Encrypted chat apps can be some of the hardest nuts to crack — especially when someone is trying to cover their tracks in advance — but they can also be vitally important to an investigation.
Signal is a popular chat app with an emphasis on privacy. It uses encryption on in-transit data, and Magnet AXIOM now parses and carves for chat and comment data in the Signal app for Android smartphones.
In cases where the user doesn’t set a password, application data can often be recovered and decrypted. Even if decryption is not possible, group and user information, and information about messages can still be recovered, although the actual message and attachment content won’t be available.In addition, latitude and longitude from location messages is also recoverable from any message that a user sends that includes their current location.
For instances when the user does set a password, you can provide a list of potential passwords for AXIOM Process or IEF to use as the key for decrypting the data. Once decrypted, message content and attachments are also available.
Other Improvements and Resolved Issues
The latest version of AXIOM includes significant improvements in carving time as part of our continuous efforts to enhance performance and get our customers to the analysis stage faster.
AXIOM 1.0.11 also resolves a performance issue that customers reported at the end of February. As always, we are listening and we’re acting on your feedback quickly.
If you haven’t tried AXIOM yet, or would like to see the new features in action, request a trial or schedule a demo.
Customers can view the full release notes and download AXIOM 1.0.11 on the customer portal.
AXIOM Adds New Features Regularly
Check out these posts for more information on new features and new artifact support:
Magnet AXIOM 1.0.10 Now Lets You Decrypt iOS 10.2 iTunes Backups
Magnet AXIOM 1.0.9 Brings Improved Reporting and iCloud Backups
The Top Five New Features in Magnet AXIOM 1.0.8
