XRY Intermediate

This course builds on the knowledge gained from XRY Certification, showing students how to carry out more complex data recovery techniques on a wide range of mobile devices, whilst also introducing them to deeper and more comprehensive data analysis following extraction, utilizing MSAB tools. Students will be introduced to XRY Cloud and XRY Photon, given an introduction into mobile application investigation, and consolidate learning throughout utilizing MSAB’s powerful XAMN Spotlight analysis tool.

This is the next level course after successful completion of the XRY Certification course with MSAB forensic tools. We assume you are now familiar with the basics of XRY and we take you through the next level of cell phone examinations and understanding, with an introduction to HEX, physical decoding, Apple Property Lists (PLists), Android XML documents, SQL analysis, and an introduction to investigating smart phone applications. The information provided is extensive and the course includes extensive hands-on exercises with feature phones, smartphones, memory cards, GPS navigation devices and a huge array of pre-acquired data sets from a range of devices for you to analyze throughout the course.

XRY Intermediate training builds confidence and expertise in our system and takes you through all the features and functionality available to ensure you get maximum value from your investment. Successful completion of this course will result in a formal certificate, ensuring the competence to meet the requirements of a mobile forensic examiner. After successfully completion of the Intermediate course, you are now confident and ready for the next level of training, the Specialist and Advanced level training courses.

Course Objectives

Day one

  • Introduction
  • Importing Backups (GrayKey, iTunes, Android, and JTAG/Chipoff)
  • Import iTunes Backup Exercise
  • XAMN Start Tab Layout and Options
  • Smartphone Alternative Methods – iDevice Security Code Bypass via Lockdown Exercise – Android Bootloader Exercise – Demonstration – Emergency Download Mode (EDL) and Raspberry Pi Zero W
  • Log File Analysis & Exercise
  • XAMN Spotlight Tab

Day two

  • Review of Day 1
  • XAMN Source Mode & Elements – Introduction to Binary and Hex Exercise – Binary Stream to Hex Exercise – ASCII from Binary Stream Exercise – XAMN Source Mode Exercise – XAMN Elements Exercise
  • Memory Cards
  • Micro SD Card Extraction Exercise
  • XAMN Spotlight Filters – Hashing your name with Hashcalc Exercise – Hashing/Re-Decoding Exercise – Hash Filter Exercise – Overview of XAMN Spotlight Filters – Pivot on Meta/EXIF Data
  • Smart Phone Profiles – XRY Photon Extraction Exercise – Logical Extraction of Unsupported Handsets Exercise
  • Chipsets – Chipset Identification – PinPoint Exercisew

Day three

  • Review of Day 2
  • XRY Cloud – XRY Cloud iCloud Extraction Exercise
  • PList, XML, and SQLite Databases – Sample Plist Analysis Exercise – Further Plist Analysis Exercise – Sample XML Analysis Exercise – Further Plist Analysis Exercise – Sample XML Analysis Exercise – SQLite Databases in XRY Exercise – Working with Databases Exercise
  • Investigation Smart Phone Applications – Investigating the Kik Application with XAMN Exercise – Exporting Entire iPhone Apps with XAMN Exercise – Investigating an Application Folder Exercise
  • Drone Data – Drone Data Exercise
  • Reporting – XAMN PDF Report Exercise – Message Report Exercise – XAMN Save Subset Exercise
  • Closure and Assessment
Book course

Available training types

  • Classroom
  • Online


  • XRY Certification

Course length

  • 3 days
  • 4 days

Available languages

  • English
  • French
  • German

Available locations

  • Canada - Live Online - EASTERN TIME ZONE
  • France - Paris
  • Germany - Berlin
  • Germany - Düsseldorf
  • Germany - Hamburg
  • Germany - Live Online
  • Sweden - Live Online
  • Sweden - Stockholm
  • USA - Arlington - Virginia
  • USA - Live Online - EASTERN TIME ZONE
  • USA - Orlando - FL
  • United Kingdom - Reading


Dates Language City Country Seats left

I am ready to book XRY Intermediate

Contact us

If you are a potential customer interested in learning more about our training, mobile forensic solutions or services, please use this form for your inquiry.