Artifacts
- Email Attachments: Updated the 'Email' section in AXIOM Examine to display recovered data from Email Attachments in a clearer way.
- KakaoTalk | Android: Updated parsing support to decrypt chat logs. [8.0.3]
- Keychain: Added support for Base64 encoding which allows keychain data to be displayed correctly when it’s recovered from a GrayKey image. [iOS 12]
- Location History: Added parsing support to recover Apple Maps Trips from a GrayKey image. [iOS 11]
- Mail | Windows: Added support for recovering emails and attachments from the native mail application in Windows. [Windows 10]
- Naver Whale | Android: Added support for recovering the browser history from Naver Whale. [8.8.6]
- Pictures: Improved performance and better deduplication, resulting in less data noise and faster scan times. [All platforms]
- QQ | Windows: Updated parsing support to decrypt the database, recover messages, and create a memory dump. [9.0.6]
- SMS/MMS | Android: Updated carving support to better recover chat threading hits.
- Safari | iOS: Now differentiates between the different types of bookmarks (bookmarks, favorites, and reading list items). [iOS 11]
- Screen Time: Get a list of the apps installed on the user’s device, or on other devices that use the same Apple ID or are part of the same family account. [iOS 12]
- USB Devices: Added support for USB 3.1. [Windows 10]
- WhatsApp | Android: Added a new WhatsApp Chats artifact which contains information about each individual chat session open on the device. This artifact includes missed calls and unseen messages which aren’t captured under WhatsApp Messages. [2.17.223]
- WhatsApp | Android: Improvements to the WhatsApp Messages artifact to better differentiate between the different types of messages (broadcast, individual, group). [2.18.267]
- WhatsApp | Android: Indicate when a user joins or leaves the group chat in the chat thread view. [2.18.267]
- WhatsApp | Android: Updated parsing support for group messages to recover group description and group profile picture. [2.18.267]
- WhatsApp | Android: Updated parsing support to recover starred messages and location user information such as profile photo, phone number, WhatsApp version, last shared location, current status, and push name. [2.18.267]
- WhatsApp | iOS: Added a new WhatsApp Chats artifact which contains information about each individual chat session open on the device. This artifact includes missed calls and unseen messages which aren’t captured under WhatsApp Messages. [2.18.10]
- WhatsApp | iOS: Now includes a Conversation ID attribute so that deleted messages can be attributed to a session. [2.11]
- WhatsApp | iOS: Updated parsing and carving support to better recover messaging hits, recover starred messages, and to identify if messages are of individual, group, or broadcast type. [2.18.81]
- WhatsApp | iOS: Updated parsing support for group messages to recover creator ID and name. [2.18.267]
- WiFi Profiles: Add support for the parsing WiFi profiles from WifiConfigStore.xml. [Android 7 and 8]
Bug fixes
- During a scan, some types of artifacts might cause AXIOM to run indefinitely. -ARTC-599