XRY used in Academic Training
New Program for Cyber Security at Manchester Community College uses XRY to teach students how to extract data from mobile devices.
If you are going to the expense of investing in a digital forensics tool like XRY, then make sure you also budget to invest in the operators too.
One of our customers has drawn our attention to a court case in the State of Western Australia, where the ruling judge prescribed the need for witnesses producing evidence to demonstrate that they have an effective understanding of how the product works. The court felt it was essential for the officer to be able to explain to the court that XRY was functioning correctly when it produced the evidence in question.
Quote from the Official Court Documentation:
Whether the text messages were admissible:
37 There are greater difficulties in understanding the second downloading process (from the mobile phone memory). The officer was not asked to explain this process in any detail, but he made mention of a web camera taking film of the text messages while they were displayed on the mobile phone. It was the first time he had experienced the relevant software and he did not have any formal training in its use. It was also his evidence that the software 'tried to do its best job at doing it'. To my mind this clearly raised questions as to the reliability of the software and of the officer's correct use of it. In my view, the prosecution failed to establish that the downloading process was of a type generally accepted by experts as being accurate, and that the particular downloading by the officer was properly performed.
It is difficult to think of a better example of why it is so important to ensure staff are adequately trained. This case is a good illustration of why it is not enough to simply use digital forensic tools. You also have to be able to explain the functions performed and why the information produced can be relied upon by the court. The court will base much of their assessment on the strength of this evidence.
XRY Training Courses are essential to help you become confident in the presentation of evidence and provide documentary proof of your competency on the forensic analysis of mobile devices with XRY. These classes are hands on with a wide variety of mobile devices to give you practical experience in understanding and explaining XRY reports. When you successfully complete the courses, you will be issued with a Certificate from the equipment manufacturer - which helps demonstrate to the court, that you have the required skills to provide commentary on the results produced by XRY.
For more information about our training courses please visit the web pages here >>
For some time now we have been testing beta versions of XAMN - the new analytical software tool from MSAB designed specifically for phone forensics.
XAMN creates a new market sector for analytical solutions with the unique ability to review forensic extractions to the same level of granular detail available in XRY, where you can see images and read SMS details, but on a whole new scale - up to 25 device files all at the same time.
It's a powerful new tool to complement XRY, which allows quicker understanding and assessment of information for our customers. It can facilitate the explanation and presentation of data in court and is user friendly enough to be understood by beginners with just one days training.
A tool purpose built for phone forensics which handles all of the challenges of time stamp normalization and viewing of image files with ease. XAMN is perfect for performing a search across a complete set of devices in one go and allows users to immediately visualize links, times and maps.
Why is it needed?
Well put simply there is simply too much data available these days, commonly referred to as BIG DATA - it seems that almost all of our customers now receive multiple mobile phones when investigating any case or operation. This combined with the increasing volume of data available in smartphones makes overwhelm a real problem.
In one of our Beta test sites we were able to help a team of several examiners speed up the analysis work significantly. They had been going through all the data recovered from the mobile phones on spreadsheets and it had taken them weeks to get to grips with the information. Within a couple of hours of using XAMN, they had identified two new suspects, which had not been apparent before.
With XAMN users will now be able to:
For more information please visit the product page here >>
MSAB will introduce support for XRY on the Windows 8 platform later this year. Conversely we will be ceasing technical support for XRY on the Windows XP operating system before the end of 2013.
We are giving you advance notice, so you can have the maximum time to plan ahead and advise relevant IT departments of this impending change.
Windows 7 support is not affected by this announcement and will continue as normal for both 32-bit and 64-bit support.
Microsoft has announced that it will cease all support for Windows XP in 2014 now they have launched Windows 8 and we anticipate increasing demand for XRY to run on this new platform from customers. As a result we will be introducing support for Windows 8 this year to meet this demand.
As we manufacture a validated forensic tool we are required to test XRY on all variations of all operating system platforms we support. The time and work load implications mean we cannot support legacy operating systems indefinitely, so as these Microsoft operating systems continue to diverge we have to move towards more modern versions.
There is a high probability XRY will continue to work on Windows XP for some time after we cease official support, as it has worked on XP since 2004, nevertheless official support will cease by the end of the year.
For more details and information you can contact email@example.com
The development department at MSAB are working hard right now to finalize the details of our new 64Bit version so customers can benefit from using XRY on the latest computer hardware.
This is a major project requiring a re-write of many of the legacy drivers for cell phones, GPS devices and portable media players, which we currently support. XRY is a forensic tool and requires validation, so we subject all the new solutions to extensive testing, so there is a lot of verification going on right now which does take some time.
In the meantime we made a breakthrough with iOS support for older models allowing us to bypass a complex passcode on the iPhone 3G, iPhone 3GS, iPhone 4 GSM, iPhone 4 CDMA, iPod touch 3G, iPod touch 4 & iPad 1.
So if you have a XRY Physical or Complete license you will now be able to bypass the passcode to access data on these devices.
We didn’t want you to wait for this and with the launch of the new iPhone and iOS 6 this week; it seemed an ideal time to provide you with some additional features. So now you extract data from some phones with the latest Apple mobile operating system and you can also bypass a complex passcode to extract more data faster than ever before with XRY.
Where possible we recommend brute force on a simple passcode, because once the passcode is known we can unlock the device and recover more data that would have otherwise been encrypted, such as emails. However if no alternative exists and you don’t want to to take several weeks to brute force a complex passcode then this is an ideal solution.
For more details of how the new feature works download the
v6.3.2 release notice here >>
Fingers crossed XRY v6.4 will be released in the coming few weeks and all users will then be able to benefit from this new improved version of the leading phone forensic tool.
In the meantime keep your eye out for the launch of an entirely brand new product to be announced next week called XAMN.