Artifact updates

Android

Aloha Browser NEW

Android Browser NEW

Brave NEW

Calc Vault NEW

Ecosia NEW

Gmail

Iron Browser NEW

Kiwi Browser NEW

Lunascape NEW

Mail.ru Agent NEW

Opera NEW

Skype Emotions NEW

TikTok

Android continued

Sleipnir NEW

UC Browser NEW

Whale NEW

Yandex NEW

iOS

Apple Accounts NEW

Lyft NEW

Gmail

Mail.ru Agent NEW

Skype Emotions NEW

Signal NEW

TikTok

Yandex NEW

Windows

Chrome

Prefetch Files

VLC Player NEW

macOS

Apple Contacts NEW

Chrome

Recovery Account Information NEW

Quick Look Thumbnails NEW

VLC Player NEW

Cloud

Facebook

Facebook Warrant Returns

Twitter (Public)

Graykey integration

AXIOM Process now includes processing workflows specifically for images acquired using Graykey.

Process GrayKey images two different ways:

Load the .zip files from a GrayKey image
Connect to a GrayKey device on your network and download images directly
More details...

Explore SQLite databases more effectively

The new SQLite viewing capabilities in AXIOM Examine make it easier to search, sort, and filter SQLite data in your cases.

Some of the new features allow you to:

Run SQL queries on the data
Search across all fields in the table
Filter and sort on a column
Rearrange columns
Copy rows, columns, or individual cells to the clipboard
More details...

More highlights

Other helpful updates in 3.1:

More macOS improvements, including several new artifacts. More details...
Several AXIOM Cloud updates, including support for additional Facebook Warrant Returns (photos, status updates) and public Twitter posts. More details...
Support for 12 Android browsers based on Chromium comprising over 90 new artifacts. More details...

More updates

Artifacts

Aloha | Android: Added support to recover auto fill, bookmarks, downloads, and history. [2.1.0.0]
Android Browser | Android: Added support to recover bookmarks, keyword search terms, and history for older versions of Android Browser.
Apple Notes | iOS: Updated parsing support to better recover data. [iOS 9.2.1]
Apple Notes | iOS: Updated support to recover HTML content in the Apple Notes app. [iOS 9.2.1]
Brave | Android: Updated support to recover top sites. [1.0.89]
Calc Vault | Android: Added support for recovering browser history and bookmarks.
Chrome Autofill | Windows: Now includes an attribute that indicates the date that the autofill value was last used. [61.0]
Chrome Sync Accounts | Windows, macOS: Updated support to recover sync accounts on some versions. [61.0 on Windows, 63.0 on macOS]
Chrome Web Visits | Windows: Updated to indicate the device that a search originates from.
Edge Chromium | Windows: Added support for recovering data from the Edge Chromium browser.
Event Logs | Windows: Improvements that result in more data being recovered.
Facebook Messenger | Android: Updated to indicate whether a message was deleted by the user. [201.0.0]
Facebook Messenger | iOS: Updated to indicate whether a message was deleted by the user. [202.0]
Gmail | Android: Updated support to recover information about attachments. [9.1.13.233495724]
Gmail | iOS: Added support to recover emails and attachments. [6.0.190224]
Grindr | Android: Updated support for recovering messages and buddies on recent versions. [5.6.1]
Instagram | iOS: Updated support to recover messages and group conversations. [75, 87]
KnowledgeC | iOS: Added support to recover KnowledgeC Application Activities and Media History. [iOS 10]
Lunascape | Android: Added support to recover auto fill, bookmarks, cookies, and history. [10.3.1]
Lyft | iOS: Added support for recovering user accounts, last known locations, and payment details. [5.67.3]
Mail | iOS: Updated support to improve recovery of emails and attachments. [iOS 12.1.2]
Mail.ru Agent | Android: Added support to recover information about users, conversations, calls, and shared media. [7.4.1]
Mail.ru Agent | iOS: Added support to recover information about users, conversations, calls, and shared media. [7.7.1]
Prefetch Files | Windows: Updated support to include more information, such as the file hash and volume information, as well as better differentiation between different Windows versions. [Windows XP-10]
Prefetch Files | Windows: Updated to include the File Creation Date/Time. [All versions]
QuickLook Thumbnails | macOS: Added support for recovering information about thumbnail previews that are generated and saved in the QuickLook database. [10.11, 10.13, 10.14]
Recovery Account Information | macOS: Recover information about the user accounts that have privileges to decrypt a FileVault encrypted volume in APFS. [macOS 10.12+]
Reddit | iOS: Recover information about users, posts, and subreddits visited using the Reddit app. [4.27.1.305578]
Safari | iOS: For GrayKey images, updated support to recover credit cards stored on Safari Keychain. [iOS 11+]
Signal | iOS: Added support to recover encrypted data from Signal, including conversations, calls, and attachments. [2.33, 2.35, 2.38]
Skype Emotions | Android: Added parsing and carving support to recover information about emotions used on Skype. [8.1 to 8.15]
Skype | Windows: Updated parsing support to recover messages sent on Skype on Windows 7. [Skype 8.10, 8.12, 8.31, and 8.30.0.98]
Sleipnir | Android: Added support to recover browsing information, including cookies, auto fill, bookmarks, history, and search terms. [3.5.13]
Telegram | Android: Updated support to recover calls and attachments. [5.4.0]
Telegram | Android: Updated support to recover calls, attachments, and sender and recipient data for messages. [5.4.0]
Telegram | iOS: Updated support to improve recovery of conversations and user data. [5.4.1]
TikTok | Android: Updated support to recover published and drafted videos. [10.3.0]
TikTok | iOS: Updated support to recover published, viewed, and drafted videos. [10.3.0]
Twitter | Android: Improvements to carving, resulting in more hits.
UC Browser | Android: Added support to recover browsing information, including cookies, auto fill, bookmarks, history, and downloads. [12.10.9.1193]
VLC Player | Windows: Added support for recovering recently played files. [3.0.6]
VLC Player | macOS: Added support for recovering recently played files. [3.0.6]
iMessage | macOS: Added support for recovering attachments from archived chats. [10.13.4]

