Magnet AXIOM 3.11 is now available to download within AXIOM or over at the Customer Portal. AXIOM 3.11 brings you new Device Identifiers — with device information like IP addresses and camera serial numbers — as well as support for .dar files from Cellebrite Advanced services and a number of new and updated artifacts, like Signal and Apple Pay.
You may be familiar with person identifiers within AXIOM — information like usernames, email address, and phone numbers — but with AXIOM 3.11, we’ve introduced Device Identifiers, enabling you to associate device information such as IP addresses, MAC addresses, and camera serial numbers to a specific person.
DAR File Support
You can now process .dar images created using Cellebrite Advanced services or from acquiring a device that was jailbroken with checkra1n and they contain three time stamps (Changed, Modified and Accessed).
Processing the .dar file with the system_metadata.plist will allow for Creation times to be included in your evidence. Processing a .dar file without the accompanying system_metadata.plist will result in a fully processed case without Creation times. In order to load both files, please point AXIOM to the .ufd file when loading your evidence.
Enhancements to ADB (Unlocked) Acquisition for Android Devices
AXIOM 3.11 introduces enhancements to the ADB (Unlocked) acquisition process for Android devices, allowing you to perform more targeted acquisitions by selectively choosing the acquisition methods used.
Now you can selectively choose to acquire live data from the device, attempt to perform a device backup and SD card acquisition, and acquire data via the Magnet acquisition agent which attempts to collect information including contacts, calendar data, downloads and more.
Learn more in this video from Tarah Melton:
- Apple Pay Transactions (iOS)
- Device Identifiers (iOS)
- Photo Albums (iOS)
- Photo Information (iOS)
- Threema (iOS)
- Signal (iOS) (Get a deeper dive into Signal in this blog from Mike Williamson)
- Significant Locations (iOS)
- Messenger (iOS/Android)
- Installed Applications (iOS)
- Google Maps (Android)
- Secure Notes (iOS)
- API Hooks (Windows)
- Instagram (Android)
- VK (iOS/Android)
- Amcache (Windows)
- Pictures (macOS/Windows)
- UserAssist (Windows)
- Prefetch Files (Windows)
- Remote Desktop Protocol (Windows)