MSAB XRY: The Global Standard in Mobile Forensics

Fast, forensically sound data extraction and recovery from over 42,000 device profiles, maintaining full evidential integrity for court.

Extraction Methods for Maximum Access

XRY provides the most comprehensive range of acquisition methods to ensure critical data is secured from the widest variety of devices and operating systems.

Specialized Decryption & Forensic Integrity

XRY’s engine is specifically designed to bypass and handle advanced security measures, ensuring data is unlocked, decoded, and forensically sound.

• Advanced Decryption: Automatically handles complex encryption schemes, including Full Disk Encryption (FDE), File-Based Encryption (FBE), and decrypting raw chip data using recovered hardware keys.
• XRY Pro Advanced Access: Utilizes unique zero-day exploits, brute-force tools, and tailored techniques to gain access to the most challenging, locked, and encrypted devices.
• Deleted Data Carving: Sophisticated proprietary algorithms recover highly fragmented files and artifacts from the unallocated space of physical dumps, maximizing recovery.
• Evidential Integrity: All data is stored in the secure, verifiable .XRY container format, embedding cryptographic hash values (SHA256) and a detailed audit trail.

The Secure, Repeatable XRY Workflow

The defined four-step process guides investigators from device connection to court-ready evidence.

• 1

  Device Triage and Profile Matching (42,000+ Profiles)

  The system automatically detects the device model and security status, matching the optimal, non-destructive extraction profile from its library of over 42,000 supported devices.

• 2

  Acquisition Execution and Data Acquisition

  The selected method (Logical, Filesystem, Physical, or Cloud) is executed in a strictly read-only manner, ensuring the original evidence remains untampered.

• 3

  Decoding and Verification

  The raw extracted data is immediately decrypted and decoded using XRY’s extensive parsing library, automatically validated with cryptographic hashes, and stored in the secure .XRY file.

• 4

  XAMN Analysis and Reporting

  The decoded .XRY file is instantly ready for deep analysis in the integrated XAMN software for searching, filtering, timeline correlation, and generating court-ready reports.

Platform Extensions & Specialized Tools

XRY ensures comprehensive evidence collection across all digital touchpoints.

• XRY Cloud: Secure, warranted extraction of evidence from linked cloud-based services and backups (e.g., social media, remote storage).
• XRY Photon: Utilizes screen-scraping and guided manual input for difficult-to-extract apps that resist traditional parsing methods.
• Drone and IoT Forensics: Dedicated capabilities to extract and decode flight path logs and media from drones, wearables, and other IoT devices.
• XRY PinPoint: Specialized connectivity for non-standard or feature phones by automatically identifying their unique connector pin-outs.
• Python API: Provides programmatic control for advanced users to automate extraction processes and integrate XRY into lab management systems.
• Selective Extraction: Allows investigators to filter the extraction process by data type, time range, or specific app for targeted collection.