Artifacts
- Best Secret Folder | iOS: Added support for configuration data, including password setup and hidden media folder locations. [6.7]
- Brave | iOS: Added support for bookmarks, favIcons, and web and tab history. [1.9.1]
- Ecosia | iOS: Added support for bookmarks, web history, and tabs. [4.0.4]
- Life 360 | Android: Added support for user accounts, contacts, single/group chats, and locations. [18.6.3]
- Life 360 | iOS: Added support for user accounts, contacts, single/group chats, and locations. [18.6.3]
- Live Photos | iOS: Added support for recovering the .mov, .jpeg, and .heic files that can be associated with live photos. [iOS 9 to 12]
- Safari | iOS: Saved credit card information that’s recovered in Safari will now be extracted into its own Refined Result.
- Signal | iOS: Added support to recover encrypted data from Signal, including conversations, calls, and attachments. [2.33, 2.35, 2.38]
- Signal | iOS: Updated parsing support to recover contact information. [2.33 to 2.38]
- Skype Lite | Android: Added carving support for messages, group conversations, contacts, and user accounts. [1.73]
- TamTam Messenger | Android: Added support for chats, contacts, and messages. [2.5.0]
- The Google Searches refined result was displaying false hits on some Google URLs which weren’t from searches.
- Tinder | Android: Updated support for accounts, matches, and messages. [10.15.0]
- Whale Browser | iOS: Added support for autofill, bookmarks, favIcons, logins, search terms, web history, and web visits. [0.10.1]
- WhatsApp | iOS: Updated support for “delivered” and “read” status messages. [2.16 and later]
- Windows 10 Timeline | Windows 10: Updated support to help examiners see a timeline of a user’s activity.
Bug fixes
- Contact cards were not being recovered from carved WhatsApp Chat artifacts. -MA-372
- In MBOX Email artifacts, the subject line would display an incorrect character encoding. -COMP-65
- In some versions of Signal on iOS the source and location for the “Group Name” was not present for every hit where a group name was recovered. -MA-437
- In the artifact explorer of AXIOM Examine, the file offset for a carved video didn’t link to the correct location in the file. -COMP-68
- Signal artifacts were not being recovered for GreyKey images that were processed as an Image in Magnet AXIOM. -MA-445
- The AmCache Program Entries artifact was displaying an invalid SHA1 Hash. This attribute has been removed. -COMP-18
- WhatsApp geolocation messages were not including latitude/longitude and location information. -MA-42
