New and updated

To refresh our brand identity, the Magnet Forensics and Magnet AUTOMATE logos have been updated in Magnet AUTOMATE. This change, along with product naming conventions, will be implemented over several releases, so you may notice some areas where the logos and names have not been updated yet.
At Magnet Forensics, we welcome your feedback and want to hear about your ideas to help us improve Magnet AUTOMATE. You can now submit your feedback for future consideration at the Magnet AUTOMATE Ideas Portal.
Note: To access the Magnet AUTOMATE Ideas Portal, you must sign in to the Support Portal.
To easily upgrade AUTOMATE Essentials, running the latest AUTOMATE Essentials installer now automatically detects if the installed version is lower than the new installer version. A new Update button displays, which updates the installed components. For more information about the latest release, a link to the AUTOMATE release notes also displays in the installer.
If you encounter issues installing AUTOMATE Essentials, you can now re-run the AUTOMATE Essentials installer. A new Repair button displays, which walks you through the installation, repairing any issues with components or configuration.
To improve troubleshooting in runs, the Log file tab in Run details includes the following enhancements:
- To search the run log for specific messages, you can now enter keywords in a text box. For example, if the run failed, search for "ERROR" to help you find potential causes of the issue(s) you are experiencing.
- To improve the readability of messages, information now appears in column format, displaying the timestamp and corresponding log file message. To view the log file in full screen, click the Full screen icon. To change the display and copy options, click Options.
Updated the Jenkins libraries from 2.401.3 to 2.426.1. As part of the Jenkins update, Java was also updated from version 11 to 21.
In Magnet AUTOMATE Enterprise, the Workflows table now displays the Magnet Remote Acquire and AXIOM Cloud applications in the Applications and plugins column. Previously, these applications did not display in this column.
To improve troubleshooting with integrations that use the API, the logs.zip file generated from the Magnet AUTOMATE web application now includes API logs. If you experience an issue with an integration that uses the API, send the logs.zip file to Magnet Forensics Technical Support and they will review these log files to troubleshoot the source of the issue.
When adding a Griffeye Processing Engine element to a workflow from the web application, you can now specify Source ID as a VICS data type. By default, all VICS data types are selected. Previously, you could only specify Source ID as a VICS data type from the Griffeye Processing Engine CLI.
To avoid running out of disk space during an image processing workflow, the AXIOM Process CLI includes a new -tfl/--tempfilelocation option that allows you to specify a directory on the node where temporary files are created. By default, temporary files are created in {NODE_WORKSPACE}\\{JOB_NAME}\\{BUILD_FOLDER}. Previously, specifying a different directory for temporary files required assistance from Magnet Forensics.

Bug fixes

When data validation was turned on and a filename in a case contained special characters, such as parentheses, the run failed. (AU-1179)
When data validation was turned on for an encrypted image processing workflow, the decrypted image was not successfully validated before processing. (AU-1301)
When adding a Magnet GRAYKEY output (iOS image and keychain file) into a watch folder with local image mode turned on, the workflow failed to process the image because the keychain file was not copied to the local node's workspace. (AU-1161)
Important: To successfully load an iOS image and keychain file for processing in a watch folder workflow, the iOS image and keychain file must use the same file naming convention and reside in the same folder. For example: D:\Storage\CASE-001\Images\iOS\7d40ef7bda29d4f52_files_full.zip and D:\Storage\CASE-001\Images\iOS\7d40ef7bda29d4f52_keychain.plist. If the keychain is not in the same folder and doesn't contain the same file naming convention as the image, a "Keychain was not found" error message displays.
When adding the Hash Sets Manager, Magnet AUTOMATE would not accept a valid hostname for the URL. As a workaround, you were required to enter a valid IP address or the Fully Qualified Domain Name instead. (AU-1193).
When setting up a Magnet GRAYKEY or Atola TaskForce hardware imager, the Hostname field did not accept a valid hostname, preventing you from clicking Connect. As a workaround, you were required to enter a valid IP address instead. (AU-504)
When a run finished for a merge workflow, the run summary was not automatically exported to the case output folder. (AU-1412)

Known issues

Long lines in log files may fail to wrap correctly, causing them to overlap with other lines. To resolve the issue, refresh the log you are viewing. (AU-699)
In an image processing workflow, AXIOM Process cannot read an iOS image with a keychain encrypted by BitLocker. To successfully read and process this type of image, copy the keychain to an external drive not encrypted with BitLocker. Additionally, if the AUTOMATE agent node's workspace is encrypted with BitLocker, workflows that have been configured to "turn on local image mode" will not be able to read these images. (AXP-10310)
During data validation, if the source destination contains an image with copies of the same image in subfolders, the data validation fails. In this scenario, the expected behavior is that Magnet AUTOMATE doesn't recursively catalog identical files. (AUTO-3407)
When copying files during data validation, the associated node is in use; however, the Nodes column for cases in progress appears empty. The expected behavior is that the Nodes column should display the active node. (AUTO-3406)
When data validation begins, the run log records a "Creating hash catalog" status. If files fail to copy after creating file hashes, there is no status in the run log to indicate when copying started. The expected behavior is that there should be a "Copying" status after "Creating hash catalog" to indicate the sequence of events and when they occurred. (AUTO-3408)

Magnet AXIOM and Magnet AXIOM Cyber updates

Updated agent installers to include the latest version of workflow applications: AXIOM Cloud, AXIOM Process, AXIOM Exporter, AXIOM Post-Processing, and Magnet ACQUIRE.
When using AXIOM Exporter to create an HTML artifacts export, the export fails if one of the artifacts starts with a period, such as .bash_history.
For more information about Magnet AXIOM 7.10.1 updates, see the Magnet AXIOM 7.10.1 Release Notes.
For more information about Magnet AXIOM Cyber 7.10.1 updates, see the Magnet AXIOM Cyber 7.10.1 Release Notes.