Installation and upgrade notes
- Kubernetes version for Azure deployments: 1.24.0
- You must use the 4.2 CLI with Magnet REVIEW 4.2 to ingest cases. Attempting to ingest using previous versions of the CLI will result in errors. If you are uploading evidence from AXIOM Examine 6.6 or earlier, you must manually replace the installed CLI as described in the knowledgebase article Update the CLI used to upload evidence from AXIOM Examine to Magnet REVIEW.
- You must run the CLI or the Upload to Magnet REVIEW tool from a machine running Windows 8 or later.
- When upgrading, you can ingnore these warnings, which appear because the configuration has moved:
Unexpected property 'node_count' encountered when updating config
Unexpected property 'node_type' encountered when updating config
Unexpected property 'region' encountered when updating config
New and updated features for end users
- You can now filter evidence items using column filters. In single-artifact view, you can apply a filter that corresponds to the data type of the column (keyword, numeric, or date-time). In multi-artifact view, you can apply a keyword filter to the first three columns and a date-time filter to the fourth column.
- You can now scroll chat threads in their entirety instead of having to use the "View Next/Previous Messages" buttons.
- All date/time information specified in reports now shows in UTC instead of GMT.
- The ingestion version listed on an evidence source now shows the versions of the CLI and the server-side ingestion library combined, for example, 4.2.0.7200 - 0.10.0.
New and updated features for administrative users
- Ingestion is now more robust with the addition of a new ingestion service. Users will see an "ingestion completed" message after evidence has been successfully uploaded. The new service has improved capabilities for concurrent ingestions.
- You can now create system reports that describe what is currently in the system, such as cases, evidence sources, and users. You can export these reports in CSV format.
Bug fixes
- Keyword searches matched artifact name and artifact category name, which gave unexpected results. -MR-3767
- After a new release was deployed, end users often had to clear their cache or use "incognito" mode in their browser. The cache is now be cleared/expired automatically following an upgrade. -MR-1938
- If you viewed case data while that case was still being ingested, the page could become difficult to view due to constantly reloading artifacts, and it could become stuck in a refresh loop. -MR-3570
- Users received a 503 Service Temporarily Unavailable error when attempting to access the REVIEW front end. Resources were not assigned and memory limits were not set for Keycloak, which allowed Kubernetes to evict the pod. -MR-3748
- When ingesting a number of large cases that contained significant document and email content, REVIEW would occasionally stop processing. A third-party component (dtSearch) has been updated to address memory and stability issues. -MR-3750
- When the same user applied tags in quick succession, it occasionally caused subsequent tag requests to throw an error. -MR-1070
Known issues
- An attempt to generate a system report will fail if there's a case that does not have a hits index (likely due to an issue with ingestion).
Workaround: Find a case on the Dashboard that has "no evidence sources", then delete the case.
- An issue with the Filmstrip previewer service is causing them to exceed their memory limits, which cause the pods to be terminated.
Workaround: Configure the maximum number of video requests to be 2 or less and the Filmstrip previewer pod should not get into a state where it runs out of memory.
- In evidence uploaded from Cellebrite Physical Analyzer, duplicate artifact fragments can be generated if an XML element from the Cellebrite export contains a nested element of the same type.
- Keyword searches applied by the user don't get highlighted in PDF previews if the content exists in the table of contents, links, or occurs over multiple lines.
- When the user previews a picture or PDF attachment in the artifact hit details view, the audit log incorrectly records the action as a download event. PDF documents can trigger multiple download requests on hit details page open.
- Switching to full screen in a document preview sometimes causes some UI elements to resize off the screen. This occurs most frequently with larger documents.