Release Notes

Magnet AXIOM 4.1.0.19966 May 29, 2020

Artifact updates

Android

Android SMS/MMS

Burner

Chromium

Grindr

Houseparty

Sim Card Information (Android 10)

Telegram

TextFree

Tinder

Zoom

iOS

Facebook Messenger

Grindr

Microsoft Edge Browser NEW

Safari

Slack

Zoom

Cross Platform

Latent Wireless Wifi Hotspots NEW

Custom Artifacts

Python Artifacts

Windows

Apple Disk Images

Autorun

Firefox Passwords and Tokens NEW

TeamViewer

MacOS

Apple Disk Images

Safari

Artifacts

• Apple Disk Images | macOS, Windows: Added support for recovering information about Apple disk images (.dmg and .img files).
• Autorun Items | Windows: Updated support for displaying registry value information in the Artifacts view.
• Burner Contacts | Android: Added support for recovering contact information. [4.2.13]
• Chromium Tab History | Android: Added support for recovering tab history from the following Chromium based browsers: Brave, Ecosia, Edge, Iron, Kiwi, Samsung and Whale.
• Custom artifacts: Added support for latitude and longitude in the World Map view for Python custom artifacts.
• Facebook Messenger | iOS: Updated carving support for all supported Facebook Messenger artifacts. [255]
• Firefox Logins | Windows: Added support for recovering login information. [76]
• Houseparty Messages and Users | Android: Added support for recovering messages and user information. [1.41.1]
• Houseparty Messages and Users | iOS: Added support for recovering messages and user information [1.41.1]
• Latent Wireless Geolocated WiFi Hotspots | Android, iOS, macOS, Windows: Added support for recovering Wifi hotspot data generated using Latent Wireless.
• Microsoft Edge Browser | iOS: Added support for recovering bookmarks, web history and favicons. [45.3.19]
• Private Photo Vault | iOS: Added support to recover albums and media information. [10.5]
• SMS/MMS Messages | Android: Updated parsing support for SMS and MMS messages. [Android 10]
• Safari Bookmarks | iOS, macOS: Updated parsing and carving support for local and synced bookmarks. [iOS 13, macOS 10.12]
• Safari Downloads | iOS: Updated support to recover .plist files. [iOS 13]
• Sim Card Information | Android: Added support for recovering SIM card information. [Android 10]
• TeamViewer Activity | Windows: Added support to recover TeamViewer activity data. [15 and earlier]
• Telegram Users | Android: Added support for recovering Telegram users. [5.13.1]
• Zoom Chat Messages | iOS: Updated support to recover call details as a part of the Chat Messages artifact. [4.6.11]
• Zoom Contacts | Android: Added parsing support for the Contacts artifact. [4.6.11]

Magnet.AI

• When you find similar pictures using Magnet.AI, you can now select the number of pictures to show in order of similarity to the reference picture.
• You can now find similar pictures from the File system explorer.

Processing

• AXIOM Process can now detect whether a PIN code is present on devices with the latest versions of iOS 13.
• AXIOM Process now uses the latest version of the Passware SDK to improve McAfee encrypted drive decryptions, as well as resolve the issue of unencrypted HFS+ drives being falsely detected as encrypted.
• During a scan, backlog items that have multiple nested files from different platforms (for example, a .zip file in a mobile backup found on a computer drive) will be searched for the platform-specific artifacts.
• When a case is created or opened, the username of the current user and the host name of the computer will be added to the case log.
• When a search completes, you can view a more detailed summary of the completed search. If a search is completed with errors or the search fails, you’ll now be provided with more detailed messaging about why scanning an evidence source might have failed, and troubleshooting steps where possible. For example, you’ll be notified if AXIOM Process encounters an error while using the Dictionary Attack method to decrypt the evidence source because the list of potential passwords did not include the correct password.

Examining

• Exports that included categorized media would display inaccurate counts if they included video or image fragments.
• Videos with no available thumbnail will now appear with a default picture in the Thumbnail view.
• When saving files to a .zip file, you now have the option to export to a single folder or maintain the original folder structure.
• When you create a portable case to share with stakeholders, the Portable Case Quick Start Guide will now be included in the portable case folder as a PDF.
• You can now take snapshots from the Preview of a video artifact.

Bug fixes

• Data from Snapchat Warrant Returns wasn’t being recovered because some file names had changed. -CAO-2883
• HTML, PDF, and PST exports were failing when a case contained many emails. -AXE-7698
• In cases with large numbers of media items, tagging in the Thumbnail view was taking a long time. -AXE-7780
• Logical image formats (LX01, AD1, and L01) were not being properly displayed in the File system explorer. -AXP-6765
• Some data from Box.com accounts was not being successfully acquired. -CAO-2891
• Sometimes, Project VIC exports were failing to be created. -AXE-8045
• Sometimes, text and hex cards weren’t appearing in the Registry explorer. -AXE-8077
• Sometimes, when trying to view the Registry, AXIOM Examine would crash. -AXE-6838
• Exports that included categorized media would display inaccurate counts if they included carved video or picture fragments without thumbnails. -AXE-7743
• When you saved an Email Attachment to the Saved Files folder, the file name and extension were incorrect. -AXE-8086
• When you exported categorized pictures to an HTML export using the "Items in the current view" option, the pictures weren't appearing in the export or in the Attachments folder. -AXE-8138
• When a folder in an APFS source had no name (i.e. was named as ' ', or a space), AXIOM Process would crash and data from that folder would not be acquired. -AXP-5099
• When attempting to acquire a cloud Twitter account, the search would be completed with errors and some data would be missing. -CAO-2948
• When exporting media items to a PDF export, multiple error messages were appearing. -AXE-8066
• When you attempted to load an iCloud Backup, AXIOM Process would crash. -CAO-2669
• Biography information from Tinder 11.3 for Android was not being recovered. -MA-2016
• False positive hits were being recovered for the TextFree Contacts artifact. -MA-1810
• Full email bodies could not be recovered from Windows 10 Mail. -COMP-680
• Hits were not being recovered for Houseparty 1.42.2 and 1.43.0 for Android. -MA-1964
• Notification Center | Windows: Updated support for recovering notifications. [Windows 10] -COMP-952
• Parsed hits from the Grindr Buddies artifact were sometimes being dropped. -MA-1928
• Slack artifacts for iOS were not being recovered. -MA-1999
• Snapchat data was not being recovered if the Android user had an additional account set up on their device. -MA-1877
• Telegram data was not being recovered if the Android user had an additional account set up on their device. -MA-1943
• The Registered Date/Time fragment name of the SIM Card Activity artifact did not accurately describe its contents. The fragment has been renamed to Updated Date/Time. -MA-1916
• The directions of recovered Zoom chat messages were not being reported. -MA-1882

Known issues

• To search for information about known issues, visit the knowledge base at support.magnetforensics.com.