XRY Pro: How the Advanced Extraction Solution from MSAB Takes on the Toughest Tasks and the Most Challenging Devices


The rapid advancement of technology has resulted in an increased demand for state-of-the-art forensic tools. 

As mobile phones continue to evolve at an unprecedented pace, so do the methods of securing data from them. Device manufacturers are consistently implementing complex and sophisticated security measures to protect the data on their devices. That, in turn, can make it more challenging to access critical evidence that could turn the tide in an investigation. 

Digital forensic experts need to keep up. 

That’s where XRY Pro comes in. Whereas the base version of XRY has a strong focus on its streamlined interface and ease of use even for less experienced examiners, XRY Pro ensures that investigators get access to state-of-the-art unique exploits right off the bat.  

In this article, we’ll take a closer look at XRY, the most advanced extraction and decoding tool from MSAB, some of its unique features, and the tremendous impact it can have on your organization’s success. 

Let’s get started.  

What Is XRY Pro? 

XRY Pro is the pioneering tool when it comes to extraction and decoding. An advanced tool for advanced users, XRY Pro is the product to meet the challenge whenever an investigation requires mobile extraction of data from the most modern, high-end handsets. In XRY Pro users will always find the newest of MSAB’s exploits.  

As new security measures are implemented, MSAB developers work to identify vulnerabilities and develop new exploits to bypass them. This ensures that examiners can continue to access data from mobile devices, even as security measures become more sophisticated. 

“XRY Pro takes our advanced and recently developed zero-days and puts them in the XRY environment”, says Martin Westman, Exploit Research Manager at MSAB. “For the investigators using the exploits there might be some differences in the procedure, it was born from the lab environment of command line tools, but is now integrated into XRY Pro.”  

XRY Pro is the perfect solution for experienced users who want to perform unlimited unlocks and extractions using their own equipment. Specialized on-demand training to understand the exploits and unlock their full potential is highly recommended, as Adam Firman, MSAB Tech Evangelist mentions.   

“It is exploits that are harder to implement but that we want to get in the hands of our users. It requires more training to get the full benefit of the features, but when you are working with a modern Android device XRY Pro can mean the difference between a successful mobile extraction and remaining locked out.” 

Check MSAB’s wide array of mobile forensics training and courses. Take a look at the Course Schedule for more information on when the courses are held. 

A Passcode Extractor Extraordinaire 

One unique feature of XRY Pro is its ability to create a RAM dump from a high-end Android phone despite the device being locked, and then decrypt its data. Strong passwords and locked phone encryption are everyday problems for law enforcement, but XRY Pro features solutions not found in any other product on the market. Adam Firman explains: 

“Once I unlock my phone and put my passcode in, then do some stuff with it, my passcode is still in RAM. I lock my phone, and then XRY Pro comes along. With its one-of-a-kind capabilities, this software will work to extract the data, decrypt the data and let you into the phone and make sense of its content.” 

The Difference Between AFU and BFU 

When a phone is on and has been unlocked via passcode at least once, as in the scenario above, it is in a state called AFU – After First Unlock. This is when the passcode is likely to be found in RAM. On the other hand, when a phone is turned off, or the passcode has not been entered since it was turned on, it is BFU – Before First Unlock. In this case, a RAM dump might not contain the passcode.  XRY Pro will then use brute force techniques to find the passcode of the phone, systematically trying out various combinations of digits until the correct code is found.  

MSAB will always work for helping forensic examiners, digital media investigators and other users acquire and analyze mobile data faster and better. XRY Pro is the latest in a long line of advancements meant to make processes and operations smoother for digital forensic investigators. Discover more ways to streamline your digital forensic investigations with the ultimate DFIR Efficiency Playbook.

Download E-book

More good news is that MSAB are excited to announce an industry first BFU breakthrough which will open up broad support for the UNISOC chipset range.

XRY Pro in a Nutshell 

XRY Pro is the tool for forensic examiners who need to examine the latest handsets and require the very latest exploits from MSAB developers. These exploits give experts a better chance to keep up with the latest technology and access the crucial data they need. 

XRY Pro’s unique capabilities, such as its ability to create a RAM dump from a locked Android phone, make it an essential tool for forensic investigations. With XRY, examiners can quickly and efficiently access the contents of locked phones, even in the most challenging situations.  

Take Your Investigations to the Next Level: Make XRY Part of Your Forensic Toolbox  

As security and encryption measures in modern mobile devices continue to advance, law enforcement and other organizations may face difficulties in accessing mobile data through traditional methods and cables. XRY Pro is a software suite that offers advanced exploits, providing high-level phone access capabilities for even the most challenging devices, and enabling investigators to access data that may have previously been impossible to extract. Add to that the fact that you can perform unlimited unlocks and extractions, and you’ve got yourself a top-of-the-line solution that can make all the difference in a digital investigation.  

Read more about other capabilities that set XRY apart, such as its unique exploits and top-of-the-line decoding abilities and its rapid hash matching feature.  

If you’re new to MSAB tools and solutions, you can experience the brilliance and power of XRY and observe first-hand the benefits it can bring to your organization. Get a 30-day trial and see how it can help your team find evidence that matters fast, in a secure, efficient, and lawful manner. Get in touch with our Sales team today. 

Contact Sales