What is XRY?

XRY is a software application designed to run on the Windows operating system which allows you to perform a secure forensic extraction of data from a wide variety of mobile devices, such as smartphones, gps navigation units, 3G modems, portable music players and the latest tablet processors such as the iPad.

Extracting data from mobile / cell phones is a specialist skill and not the same as recovering information from computers. Most mobile devices don't share the same operating systems and are proprietary embedded devices which have unique configurations and operating systems. What does that mean in terms of getting data out of them? Well in simple terms, it means it is very difficult to do.

XRY has been designed and developed to make that process a lot easier for you, with support for over 8,000 different mobile device profiles. We supply a complete solution to get you what you need and the software guides you through the process step by step to make it as easy as possible.

   

Multiple Extraction Wizard

The latest version of XRY includes the Multiple Extraction Wizard as standard. This functionality allows users to examine 3 different mobile devices all at the same time, to speed up the time taken to perform examinations and ensure you make the best use of your time. 

There are several different XRY variants available depending upon your needs:

 

XRY Logical

This is our most established product designed to perform a 'logical' extraction of data from the mobile device.

What this means is that we communicate with the operating system on the device and request information from the system. In general terms this will allow you to recover most of the live data from the device.

It is effectively the automated equivalent of manually examining each available screen on the device yourself and recording what is displayed.

XRY Logical is by far our most popular product, useful for the vast majority of our customers and their tasks.

XRY Physical

Is more advanced - it allows you to perform a 'physical' extraction from a mobile device. Where we recover all available raw data stored in the device. Typically this is performed by bypassing the operating system and this offers you the opportunity to go deeper and recover deleted data from the device.

A physical extraction is separated out into two distinct stages, the initial 'dump' whereby the raw data is recovered from the device and then the second stage 'decode' - where XRY can automatically reconstruct the data into something meaningful; such as a deleted SMS without the need for manual carving of data. 

XRY Physical is particularly useful when faced with a GSM mobile phone without a SIM Card, or with security locked devices.

XRY Complete

This is our top of the range solution combining the best of both worlds with XRY Logical and XRY Physical in one complete package, hence the name.

With XRY Complete you will be able to perform both logical and physical extractions from a device, giving you the best possible opportunity to recover all the available data from a mobile device. Allowing you to compare the results between the different recovery methods.

This system is supplied with all the necessary hardware from both the Logical and the Physical systems to ensure you have everything you need to do complete the task.

XACT

XACT is a separate hex viewer software application which complements XRY Physical, allowing examiners to view the raw hexadecimal data extracted during a physical dump of a mobile device.

Whilst XRY Physical supports a considerable amount of automatic decoding, there will always be times when an examiner needs to look at the original data for themselves to establish the source of information. XACT provides mobile forensics specialists with the ability to examine that data in detail.

With XACT you can import binary files from other sources if required and view the hexadecimal data to see for yourself exactly where the data is.

SIM id-Cloner

This product can be purchased stand alone or as part of the XRY Logical & Complete packages.

It is specifically designed to assist you in the forensic recovery of data from GSM SIM Cards and also provide a secure environment for forensic examiners to investigate a mobile device free from the risks associated with examining GSM devices.

SIM id-Cloner will allow you to create a replica of the SIM card found within a mobile device so that you can enable the operating system without the risk of it making a network connection and changing data held on the device.