The latest version of Magnet AXIOM is now available for customers to download — bringing with it new acquisition capabilities with iOS 11 and Android O, new artifacts support, and enhancements to AXIOM Examine and Connections.
AXIOM 1.2.1 Brings Support for iOS 11
In addition to the ability to acquire from iOS 11 (as well as Android O), AXIOM 1.2.1 now features improved iOS artifacts — including iMessage, SMS, MMS — and the ability to retrieve proprietary photo/video formats found on Apple iPhones: .HEIC/.HEVC.
At this time, you can parse, carve, and preview HEVC files, and you can parse HEIC files. Carving and previewing HEIC files isn’t supported within AXIOM yet, but we are working hard on it. In the meantime, you can check out a great overview of the new file format and how to convert the files into jpges at Cheeky4n6Monkey’s blog.
Enhancements to AXIOM Examine
AXIOM 1.2.1 brings some improvements to AXIOM Examine that will help examiners in the course of their investigations.
Users can now save a file/file type found in the file system and use it as an examiner-defined artifact. These will work with existing sorting, filtering, and timeline capabilities in AXIOM and can be included with other artifacts in Portable Case and other report formats. This capability is important for examiners that are looking for specific evidence sources that aren’t pre-configured artifacts (e.g. Open office documents, MP3 files.)
For those that have explored the new Connections feature, you’ll notice a number of bug fixes and UI improvements that will make Connections faster and easier to use — particularly the ability to jump straight to analysis while the Connections processing task runs and enhanced status indication. Additionally, chat threads will now be easier to read in AXIOM 1.2.1 since duplicate chat threads will be removed, and files which don’t contain “plist” in the file extension will now be viewable in AXIOM’s plist viewer.