Highlights

SMS/MMS: Updated parsing to enable chat threading. [Android]

Windows 10 Timeline Activity: You can now recover information from the Timeline on Windows 10 to uncover a user's activities on their system, such as web history, document usage, media access, and so on.

Skype: Added parsing and carving support for private messages, group messages, contacts, attachments, calls, media cache, highlights. [Skype 8.1-8.15 on Windows]

Skype: Added parsing and carving support to recover messages, group messages, contacts, attachments, calls, and more. [Skype 8.1-8.15 on macOS]

Mobile and desktop artifacts

WhatsApp: Updated parsing and carving support to clearly identify audio and video calls, and to recover the call duration. [WhatsApp 2.17.254 on Android]

Location History: Added parsing support to to recover a user's significant locations, and significant location visit history from a GrayKey iOS image. [iOS 11]

Safari: Added parsing and carving support to recover Safari iCloud tabs from a GrayKey image. [Safari on iOS]

iMessage Read Receipts: Added parsing and carving support for iMessage/SMS/MMS read receipts. [iOS 6+].

Safari: Added parsing support to recover users' open Safari tabs. [Safari on iOS]

iOS Application Permissions: Added support to recover application permission settings on iOS devices, including camera access, contact access, microphone access, and more. [iOS 9-11]

SIM Card Activity: Added parsing and carving support for iOS SIM card activity. [iOS 9-11]

iOS Notes: Updated parsing support to recover attachments, password hints, the source of the note, and more. [Notes on iOS 9.3.3 - 12.0]

iOS Voice Mail: Updated parsing support to recover voice mails in the Artifact view, play back voicemails, and more. [iOS 9.3.3-11.3.1]

Instagram Direct Messages: Updated parsing support for Instagram direct messages recovered from GrayKey. [Instagram 57.0 on iOS]

iOS Calendar Events: Updated parsing support to recover iOS Calendar Event notes and URLs. [Calendar on iOS 7-11]

Telegram: Updated parsing support to recover message text. [Telegram 4.7.1 on Android]

WhatsApp: Added parsing and carving support for audio and video calls. [WhatsApp 2.17.22-2.17.33 on iOS]

iOS Contacts: Updated parsing support to recover the profile pictures of iOS contacts. [Contacts on iOS]

AXIOM Process features

Significantly improved performance of scan times of video carving, depending on the evidence you loaded.

Improvements were made to the performance time of device connection scanning.

Improvements were made to the LG mobile device acquisition process to better detect whether devices can be imaged or not.

AXIOM Examine features

When you click a picture in the "Preview" card, you can resize the picture, rotate the picture, and more.

Open a case in AXIOM Examine faster with improvements to loading evidence sources.

Improvements have been made to increase the quality of the video and audio playback of parsed and carved videos, to support more video file formats, including MOV and MPG, to preview audio files, and more.

Sometimes you can't see picture or video previews because the source of the picture or video couldn't be located. You are now notified if this issue occurs.

Fixed issues

Sometimes AXIOM Process would crash if you processed evidence over a network connection, and the path you used exceeded size constraints. -AXP-3708

Sometimes if you tried to acquire data from Box.com, only Box.com User Events from the Cloud would be recovered. -CAO-1548

For some users when you logged in to a Cloud Office 365 account with administrative privileges, the Microsoft mail item didn't have an "Edit" option, and you couldn't access audit logs. -CAO-1556

If you attempted to acquire AOL IMAP Webmail data from the Cloud and an error message appeared, if you exited the error window, AXIOM Process would close too. -CAO-1559

Sometimes you couldn't categorize items using Magnet.AI. -AE-655

Improvements have been made to increase the reliability of iOS backup quick imaging. -MMI-797

If you tried to acquire a jailbroken device, sometimes you couldn't complete a full acquisition because it was reported that you didn't have privileged access, even if you did. You can also now acquire a jailbroken device using SSH if the device doesn't have AFC2. -MMI-766

When you set the language in AXIOM to Japanese, Traditional Chinese, Simplified Chinese, or Korean, no data for Windows Timezone Information would be recovered. -ART-9777

"Last connected date/time" information would be incorrectly displayed for Windows Network Profiles. -ART-9747

Sometimes if you acquired Facebook data with AXIOM Cloud, files would get stored in the temp directory.

Known issues

In some situations, antivirus software is known to prevent Magnet AXIOM from creating a portable case. For example, if Malware URLs are part of the evidence being exported, the portable case might not get created successfully. Workaround: Turn off the antivirus software and create the portable case. Turn on the antivirus software again.

Magnet AXIOM crashes when out of disk space. Workaround: Check the amount of disk space available for the case and acquisition directories before you start processing.

In older versions of AXIOM Examine (earlier than 1.1.0), if you attempt to open a case that was processed using AXIOM Process version 1.1.0 or later, you may experience unexpected results.

When you process an encrypted iTunes backup and provide the password to decrypt it, the data might still appear in its encrypted form in AXIOM Examine. Workaround: Extract the iOS image from the compressed container to a different location on your computer. In AXIOM Process, perform a Files and Folders scan. (In the Evidence sources section, click Mobile > iOS > Load evidence > Files and Folders.)

If you attempt to acquire iCloud backups that have two-factor authentication, AXIOM Process fails to acquire the image.

New in Magnet AXIOM 2.4.0.10970 - August 16, 2018