Previously, column filters would not reset correctly after navigating through related artifacts. -EXM-3492
Selecting the Mobile View dropdown filter would cancel out any changes made to the Evidence dropdown filter, and vice versa. -EXM-3680
The Translation Module previously only functioned on the first opened instance of Examine. -EXM-3801
Security - CVE-2024-4741: Addressed a vulnerability in OpenSSL affecting version 1.1.1. -IL-606
Acquiring WhatsApp messages via QR code would previously result in an unresponsive screen. -CA-2172
Discord Warrant Return timestamps previously showed the incorrect date and time. -CLA-35
Gmail Emails previously displayed inconsistent sender and recipient information. -MARS-2056
Incorrect attachments in Android Messages would display in the preview. -MARS-2351
Multiple Data tags were previously combined into one when parsing Windows Event Logs, resulting in incorrect XML. -CARS-946
Previously, certain messages from iMessage macOS databases were not being parsed correctly. -CARS-722
Previously, the Options button under the Edge artifact would not yield any prompts. -CARS-960
Axiom may have produced an error when processing HTML messages from a Facebook Download Your Data evidence collection. -CA-1318
Previously, Axiom Process would become non-responsive when performing a WhatsApp QR Code acquisition. -CA-2103
While performing a Box.com acquisition, the process may have timed out. -CA-254
Axiom Examine may have crashed when opening an existing case. -EXM-3911
Opening a case using a UNC path (Example, \\networklocation\mycase.mfdb) would result in the artifacts not populating in Axiom Examine. -EXM-3907
Pins in the World Map View were duplicated when navigating to the view or resizing the Details pane. -EXM-3857
Previously, stack details could not be viewed in Media Explorer when stacked by PhotoDNA, resulting in inconsistencies with stack behavior. -EXM-3785
In some instances, Axiom Process would only acquire the first page of Facebook Public Activity timeline posts. -CA-2199
Previously, Axiom was unable to acquire Facebook Public activity. -CA-2269
Previously, iCloud Drive acquisition may have failed with a global session error. -CA-2175
Previously, Axiom was unable to acquire Timeline, Friends, or Profile for Facebook User account. -CA-1117
Previously, some Facebook Private timeline status values may have been cropped. -CA-2179

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.

Featured artifacts

Acquire Google Chat

View location data with Google Maps