Artifact updates
Android
![Facebook Contacts](./icons/Facebook.png)
Facebook Contacts
![Safari Downloads](./icons/IOS Safari.png)
Safari Downloads
![Signal Messages](./icons/Signal.png)
Signal Messages
![Signal Users](./icons/Signal.png)
Signal Users
![Snapchat Chat Messages](./icons/Snapchat.png)
Snapchat Chat Messages
![Tinder Accounts](./icons/Tinder.png)
Tinder Accounts
iOS
![Facebook Messenger](./icons/Facebook Messenger.png)
Facebook Messenger
![iOS Messages](./icons/IOS Messages.png)
iOS Messages Preferences
NEW
![Owner Information](./icons/IOS.png)
Owner Information
![Safari Downloads](./icons/IOS Safari.png)
Safari Downloads
macOS
![Safari Downloads](./icons/IOS Safari.png)
Safari Downloads
Artifacts
- Facebook Contacts | Android: Updated carving support. [394.1.0.51]
- Facebook Messenger Messages | iOS: Updated parsing and carving support to recover the group name from group messages. [408.1]
- iOS Messages Preferences | iOS: Added parsing support for iOS Messages Preferences.
- Owner Information | iOS: Updated parsing support to recover the DSID from com.apple.itunescloud.plist. [iOS 16.5.1]
- Safari Downloads | Android, iOS, macOS: Updated parsing support to recover timestamps for the start and end of a download.
- Signal Messages | Android: Updated parsing support to recover missing messages. [6.28.5]
- Signal Users | Android: Updated parsing support to recover more user data. [6.28.5]
- Snapchat Chat Messages | Android: Updated parsing and carving support to recover story replies. [12.20.0.33]
- Tinder Accounts | Android: Updated parsing support to recover profile picture URLs. [14.3.1]
Remote acquisition
- You can now optionally include a file and folder listing of the endpoint as part of the acquisition.
Cloud
- Shared drives can now be acquired from Google Workspace.
- You can now authenticate using client credentials when acquiring a Microsoft user account.
Processing
- AXIOM will automatically resolve Git URLs to a valid repo.
Examining
- When viewing items in the Registry explorer, you can now right-click to collapse items more quickly.
- You can now highlight protobuf data in the Hex/Text Card and right-click to view in our protobuf viewer.
- The Magnet.AI weapons category now searches for media that contains 3D printed weapons and weapon parts.
Bug fixes
- Now, an Android device may not be selectable as an evidence source during mobile acquisition if the iSerial property has been modified. This is to prevent an attacker from leveraging a command injection vulnerability -ENGN-7199
- Previously, AXIOM could not read uninitialized file extents in an ext4 image. -ENGN-1768
- After changing settings in AXIOM Examine, multiple attempts to close the Settings window would cause AXIOM to crash. -AXE-10922 -EXM-1414
- Sometimes, building the Media explorer would cause AXIOM Examine to crash. -EXM-2801
- Sometimes, the Media explorer wouldn't build when the option was selected from the Tools menu. -EXM-2743
- Android TikTok Draft Media was incorrectly being reported as published. -MARS-1160
- Some data was missing from iOS Telegram Messages. [v9.5.4] -MARS-1363
- When case included Instagram Direct Messages or Instagram Group Members from multiple evidence sources, the sending and receiving users were being incorrectly reported. -MARS-1467
- Previously, acquiring Google photos may have failed stating 'too many requests'. -CA-1408
Known issues