Upgrade note: This update to the 3.18.0 release addresses an issue with adding custom case and evidence variables.
New and updated
This release introduces AUTOMATE Essentials, a streamlined offering of Magnet AUTOMATE. It installs and configures one controller and one node on a computer, as well as several default Magnet Forensics applications and workflows, allowing you to create cases right away.
Magnet AUTOMATE now includes the Griffeye Processing Engine as a default application that you can include as an element in your CSAM workflows. The Griffeye Processing Engine can extract and/or process media files from various evidence source types and save them to a case file, which you can then open in Griffeye Analyze DI Pro for media grading and victim identification. This functionality is available from the web application and CLI. Previously, you had to purchase the Griffeye Processing Engine as a separate application to use with Magnet AUTOMATE. Important: When you run the node installer, Griffeye Processing Engine 23.5.1 is installed by default into the C:\Program Files\Griffeye Technologies\Griffeye Processing Engine folder. After you install the node, you must manually add a separate license for the Griffeye Processing Engine. To add your license, refer to the Griffeye Processing Engine User Manual in the Support Portal. If you have a version of Griffeye Processing Engine older than 23.5.1 currently installed, the node installer will update your version to 23.5.1. For assistance with your existing Griffeye Processing Engine license, contact Magnet Forensics.
In Magnet AUTOMATE Enterprise, you can now export and import workflows with Remote computer or AXIOM Cloud as a source element. Previously, Remote computer and AXIOM Cloud were unsupported source elements.
You can now choose to share information about how you use Magnet AUTOMATE with Magnet Forensics. This information can help us improve our products. The type of information that gets sent only includes information from finished runs, such as AUTOMATE version, duration, and evidence size. This new option is available from Settings in the web application and is turned on by default in AUTOMATE Essentials and turned off by default in Magnet AUTOMATE and Magnet AUTOMATE Enterprise.
When exporting a workflow from the web application, the workflow file name now records the user's local time. Previously, exporting a workflow from the web application recorded the time in UTC format. Exporting a workflow from the API continues to record the time in UTC format.
To help you troubleshoot errors, you can now export run logs for runs that are in progress. Previously, you could only export run logs for completed runs.
To help you understand how to use Magnet AUTOMATE, the following video tutorials are now available from the Magnet Tutorial Hub in the Support Portal:
Magnet AUTOMATE: An Overview
Creating a Case in Magnet AUTOMATE
Creating a workflow in Magnet AUTOMATE
Case Status and Troubleshooting in Magnet AUTOMATE
Note: To access video tutorials, you must sign in to the Support Portal.
Bug fixes
When importing a workflow with a duplicate name, if the imported workflow contained valid special characters in the name, such as +, "Copy" was not appended to the name of the imported workflow. (AU-1216)
When importing a workflow, if the import environment used a different date/time formatting than the export environment, the import failed. (AU-1250)
When viewing a live run log from the Log file tab, duplicate log entries displayed. (AU-1165)
Known issues
When setting up a GrayKey hardware imager, the Hostname field does not accept a valid hostname, preventing you from clicking Connect. As a workaround, enter a valid IP address instead. (AU-908)
Long lines in log files may fail to wrap correctly, causing them to overlap with other lines. To resolve the issue, refresh the log you are viewing. (AU-699)
In an image processing workflow, AXIOM Process cannot read an iOS image with a keychain encrypted by BitLocker. To successfully read and process this type of image, copy the keychain to an external drive not encrypted with BitLocker. Additionally, if the AUTOMATE agent node's workspace is encrypted with BitLocker, workflows that have been configured to "turn on local image mode" will not be able to read these images. (AXP-10310)
During data validation, if the source destination contains an image with copies of the same image in subfolders, the data validation fails. In this scenario, the expected behavior is that Magnet AUTOMATE doesn't recursively catalog identical files. (AUTO-3407)
When copying files during data validation, the associated node is in use; however, the Nodes column for cases in progress appears empty. The expected behavior is that the Nodes column should display the active node. (AUTO-3406)
When data validation begins, the run log records a "Creating hash catalog" status. If files fail to copy after creating file hashes, there is no status in the run log to indicate when copying started. The expected behavior is that there should be a "Copying" status after "Creating hash catalog" to indicate the sequence of events and when they occurred. (AUTO-3408)
Magnet AXIOM and Magnet AXIOM Cyber updates
Updated agent installers to include the latest version of workflow applications: AXIOM Cloud, AXIOM Process, AXIOM Exporter, AXIOM Post-Processing, and Magnet ACQUIRE.
When using AXIOM Cloud to acquire cloud evidence from the Microsoft cloud platform (365 and Teams), specifying an alias email address instead of a primary email address may have resulted in incomplete or failed acquisitions. For example, using the alias email address of firstname.lastname@companyname.com instead of the primary email address of username@companyname.com. (CA-1616)