Cloud

If you are having trouble signing in to a Microsoft cloud account using the user name and password sign in method, you can now try signing in to the account using external browser authentication. Audit logs cannot be collected using this authentication method.
Support for processing Facebook warrant returns now includes photos and status updates.
When acquiring public Twitter activity, you can now choose the type of activity you want to acquire from the Twitter account: Tweets, Followers, and Following.

Processing

If the connection to your license is lost during a scan, you will now be notified if AXIOM Process is unable to detect a valid license and can’t complete the scan.
In AXIOM Process, you can now connect to a GrayKey device on your network, download images stored on the device, and add the images to your case.

Examining

AXIOM Examine now includes a enhanced SQLite viewer which allows you to:
- Select the table you want to view from a drop-down list.
- Rearrange, freeze, filter, and sort columns.
- Search across all fields in the table and execute SQL queries.
- Export SQLite data in a table to a .csv or .xlsx file.
- And more!
AXIOM Examine now includes support for exporting evidence using the VICS 2.0 JSON format. VICS 1.2 JSON is no longer supported.
Improvements were made to how email previews are displayed in AXIOM Examine. Email previews now better resemble previews from email applications, and you can now easily view fragments such as From, To, Subject, Attachments, and more.
Improvements were made to the way HTML-formatted content displays in PDF and HTML reports. HTML-formatted content now retains its formatting instead of displaying the HTML code.
In the Timeline explorer, you can now filter evidence based on specific date and time attributes (such as created date/time, modified date/time, installed date/time, and more), use more keyboard shortcuts to complete actions, quickly switch between timeframes using a drop-down, load the next page of results automatically, and more.
When you set a relative time in the Details card for an artifact or file, you can now choose which explorer you want to view relative time results in—your current explorer or the Timeline explorer.

Bug fixes

In certain situations, AXIOM Cloud was unable to recover some conversations from Facebook Messenger. -CAO-1857
In some cases, when you loaded a .zip file created from the Download Your Information option in Facebook, Facebook messages weren’t recovered. -CAO-2125
In some cases, when you switched from the File system explorer to the Timeline explorer in AXIOM Examine, the Timeline explorer crashed. -AXE-6760
In some situations, if you attempted to sort evidence in the Column or Classic views and the evidence included duplicate artifacts, AXIOM Examine would sometimes crash. -AXE-5348
In some situations, when you tried to acquire an Instagram account, the authentication window closed after you provided login information, and you weren’t able to add the account as an evidence source. -CAO-2076
Previews of pictures weren’t appearing in PDF and HTML reports. -AXE-6736
Previously, AXIOM Examine incorrectly indicated that the source was not available for items from file slack even after you located the source. -AXE-6039
Previously, the Text and hex card incorrectly displayed decoded Base64 data as encoded. -AXE-6750
Previously, when viewing a PDF document that included embedded scripts, the scripts were executed. -AXE-6786
Previously, when you clicked the Location link in the Details card, you were sometimes taken to the incorrect physical sector in the Text and hex card. -AXE-6593
When acquiring audit logs from a Microsoft Office 365 account, AXIOM Process was previously unable to acquire more than 5000 audit results. -CAO-2097
When processing an image of a FAT file system, AXIOM Process would sometimes appear to stop processing or performance was degraded. -AXP-3622
When processing evidence, AXIOM Process sometimes reported that no transaction was active on the connection and crashed. -AXP-1582
When you deleted a previously loaded hash list from the Calculate hash values section, the hash list still appeared the next time you started AXIOM Process because the application did not finish deleting the file. -AXP-368
When you processed an encrypted APFS image and provided the correct known password, sometimes the scan would fail and AXIOM Process reported that decryption was not successful. -AXP-4891
When you provided a known password for an encrypted APFS image, AXIOM Process sometimes incorrectly reported that the password or recovery key was incorrect. -AXP-4882
In some cases, AXIOM Process stopped responding without starting a scan. -MMI-1026
When analyzing data that’s AES and RC4 encrypted, incorrect NTLM hashes were reported for AES encrypted passwords. -TAO-240
When you analyzed an iOS image on AXIOM Process and viewed the Apple Notes artifact, the options link to add known passwords was not displayed. -MA-312
Windows Timeline | Windows: Updated support to recover missed hits. [Windows 10] -MA-386

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.