MSAB XAMN: Analysis, Visualization, and Court-Ready Reporting

The unified platform designed for forensic examiners and investigators to efficiently search, filter, and report on massive volumes of digital evidence from any source.

Key Analytical Views for Rapid Triage

XAMN Pro offers specialized, dynamic views that transform complex data into clear, actionable intelligence, accelerating the path to relevant findings.

The XAMN Analysis and Reporting Workflow

A reliable, four-step process for managing large datasets, filtering noise, and preparing evidence for legal proceedings.

• 1

  Ingestion of Multi-Source Data and Integrity Check

  Load data from various digital and analog sources, including XRY files, third-party extractions (UFDR, raw dumps), Call Data Records (CDRs), drone logs, and warrant returns. XAMN automatically verifies file integrity by checking embedded hash values.

• 2

  Advanced Filtering and Search Triage

  Utilize real-time filters based on artifact type, date, participant, and content. Features like Quick Views, text search with wildcards, and the ability to exclude known NIST/MSAB reference data significantly speed up the triage process.

• 3

  Artifact Pivoting, Tagging, and Annotation

  Investigators can pivot their search directly from a single artifact (e.g., filter all activity around a specific message's timestamp or location). Relevant findings are organized using custom tags and Examiner Notes to build the case narrative.

• 4

  Court-Compliant Reporting and Export

  The Report Builder uses drag-and-drop functionality and customizable templates (including chain of custody) to generate professional, accurate reports. Findings can be exported in various formats, including PDF, HTML, XML, Excel, and VICS, or as an XRY subset for review in XAMN Viewer.

Deep Recovery and Forensic Integrity Features

Beyond analysis, XAMN Pro provides expert-level tools to recover fragmented data and ensure the reliability of evidence.

• Advanced Hex Carving: Enables expert users to search, reconstruct, and validate undecoded, fragmented, or deleted data that is not parsed automatically by the system.
• File Mismatch Identification: Detects when a file extension has been manually altered (e.g., a video renamed to an image extension) to disguise its true content, preventing misclassification of evidence.
• Visual Image Similarity (Dhash): Calculates dhash values for images, allowing investigators to find visually similar images even if the file's hash value was altered by compression, cropping, or applying a filter.
• Project VIC / CAID Integration: Includes functionality for integrating with child abuse image databases (VIC/CAID), allowing pre-categorization and rapid exclusion of known illegal content.
• Multilingual Support: Ensures that text and data in a wide variety of languages can be accurately searched, filtered, and presented without manual translation barriers.
• Person-Centric Analysis: Automatically links identifiers (email addresses, phone numbers, app usernames) found across multiple artifacts to a single Person of Interest profile for comprehensive analysis.