Artifact updates

Android

Android Messages

DuckDuckGo

File System Information

Google Duo

Google Meet

Private Photo Vault

iOS

DuckDuckGo

Facebook Messenger

File System Information

Google Duo

KnowledgeC

Photos Media Information

Significant Locations

TextFree

Threema

Windows

File System Information

Remote Desktop Protocol

Windows OS

MacOS

Photos Media Information

KnowledgeC

Cross Platform

Chrome

Microsoft Edge

PDF

Custom targeted locations

You can add your own custom targeted locations to the default list of targeted locations in AXIOM Process!

Support for both Windows and macOS paths that point to a folder or a file.
Ability to include wildcard characters in the paths to serve as placeholders for items like all user names, all file names, and more.
For more information about creating custom targeted locations, log in to the Customer Portal to view the Adding custom targeted locations article.

New cloud platforms

Magnet AXIOM now includes even more support for cloud platforms!

You can now process Microsoft Unified Audit log .csv files generated using the Microsoft Security and Compliance Center.
AXIOM Process can now parse Cloud-acquired VMs for artifacts, in addition to carving for data. Additionally, when you acquire VM images, Magnet AXIOM now saves them directly to your evidence folder as VHD files and processed them directly.
You can now acquire WhatsApp messages from a mobile device using QR code acquisition.
You can now process Skype Warrant Returns.
More details...

More highlights

Other useful features in Magnet AXIOM 4.2.0 include:

You can now load standard AFF4 physical images into Magnet AXIOM for Windows, macOS, Android, iOS, Kindle Fire, and Windows Phone workflows. More details...
Magnet AXIOM will now index File system items to allow for faster searching and filtering. More details...
When saving files to a .zip file, you now have the option to export to a single folder or maintain the original folder structure. More details...
Magnet AXIOM Cyber will now collect full RAM up to 60% faster. More details...

Artifacts

Device Identifiers: Updated support to prevent HWIDs from being categorized as device identifiers.
DuckDuckGo | Android: Added support for recovering cookies, current tabs, special sites, and bookmarks. [5.54.0]
DuckDuckGo | iOS: Added support for recovering information on whitelisted and fireproofed websites. [7.46.0]
Edge and Chrome: Updated support to reduce duplicate hits across Edge and Chrome applications.
File System Information | Android, Windows and iOS: Updated support to display volume serial numbers in a format that is consistent, and to recover information on start and end sectors.
Google Duo | Android and iOS: Updated support to recover hits from the latest version. [91.0 for iOS and 89.0 for Android]
Google Duo | iOS: Added support for recovering information about group calls. [91]
Google Meet Accounts | Android: Added support for recovering information from Google Meet accounts. [42.0.31]
KnowledgeC | iOS and macOS: Updated support for recovering the activity levels and notification usage of stream types. [iOS 11.12 and macOS 10.15]
PDF Documents | All Platforms: Updated support to recover MD5 and SHA1 hash values of documents.
Photos Media Information | iOS and macOS: Updated support for recovering the hidden, deleted, and favorited statuses of recovered pictures. [iOS 13.1 and macOS 10.14]
Private Photo Vault | Android: Added support for recovering albums, media files, and thumbnails.
Remote Desktop Protocol Bitmap Cache | Windows: Added support for providing an image reconstruction of the RDP bitmap cache.
Significant Locations | iOS: Updated support for recovering location names. [iOS 13]
Textfree Messages | iOS: Updated support for recovering media attachments. [11.52]
Windows OS artifacts: Updated support to prevent computer SIDs hits from being categorized as person identifiers, where the SIDs are for systems accounts that aren’t tied to a user or a system.
Legacy artifacts: Some older and obsolete artifacts have been turned off by default to help improve processing times. You can still turn these artifacts on manually. For the list of artifacts, log in to the Customer Portal to review the Legacy artifacts article.

