We’re continuing to make Magnet AXIOM faster and easier to use with each release. With Magnet AXIOM 2.7, we’ve incorporated acquisition, analysis, and reporting improvements, as well as improvements to GrayKey analysis, Magnet.AI and AXIOM Cloud. We’re also bringing in new and updated artifacts, including Windows 10 mail, QQ, and Naver browser.
Windows 10 Mail
As the default mail application on every Windows 10 machine, Windows 10 mail is used by many users who don’t want to sign into a web-based service (like Gmail) to access their emails. With AXIOM 2.7, you can find a new place to get emails, by retrieving emails from Windows 10 mail.
Finding Evidence Faster
With AXIOM 2.7, we’ve fine-tuned our carving algorithm to discard thumbnails recovered from parsed pictures, which greatly reduces the overall number of duplicate pictures that an examiner needs to review — we’re seeing scan time improvements up to 15% on evidence with heavy picture content.
AXIOM 2.7 adds further performance improvements in three key areas: unencrypted backup scanning, imaging progress, and report creation. Also, unencrypted iOS backups or GrayKey backup images can now scan up to 40% faster (dependent on case & workstation).
In addition to the creation of HTML reports now being up to 2.5x faster, portable cases now exclude extraneous information that can’t be reviewed — allowing for faster creation and a reduced case size.
Physical acquisitions for computers and some mobile acquisition methods also now display progress reporting during the process to give a better idea of time remaining.
AXIOM 2.7 makes it easier to use Magnet.AI by allowing you to configure Magnet.AI scanning in AXIOM Process (which could previously only be done in AXIOM Examine) to take advantage of machine time and processing overnight.
AXIOM can also now filter on deleted evidence as AXIOM 2.7 adds additional attributes to identify artifacts from deleted sources.
You can also now open a file in an external viewer/program by right-clicking it in the Artifact or File System Explorer and selecting the “open with” option. This capability can be key for reviewing evidence in hex viewers or previewing evidence that Examine won’t display, such as Photoshop or CAD drawings.
Magnet AXIOM Cloud Updates
With Magnet AXIOM 2.7, there is now faster loading for user and folder views in O365 and Box and we’ve sped up the time to load content from the cloud, meaning:
- Improved searching for individual users in an organization when logged in as an O365 or Box.com administrator
- A better experience when loading all users as an O365 or Box.com administrator
- Faster performance when loading the files / folder view when there are very large numbers of files and folders
New and Updated Artifacts
We’re always bringing new and updated artifacts to each release of AXIOM. Here’s what’s included in AXIOM 2.7:
New in Windows
- Windows 10 Mail
- QQ — A popular chat application in Asia, Europe, and the Middle East, we’re continuing to add support (in addition to previous mobile support)
- USB Devices 3.1+
New in iOS
- Screen Time Installed Apps on iCloud and family devices
- Apple Maps Trips — Allows examiners to review the list of all navigation trips searched for using Apple Maps. This artifact includes time stamps.
New in Android
- Naver Browser — Added support for the #1 web browser in South Korea. Also includes browser history support.
- WhatsApp (iOS/Android) — Added support for group chat member history, list of all user’s chats, and unread messages.
- Call logs (iOS/Android)
- KakaoTalk (Android)
- WiFi Profiles (Android)
- Safari Bookmarks (iOS)
- GrayKey Keychain (iOS)
- Email Attachments