Discord Local Storage | Computer
Input Method Editor | iOS, macOS
System Logs | Linux
Linux Logs - auditd | Redhat
Linux Logs - auditd | Ubuntu
Samsung Customization Service - Motion Logs | Android
Samsung Customization Service - Location Logs | Android
SMS/MMS/iMessage | iOS: Added carving support to recover sender and recipient nickname fragments.
WhatsApp | iOS, Android: Added parsing support for WhatsApp Calls.
Session Messages | iOS: Added parsing support for iOS Session Messages.

Android Messages | Android: Updated parsing support to improve attachment handling and preserve thumbnails.
Slack | iOS: Updated parsing functionality for new schema. (Accounts, Channel Messages, Channels, Direct Messages, Users).
Facebook Account Actions (Warrant Return) | Updated processing to support the new Facebook Warrant format.
Facebook Friend Requests (Warrant Return) | Updated processing to support the new Facebook Warrant format.
Facebook Friends (Warrant Return) | Updated processing to support the new Facebook Warrant format.
Facebook Messenger Messages (Warrant Return) | Updated processing to support the new Facebook Warrant format.
Facebook Wallpost (Warrant Return) | Updated processing to support the new Facebook Warrant format.
Facebook Messenger End-to-End Encrypted Chat Attachments | Android: Updated parsing support to include the recovery of attachments, ensuring consistent handling of encrypted messages and attachments.
KakaoTalk | Android: Updated parsing support for: KakaoTalk Chat Rooms, KakaoTalk Calls, and KakaoTalk Messages.
KakaoTalk | iOS : Updated to support KakaoTalk version 9.5.2.
LINE | Android: Updated parsing support for LINE Contacts.
Linux Logs - auditd | Redhat, Ubuntu
Windows Event Log | Updated parsing to recover missing hits.
SMS/MMS/iMessage | iOS: Added carving support to recover sender and recipient nickname fragments.
SMS/MMS/iMessage | iOS: Consolidated parsing support into a single hunter to improve data recovery.
TeleGuard Messages | Android: Updated parsing support to recover multiple attachments in a single TeleGuard message.
WhatsApp Messages | iOS: Updated parsing support to ensure that iCloud Backup data is correctly extracted during the acquisition.
WhatsApp Messages | iOS: Improved parsing and carving support to resolve inconsistencies in WhatsApp sender and recipient data.
WhatsApp | Updated parsing to remove duplicate hits.

Magnet Axiom is now able to acquire the following Facebook Messenger message types: Text, Emoji, Sticker, Images, and Files. Hits for video and audio messages will include a place holder value, such as [Video clip] or [Audio clip], but no media is included.
Magnet Axiom can now acquire Facebook Private Timeline comments and Friends.
Magnet Axiom can now acquire Facebook Public Friends.
Magnet Axiom can now acquire Facebook Public Profile.

Magnet Axiom Cyber can now use SIGMA rules to identify TTPs using the MITRE® ATT&CK framework.Cyber
Reduced time to load and display the contents of .zip archives within images.

You can now open a location in an external application from the World Map preview window.
You can now right-click a file and select "Jump to Folder" in the Filesystem Explorer.

In the previous version, Axiom Process may have missed recovering some Discord Chat data. -CARS-1035
Previously, Magnet Axiom was unable to process Facebook Warrant Returns due to a change in the Facebook Warrant Return format. -CLA-48
Previously, UTFT8 encoding was not supported for Google Warrant returns. -CLA-43
Previously, Instagram Warrant returns may have produced Facebook Warrant hits. -CLA-76
In some instances, Axiom Process would only acquire the first page of Facebook Public Activity timeline posts. -CA-2199
Previously, acquiring a large collection of iCloud Photos may have failed stating an invalid session. -CA-2217
Previously, acquiring iMessages may have failed stating an existing connection was forcibly closed by the remote host. -CA-2246
Previously, an iCloud acquisition may have failed with an 500 Internal Server Error while attempting to acquire a metadata file. -CA-1994
Previously, newer encrypted Mega account acquisitions may have failed silently. -CA-1879
Previously, iCloud Drive acquisition may have failed with a global session error. -CA-2175
Previously, some Facebook Timeline posts would not display correctly in Axiom Examine. -CA-2179
Magnet Axiom can now acquire Facebook Private Profile. -CA-2332

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.

Featured artifacts

Identify TTPs with MITRE ATT&CK (Windows)

Input Method Editor (IME) iOS, macOS

Artifact Reference Guide included with portable case