Magnet AXIOM 1.1.2 is now available — bringing with it enhanced integration with Griffeye and Project VIC, as well as significant developments in mobile acquisition, Portable Case, and BitLocker decryption.
Enhanced Integration with Griffeye and Project VIC
As we recently announced, AXIOM 1.1.2 will feature deeper integration with Griffeye and Project VIC for enhanced digital forensics analysis in child exploitation cases.Quickly add media files that have been categorized in Griffeye directly back into AXIOM for more holistic analysis and reporting, and get a simplified workflow that will save time and effort as you work to analyze and share all findings for the whole case with investigative teams – from categorized media files, to messages, to location and timestamped data, to system data.
Mobile Acquisition Updates
If a Samsung mobile device is locked or you can’t gain privileged access to it, you can now flash a recovery image to the device so you can acquire evidence from it — getting more data than if you performed a quick image. This will work on over 650 different Samsung devices, with more Samsung and other Android devices being added to future releases.
You can now also connect mobile devices and media devices that support the media transfer protocol (MTP) to acquire media content, downloaded content and basic app data.
And because newer versions of certain apps no longer back up files in Android, AXIOM now gives the option to downgrade Android applications to allow those apps’ data to be backed up by installing an older version of the app.
Portable Case Improvements
Portable Cases generate more quickly than ever before, with overall sizes being 1GB smaller than in previous versions of AXIOM. In addition, AXIOM now leverages Turbo.net’s container technology to better manage dependencies on other technology or libraries, meaning that you will no longer need to have administrative access to view portable cases and you will not need to worry about installing all the necessary dependencies first.
Other Additions and Enhancements
1. AXIOM can now decrypt BitLocker encrypted evidence using the recovery key, which can be entered in the exact same field as the password is currently entered in.
2. Keyword searching improvements – ‘All content’ keyword searches are now three times faster and keyword hits from Unicode encoded evidence are now more reliable.
3. New artifacts – Get data from Shimcache, installed programs, and executed programs for Windows XP, Vista, 7, 8, 10 — showing whether certain applications have been installed and deleted to prove intent, and providing a stronger timeline analysis.