Apple Disk Images | macOS, Windows: Added support for recovering information about Apple disk images (.dmg and .img files).
Autorun Items | Windows: Updated support for displaying registry value information in the Artifacts view.
Burner Contacts | Android: Added support for recovering contact information. [4.2.13]
Chromium Tab History | Android: Added support for recovering tab history from the following Chromium based browsers: Brave, Ecosia, Edge, Iron, Kiwi, Samsung and Whale.
Custom artifacts: Added support for latitude and longitude in the World Map view for Python custom artifacts.
Facebook Messenger | iOS: Updated carving support for all supported Facebook Messenger artifacts. [255]
Firefox Logins | Windows: Added support for recovering login information. [76]
Houseparty Messages and Users | Android: Added support for recovering messages and user information. [1.41.1]
Houseparty Messages and Users | iOS: Added support for recovering messages and user information [1.41.1]
Latent Wireless Geolocated WiFi Hotspots | Android, iOS, macOS, Windows: Added support for recovering Wifi hotspot data generated using Latent Wireless.
Microsoft Edge Browser | iOS: Added support for recovering bookmarks, web history and favicons. [45.3.19]
Private Photo Vault | iOS: Added support to recover albums and media information. [10.5]
SMS/MMS Messages | Android: Updated parsing support for SMS and MMS messages. [Android 10]
Safari Bookmarks | iOS, macOS: Updated parsing and carving support for local and synced bookmarks. [iOS 13, macOS 10.12]
Safari Downloads | iOS: Updated support to recover .plist files. [iOS 13]
Sim Card Information | Android: Added support for recovering SIM card information. [Android 10]
TeamViewer Activity | Windows: Added support to recover TeamViewer activity data. [15 and earlier]
Telegram Users | Android: Added support for recovering Telegram users. [5.13.1]
Zoom Chat Messages | iOS: Updated support to recover call details as a part of the Chat Messages artifact. [4.6.11]
Zoom Contacts | Android: Added parsing support for the Contacts artifact. [4.6.11]
Magnet.AI
When you find similar pictures using Magnet.AI, you can now select the number of pictures to show in order of similarity to the reference picture.
You can now find similar pictures from the File system explorer.
Processing
AXIOM Process can now detect whether a PIN code is present on devices with the latest versions of iOS 13.
AXIOM Process now uses the latest version of the Passware SDK to improve McAfee encrypted drive decryptions, as well as resolve the issue of unencrypted HFS+ drives being falsely detected as encrypted.
During a scan, backlog items that have multiple nested files from different platforms (for example, a .zip file in a mobile backup found on a computer drive) will be searched for the platform-specific artifacts.
When a case is created or opened, the username of the current user and the host name of the computer will be added to the case log.
When a search completes, you can view a more detailed summary of the completed search. If a search is completed with errors or the search fails, you’ll now be provided with more detailed messaging about why scanning an evidence source might have failed, and troubleshooting steps where possible. For example, you’ll be notified if AXIOM Process encounters an error while using the Dictionary Attack method to decrypt the evidence source because the list of potential passwords did not include the correct password.
Examining
Exports that included categorized media would display inaccurate counts if they included video or image fragments.
Videos with no available thumbnail will now appear with a default picture in the Thumbnail view.
When saving files to a .zip file, you now have the option to export to a single folder or maintain the original folder structure.
When you create a portable case to share with stakeholders, the Portable Case Quick Start Guide will now be included in the portable case folder as a PDF.
You can now take snapshots from the Preview of a video artifact.
Bug fixes
Data from Snapchat Warrant Returns wasn’t being recovered because some file names had changed. -CAO-2883
HTML, PDF, and PST exports were failing when a case contained many emails. -AXE-7698
In cases with large numbers of media items, tagging in the Thumbnail view was taking a long time. -AXE-7780
Logical image formats (LX01, AD1, and L01) were not being properly displayed in the File system explorer. -AXP-6765
Some data from Box.com accounts was not being successfully acquired. -CAO-2891
Sometimes, Project VIC exports were failing to be created. -AXE-8045
Sometimes, text and hex cards weren’t appearing in the Registry explorer. -AXE-8077
Sometimes, when trying to view the Registry, AXIOM Examine would crash. -AXE-6838
Exports that included categorized media would display inaccurate counts if they included carved video or picture fragments without thumbnails. -AXE-7743
When you saved an Email Attachment to the Saved Files folder, the file name and extension were incorrect. -AXE-8086
When you exported categorized pictures to an HTML export using the "Items in the current view" option, the pictures weren't appearing in the export or in the Attachments folder. -AXE-8138
When a folder in an APFS source had no name (i.e. was named as ' ', or a space), AXIOM Process would crash and data from that folder would not be acquired. -AXP-5099
When attempting to acquire a cloud Twitter account, the search would be completed with errors and some data would be missing. -CAO-2948
When exporting media items to a PDF export, multiple error messages were appearing. -AXE-8066
When you attempted to load an iCloud Backup, AXIOM Process would crash. -CAO-2669
Biography information from Tinder 11.3 for Android was not being recovered. -MA-2016
False positive hits were being recovered for the TextFree Contacts artifact. -MA-1810
Full email bodies could not be recovered from Windows 10 Mail. -COMP-680
Hits were not being recovered for Houseparty 1.42.2 and 1.43.0 for Android. -MA-1964
Notification Center | Windows: Updated support for recovering notifications. [Windows 10] -COMP-952
Parsed hits from the Grindr Buddies artifact were sometimes being dropped. -MA-1928
Slack artifacts for iOS were not being recovered. -MA-1999
Snapchat data was not being recovered if the Android user had an additional account set up on their device. -MA-1877
Telegram data was not being recovered if the Android user had an additional account set up on their device. -MA-1943
The Registered Date/Time fragment name of the SIM Card Activity artifact did not accurately describe its contents. The fragment has been renamed to Updated Date/Time. -MA-1916
The directions of recovered Zoom chat messages were not being reported. -MA-1882