Android App Roles | Android: Added support for parsing the roles.xml file, which indicates which application a user or system has set to perform a function.
Application Permissions | Android: Added parsing and carving support to retrieve permissions used by each package and indicate what permissions have been granted by the user and requested by the application.
Chrome Keyword Search Terms | Windows: Updated support for Chrome Keyword Search Terms to show the last visited time in Magnet AXIOM. [4.9.1]
Chromebook: Added parsing and carving support to identify Chrome artifacts with Chromebook extractions, such as cache, cookies, last tab, media history, web history, and more.
Evernote | iOS: Updated support for recovering Evernote Notes data, including the note type, the file name, the creator, the owner, who the note was shared with, the last editor, and the notebook name.
Google Photo Album | iOS: Added support for recovering Google Photo Album comments. [5.8.328412793]
Houseparty | Android: Updated support for recovering Messages and Users Hits in the latest version of Houseparty. [1.54.0]
Houseparty | iOS: Updated support for recovering Messages and Users Hits in the latest version of Houseparty. [1.54.1]
Improvements to extract more data from attachments and thumbnails. Due to the nature of this change, you might experience longer scan times when scanning images that include many small attachment files.
Instagram | iOS: Updated support for Instagram Profiles to recover profile information of the Local User from different .plist files. [176.0]
Instagram Download Your Data | Cloud: Added support for acquiring direct messages, direct message attachments, account history, messages, media, and comments from an Instagram Download Your Data archive.
Location History | iOS: Removed the Local User fragment from the Significant Locations and Significant Locations Visits artifacts as there was no data to report.
Owner Information | iOS: Updated support for the Owner Information artifact to recover iOS device model information.
Parler | Android: Updated support to include whether the activity was deleted, the repost count, number of upvotes, and number of downvotes and updated support for Parler Activity and Parler Users to include the "-Android" tag for Android artifacts.
Puffin Browser | iOS: Updated support for recovering Puffin Browser Bookmarks information. [5.2.5]
Runtime Permissions | Android: Added parsing and carving support to retrieve the permissions a user has granted or declined to an application.
Slack | Android: Added support for parsing one-to-one direct messages in Slack [20.9.10 and 20.10.10 onward].
Snapchat | Android and iOS: Updated support for the Type fragment to indicate message types with descriptive strings instead of numeric codes.
Snapchat | Android: Updating carving support for retrieving sender and recipient names. [11.17.0.37]
Snapchat | iOS: Updated carving support to recover Snapchat iOS messages from the Arroyo.db database.
Telegram | Android and iOS: Updated parsing support to recover Telegram data on video calls.
TextFree | iOS: Updated support for the Contacts, Groups, and Messages artifacts [11.84]
Viber | iOS: Added support for recovering attachments information for iOS Viber Messages.
WeChat | iOS: Updated support for recovering chat messages. [7.0.78]
Yahoo Mail Emails | Android: Updated parsing support to retrieve Android Yahoo Mail email attachments and message ID. [6.12.1]
Remote acquisition
When creating your agent, you can now optionally configure the agent to survive a restart or shutdown of the target computer. For more information, log in to the Customer Portal to review the Configure the agent to survive a shutdown of a target computer article.
Examining
The beta program for Load File exports is now closed. We appreciate all of your questions, comments, and feedback, which we’ve used to make several improvements to Load File exports. We'd still love to hear from you! To continue to provide feedback, please reach out to Tech Support.
Added support for generating native files for artifacts with HTML-based preview cards, such as Facebook posts, in Load File exports.
Improvements to how DocIDs are assigned across Load Files, text files, and natives.
Updated use of delimiters in .dat files to improve compatibility with loading Load File exports in Intella.
Cloud
In response to new restrictions implemented by Instagram, you now must sign in to an Instagram account to fully acquire publicly available data. You can use any active Instagram account to acquire public activity.
You can now load a .zip file generated from the Download Your Data (JSON format) option in Instagram as a Cloud evidence source.
Bug fixes
AXIOM Process was unable to recover some hits from a W10x64_19041 memory profile if process names included a space. -AXP-7758
If you loaded a folder as evidence and that folder name included an underscore, the underscore was not properly shown in the "Image - location name" column in the list of evidence sources. -AXP-5423
You were unable to acquire Google Activity. -CAO-3643
When acquiring a large amount of audit events from G Suite, AXIOM Process would sometimes crash. -CAO-3526
When emails were exported to PST, some of them were missing the body text. -AXE-8999
When emails with large amounts of body text were exported to PDF reports, the text would overlap or go off the edge of the page. -AXE-5160
When watching a video in one explorer, the video would continue playing when AXIOM Examine was switched to another explorer. -AXE-8957
You were unable to acquire Facebook Profile information. -CAO-3659
Significant Location Visits artifact data could not be parsed on iOS 14 devices. -MA-2772
Updated fragment names to be more specific for the following Cloud artifacts: Cloud Amazon S3 Files, Cloud Google Contacts, Cloud Google Photos (Warrant Return), Cloud Twitter Posts Public, Cloud Twitter Users, Cloud Twitter Users Public, Cloud Google Calendar Events, and Facebook Photos (Warrant Return). -MA-2583
Updated the "Category" fragment names to be more specific for the following Android and iOS artifacts: Android Snapchat Received Images, Android WhatsApp Profile Pictures, Instagram Media, Instagram Photos (Warrant Return), KakaoTalk Pictures, LINE Pictures, Live Photos, Pictures, Carved Video, Snapchat Received Videos, Snapchat Memories, TikTok Videos, and Videos. -MA-2576
Updated the "Location" fragment names to be more specific for the following Android and iOS artifacts: Whisper Posts (iOS only), Mail.ru Contacts, Outlook Appointments, Pebble Calendar Events, Pinterest Accounts, Pinterest Following, and Twitter Users. -MA-2582
When you exported Signal Messages .gif attachments from the picture artifact, the .gif files were converted to static .jpeg files. -MA-2774
When you loaded a World Map in Report Viewer with Lyft Last Known Location for iOS, you got an error and no points were mapped. -MA-2914
When you reviewed Samsung Messages in the Conversation View, the sender and recipient information were not displayed. -MA-2880
When trying to analyze the evidence from an AFF4 image generated from a remote acquisition, AXIOM Process would crash if the image included evidence from the "All users - Folders" targeted location. -CRA-1389