Customers can now get the latest version of Magnet AXIOM over at the Customer Portal! Magnet AXIOM 1.2.3 improves smartphone acquisition, provides innovative new time filtering capabilities, enhancements to AXIOM Examine and AXIOM Cloud, offers new artifacts, and adds language support for Chinese (traditional) and Korean.

Smartphone Acquisition Improvements

With this release, we’ve worked hard to improve the experience of mobile acquisition within AXIOM. Specifically, we’ve improved iOS quick imaging, implemented selective Android app downgrading, and improved device detection for Android devices. We also now support 1,200 Android recovery images (up from 650) which enables you to bypass device passwords and extract a full image.

AXIOM Examine Filter Updates

• Relative Time Filtering – Now it’s easier to prove attribution by applying a relative time filter on a timestamp, related to a key artifact of interest, and see all the activity (e.g. shellbags, jump lists) that occurred just before and after the time stamp.
• Accessible vs. Inaccessible File Filter – Allocated files/artifacts from allocated (accessible) space typically hold more investigative value in a case than files carved from unallocated space (inaccessible), so we’ve made it easier to separate the two types.

AXIOM Cloud Enhancements

AXIOM Cloud now highlights all extracted token (or iOS keychains) that can be used to authenticate and acquire data from cloud services — giving examiners the ability to extract cloud evidence without relying on user credentials

We’ve also brought in greater Office 365 functionality, with the ability to select specific files/folders to acquire from OneDrive and SharePoint instead of everything in the cloud — saving you time. You can also acquire Office 365 audit logs to view user actions, like what files were accessed and when.

New Artifacts in AXIOM 1.2.3

• iOS 9, 10, 11 Keychains – Insert the iOS keychain into AXIOM Cloud and use it to authenticate to cloud accounts connected to the iOS device.
• IP addresses and geo-location data from WhatsApp and Messenger audio/video calls (limited to computers as it is uncovered by reviewing browser artifacts left in the RAM.)