Remote acquisition

A warning message will appear if you’re using a version of TLS older than 1.2 when you try to connect to an agent.
When acquiring targeted locations, you can now add your own custom locations.
You can now perform a full RAM acquisition up to 60% faster than with previous versions of Magnet AXIOM Cyber.

Cloud

You can now process Microsoft Unified Audit log .csv files generated using the Microsoft Security and Compliance Center.
The Last Message Date/Time data for a WhatsApp conversation will no longer appears for individual WhatsApp messages.
You can now acquire WhatsApp messages from a mobile device using QR code acquisition. Magnet AXIOM provides you with a QR code that can be scanned by the target device, as long as the device is unlocked and has internet connection.
You can now process Skype Warrant Returns. If you receive the Warrant Return in a format other than a non-password protected .zip file, you must re-archive it in order to load it into Magnet AXIOM.
When you acquire virtual machine images, Magnet AXIOM now saves them directly to your evidence folder as VHD files and processed them directly.

Magnet.AI

You can now set picture comparison to build automatically before you process your case. In Tools > Settings, you can also customize Magnet AXIOM to automatically build picture comparison for all cases going forward.

Processing

AXIOM Process can now parse Cloud-acquired VMs for artifacts, in addition to carving for data.
If an AFF4 physical image fails to load, you’ll receive an error message notifying you whether the image is corrupt or unsupported.
When you acquire iOS backups, Magnet AXIOM will now search four levels of folders, rather than just the first level.
You can now load standard AFF4 physical images into Magnet AXIOM.

Examining

Magnet AXIOM will now index File system items to allow for faster searching and filtering. You can also keyword search APFS extended attributes in the File system explorer.
When saving files to a .zip file, you now have the option to export to a single folder or maintain the original folder structure.
When you start working in a case before a scan has completed, you’ll receive a notification to load new evidence once the scan completes.

Bug fixes

Improvements to the Project VIC exporting workflow. -AXE-8189
Sometimes, keyword searches would cause AXIOM Examine to crash. -AXE-8093
Sometimes, when attempting to acquire Microsoft Teams data, the search would complete with errors and no data was found. -CAO-3053
Sometimes, when performing a scan of Mac files and folders, Magnet AXIOM would crash. -AXP-6808
When acquiring Yahoo Mail through the Email data source, no data was being returned. -CAO-1135
When column filtering for a .zip file extension in the File system explorer, no results would be returned. Additionally, using regex to column filter in the File system explorer would return some results, excluding .zip files. -AXE-7694
When creating an Identifiers export with all identifiers, or a PST export with all email messages, the count that appeared in the Exporting wizard was incorrect. -AXE-7956
When exporting an MCAT summary using the “Items from the current view” option, the export would only include items currently visible in AXIOM Examine, rather than all filtered results. -AXE-8210
When exporting media items to a PDF export, multiple error messages were appearing. -AXE-8066
When orphaned files were found in multiple sources in a case, only the first source was listed for all subsequent orphaned files. -AXP-6848
When performing a search with the Dynamic App Finder turned on and multiple databases with the same column name, Magnet AXIOM would crash. -AXP-452
When processing an NTFS drive with an extremely fragmented $MFT file, the search would fail after a long period of time. -AXP-4191
When saving an artifact to a file or creating an HTML export, video attachments weren't being exported. -AXE-8265
When scanning a computer drive, an error message would appear after the scan was complete and indexing would be interrupted. -AXP-6631
When you opened an AFF4 image in AXIOM Examine without Administrative privileges, the source couldn't be located even after mapping the source location. -AXE-8342
Full email bodies could not be recovered from Windows 10 Mail. -COMP-680
Some messages from Android Messages were not being carved from Android 10 devices. -MA-1851
The Android WhatsApp Account Information was in the OS category when it should have been located under Chat. -MA-2123
The wrong user was being reported as the message sender in Threema Chat 4.5.3 for iOS. -MA-2112
Text:When a portable case was opened on a computer with access to a cloud license server (CLS), the portable case would check out a CLS license. -PL-1231

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.