Apple Keychain - Elcomsoft iOS Forensic Toolkit (EIFT) | iOS
Eufy Cached Media | Android, iOS
Eufy Device Information | iOS
Google Home Cached Media | Android, iOS
Google Home Device Information | Android, iOS
Kasa Cached Media | Android, iOS
Kasa Device Information | iOS
Kasa User Information | iOS
Notifications Cached Media | iOS
TeleGuard Accounts Information | Android
TeleGuard Channels | Android
TeleGuard Contacts | Android
TeleGuard Groups | Android
TeleGuard Messages | Android
TeleGuard Posts | Android

All Edge Chromium | Android, iOS, Windows, MacOS: Updated browser support to distinguish between Legacy Edge/Internet Explorer and modern Edge.
Edge Cache | iOS, Windows, MacOS: Updated parsing support to use an improved Chromium Cache parser.
Chrome Cookies | Computer, Mac, iOS: Improved displays for encrypted values when decryption fails.
Chrome Cookies | Mac, Windows: Updated parsing to include cookie decryption.
Google Drive Desktop | Windows: Updated parsing support to recover more data from version 87.0.2.0.
iMessage/SMS/MMS | iOS: Updated carving support to include blob messages.
Instagram Direct Messages | iOS: Updated parsing and carving to improve support for messages with attachments.
Instagram Posts | Android: Updated parsing support to locate data more accurately within .json files.
Pictures | All Platforms: Updated carving to improve the recovery of bitmap files.
Pictures | Android, iOS, Computer, Kindle, macOS, WindowsPhone: Carved pictures now report the file extension of the carver instead of the container they were found in.
Discord | Windows, MacOS: Updated parsing support to recover more artifacts.
Signal Messages | Android: The read state for call logs is now tracked on the call table instead of the messages table.
Signal Messages | iOS: Updated carving support to address issues with large blob records and attachment parsing.
Tik Tok Messages | iOS: Updated carving support to address previous bugs.
Telegram | Android: Updated parsing to match new Message schema for version 10.12
Wallpaper | iOS: Updated parsing support for devices running iOS 17+.
WhatsApp Messages | Android: Updated parsing support to ensure a more accurate display of individual sender names.
WhatsApp Messages | iOS: Updated full file system parsing to resolve instances of missing hits.
WhatsApp Messages | Android: Updated to report accurate timestamps for Message Sent Date Time and Message Received Date Time.

Magnet Axiom can now acquire threads that were created from a Slack conversation.
Magnet Axiom can now validate user defined values before acquiring an EC2 Snapshot.
Magnet Axiom now supports Discord Warrant returns.
Gmail acquisitions can acquire modern Gmail attachments from Google Drive.
Magnet Axiom now acquire iMessages from iOS17 accounts.
Updated Facebook Warrant Return Process to use the new format to capture: Friends, Friend Requests, Status updates, Wall posts, Audit logs, Account and Actions.

Magnet Axiom will now parse $MFT files as an evidence source from a remote acquisition image.
Magnet Axiom now supports Elcomsoft iOS Forensic Toolkit (EIFT) keychain parsing support for iOS images

In mobile view in portable cases, a pop-up now appears to clarify that the view doesn't accurately reflect how the user's device would have appeared.
Portable cases now include Privileged and Non-privileged tags by default.
The file size for large files now include commas.
You can now see image hash verification on the case dashboard and in portable cases.
Magnet Axiom will display parsed $MFT files as an evidence source from a remote acquisition image.
When viewing a markup preview in the Email explorer, you can now click Find to search the data.
You can now select whether you want to include millisecond precision when you acquire evidence. By default, this setting is enabled.

Improvements to the onboarding video experience supporting a wider range of environments.
Added support for more media types:
- Synethic media analysis: .gif, .tiff, .heic, and more. Analysis is also now available for the Live Photos artifact.
- Q&A: .gif, .tiff, .heic, and more. Q&A now also provides a summary of the matches from your query.

Previously, Magnet Axiom may have failed to parse an NTFS image if it contained a corrupted $Upcase. -ENGN-11569
Previously, Magnet Axiom may have thrown an Out of Memory error when processing large evidence items. -ENGN-11516
Updated processing of Cellebrite images containing encrypted and non-encrypted iOS 17.4+ backups -ENGN-11457
If an export was moved to a different file location, Axiom Examine would crash when trying to open it. -EXM-3495
In previous instances, filtering on an iOS Message conversation may have caused complications in the column view. -EXM-3577
Previously, World Map Views experienced difficulties reflecting an accurate image of artifact counts. However, this issue has now been resolved. -EXM-3552
Sometimes, when previewing text files, Axiom Examine would crash. -EXM-3073
Sometimes, when switching to the Registry explorer, Axiom Examine would crash. -EXM-213
Sometimes, when viewing videos in the Media explorer, Axiom Examine would experience an error. -EXM-3434
The offline map server wasn't working correctly in world map view if the server was set up on port 443. -EXM-2489
The organization name wasn't appearing in PDF and HTML reports. -EXM-3220
When saving an export, sometimes Axiom Examine would crash if there were special characters in the export name. -EXM-3594
Chrome Cookies | Mac, Windows: Updated parsing to include cookie decryption. -CARS-906
Gmail | Android: When processing Gmail data, temporary folders and files were left behind. -MARS-2236
Pictures | Android, iOS, Computer, Kindle, macOS, WindowsPhone: Carved pictures now report the file extension of the carver instead of the container they were found in. -CARS-877
WhatsApp Messages | Android: Updated parsing support to ensure a more accurate display of individual sender names. -MARS-1204
Axiom Process includes a more robust handling of Mega server exceptions during file acquisitions. -CA-1821
Previously, acquiring Apple iCloud Photos may have completed without errors after failing to download photos. -CA-1962
Previously, Axiom Process was unable to acquire Gmail message attachments stored in Google Drive. -CA-1152
Previously, Magnet Axiom would crash if a corrupt Facebook Warrant return was loaded. -CA-2069
Previously, Instagram may have not have acquired successfully stating the Instagram agent is out of date. -CA-1993
Previously, Magnet Axiom may have only recovered the first timestamp for multiple pictures when processing a Facebook Messenger Warrant Return. -CA-1944
Previously, when viewing Google Shared Drives in Axiom Process, it would not display the full directory structure. -CA-2071
Performance improvements to RSMF exporting. -EXE-572
Previously, some acquired Slack attachments may not have had a valid file extension. -CA-1905:

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.

Featured artifacts

Animated maps

Gmail modern attachements

MFT