Artifacts
- Application Permissions | Android: Added parsing and carving support to retrieve permissions used by each package and indicate what permissions have been granted by the user and requested by the application.
- Application Permissions | iOS and macOS: Updated the naming conventions for the Application Permissions artifact to indicate "macOS, iOS" rather than "AppleOS".
- Artifact categories: The artifact categories have undergone some changes this release, so some items might not appear where you'd expect when you're looking for an artifact in Magnet IEF, Report Viewer, and the Artifact Reference.
- Chat is now Communication
- Email is now Email & Calendar
- Encryption is now Encryption & Credentials
- Mobile is now Application Usage
- Transportation & Travel is now Location & Travel
- Internet of Things is now Connected Devices
- Many of the artifacts previously found under Operating System, Mobile, and Cloud have been relocated to more appropriate categories
- Burner Messages | Android and iOS: Updated the Burner artifact to display the local users’ names instead of phone numbers for messages.
- Chrome | iOS: Updated support for recovering last tabs and current tabs. [87.4280.163]
- Facebook Messenger | Android and iOS: Updated the Facebook Messenger Messages chat threading to show sender names before sender IDs, and to show only two participants.
- Google Meet | iOS: Updated support for recovering user emails and user names for meeting history. [57.0.0]
- Grindr | iOS: Added support for recovering group members and updated support for recovering messages and buddies.
- Instagram Media | iOS: Updating support for the Instagram Media artifact to recover Instagram Reels videos.
- Kiwi Browser | Android: Updated support for the latest version. [Git20126Gen426127039]
- Life360 | Android: Updated support for recovering circle members, local user accounts, messages, and places. [20.8.0]
- Location History | iOS: Removed the Local User fragment from the Significant Locations and Significant Locations Visits artifacts as there was no data to report.
- MMS | Android: Updated carving support for the Android MMS artifact to recover and join information from multiple tables.
- Motion Photos | Android: Updated support to retrieve SHA1 and PhotoDNA hashes.
- PowerLog | iOS: Updated the PowerLog artifacts to uniformly display the Adjusted/Original Date/Time.
- PowerShell History | Windows: Added support for recovering PowerShell history, including the user that executed the command and the command text.
- Samsung Health | Android: Added parsing support to retrieve user information from the Samsung Health app, including name, profile image, email, birthday, height, weight, and more.
- Signal | Android: Updated support for Messages, Charts, and Users artifacts for Android Signal. [5.1.9]
- Slack | iOS: Updated support for recovering recipients for direct messages. [21.3.20]
- Snapchat | iOS: Updated parsing and carving support for recovering Snapchat username information.
- Telegram | iOS: Updated support for the Telegram artifact to recover deleted account information in the latest version of Telegram. [7.6]
- Tinder Accounts | Android: Updated support for recovering user IDs and names.
- Uber Cached Locations | Android and iOS: Updated support to retrieve the name of the cached location, tags assigned to the location by the user, and categories assigned to the location by Uber.
- WeChat Friends | iOS: Updated parsing support for the WeChat Friends artifact to recover profile image, nickname, chat room participants, and geolocation information. [7.0.78]
- Wickr Messages | Android, iOS, and Windows: Updated the Wickr Messages artifact schemas to be consistent across different platforms (iOS, Android, and Windows), updated support to recover room name and chat type information, and updated support for system messages.
- Yahoo Webmail | Android: Updated parsing support to retrieve attachment files. [6.19.4]
Bug fixes
- Previously, an incorrect attachment file was recovered for TextNow for iOS. -MA-2909
- The text from Twitter Direct Messages for Android devices was displayed twice in the Text column and in the Details card. -MA-2959
- Updated ExifTool to version 12.25. -COMP-1369
- When processing old versions of Signal for iOS (prior to version 3.2), temporary files produced as part of the decryption process were not properly cleaned up or removed when processing was complete. -MA-3040
