Mobile data extraction

Retrieving the optimal forensic data is what matters. MSAB helps you through the challenges of mobile data extraction. Recover data fast, in a secure, efficient, and lawful manner.

Data extraction

Mobile data extraction

MSAB is the world leader in providing forensic technology for mobile device data extraction and analysis. The services and products offered have privacy and the rights of the innocent at heart, while also ensuring the evidence extracted is reliable and forensically sound.

Our world is more digital than ever before and with people carrying all sorts of mobile digital devices all the time, digital evidence is critical in solving most crimes today. Being able to extract that evidence quickly and correctly is essential – otherwise investigations can end up blocked, at wrong conclusions, thrown out and perpetrators can go free.

MSAB has developed a unique toolset to aid investigators with cell phone and mobile device data extraction: the XRY family. It is the flagship of the MSAB portfolio with the newest version of XRY being even more powerful, intuitive and efficient than ever. It lets forensic specialists as well as field and frontline users extract more high-quality data in less time than ever before, while always fully maintaining the integrity of the evidence.

With XRY you can work better, faster and smarter since the XRY products are constantly being updated to help you recover data from more mobile devices and apps.


Get started

Mobile data extraction -> lawful access and analysis to digital intel

MSAB provides you with top mobile data extraction solutions to speed up your operations and to allow you to easily acquire and analyze evidence and intelligence from more mobile devices with greater functionality and control.

Frontline Extractions

MSAB understands the current challenges facing frontline personnel in the first few critical hours. You need to find vital evidence, insights and intel as quickly as possible. We can help.

Lab Extractions

In modern forensic labs you need solutions that can bypass device locks, acquire passcodes, extract, and decode digital evidence and intel — quickly and in a forensically sound way.


XRY Logical

XRY Logical is the starting place for your investigation – it is the quickest extraction method because it enables you to access and recover live and file system data from the device right at the crime scene. XRY Logical extracts the data from digital devices by communicating with the operating system.

XRY Logical is the starting point for our license options and an entry-level solution for your mobile device data extraction needs. It works on Windows-based computers and comes with the necessary hardware.

Mobile data extraction through XRY Logical offers an intuitive and user-friendly interface, logical extraction of, for example, SIM cards and SD memory storage, and a tamper-proof customizable XRY report to suit your needs, references and organization. In addition, the unique Device Manual Help File assists you in distinguishing which information you can and cannot expect to be recovered from a device.

XRY Express

XRY Express is a user-friendly cell phone data extraction software, with a simplified interface that guides users step-by-step though their mobile device data extractions. It is the same software that runs on the MSAB Kiosk and MSAB Tablet platforms and is now installable on Windows-based PCs.

With the XRY Express, non-expert users can quickly perform their own mobile device extractions and analyses. For example, field-based investigators can uncover evidence quickly this simplified, locked-down workflow with approved and consistent processes.

XRY Cloud

XRY Cloud is a separate component within the XRY software, requiring a separate license. As the name implies, XRY Cloud recovers data beyond the mobile device itself from connected cloud-based storage. This is particularly useful when looking for online social media data and app-based information. Smartphone apps use credential tokens held on the device to verify identity automatically without having to enter details repeatedly. These tokens offer forensic examiners the opportunity to recover data from cloud-based storage centers for services such as Facebook, Google, iCloud, Twitter, Snapchat, WhatsApp, Instagram Cloud and more.

Data can be recovered in two modes: automatic and manual. Automatic mode can be used when you have the actual device in your possession. Here you acquire the app tokens needed for the recovery of cloud data with the assistance of the standard XRY smartphone extraction. This will also help you locate other data online.

In contrast to automatic mode, in manual mode you do not need to have the device in your physical possession. Data is recovered by entering user ID and password login details, recovered from alternate sources, for app services.

Get started

  • Solving child exploitation case with the right digital intelligence solution

    Catching the perpetrator in time while preserving the victims right to privacy was the main goal for the Internet Crimes Against Children Task Force. To enable this to happen it was necessary to find a solution that would only recover the vital digital evidence without compromising people’s private data. More on this true story in the video.

    Download case

  • The only solution to select the digital evidence you need

    The need to understand the legal grounds for recovering digital evidence from mobile phones while maintaining the fundamental rights to privacy is increasingly important to our industry. We at MSAB are passionate about helping our customers acquire mobile data from more devices while emphasizing the right to privacy for victims and witnesses.

    Learn more   Contact an expert


Ten reasons to choose XRY over other mobile extraction softwares

  • More data recoverym from over 40,000 mobile devices and app profiles.
  • Quickly refine extractions to data categories, apps or individual files within specified time ranges.
  • Simultaneously extract and decode data from three phones at a time with a single license.
  • Decode images with automated image recognition up to 20 times faster with Nvidia CUDA enabled GPUs.
  • Support for the latest Android and iOS versions.
  • Recover and decode Warrant Returns, Cloud Data and iCloud Backups.
  • Secure your chain of evidence in a forensically sound file format with a complete audit log.
  • Includes XRY Photon for acquiring unencrypted data from encrypted apps, when other methods don’t work.
  • Market leading support for Chipsets like Exynos, Qualcomm, Kirin, MTK, Spreadtrum, Coolsand & Infineon.
  • Retrieve more location data along with related timestamps from embedded files in both iOS and Android databases.
  • XRY helps in solving a triple homicide

    “We worked on a very tragic case, but I’m happy to report we were able to make an arrest. XRY proved to be very valuable to our investigation. We used the digital intel obtained through the extraction to question the suspect on inconsistencies, and he ultimately confessed.

    I must say, I’ve worked with numerous companies throughout my law enforcement career and I’ve never had a company be more responsive than MSAB. I really respect that so many of your employees are former law enforcement or have a familiarity with what we do and understand the challenges of making sure that the digital evidence must be admissible in Court.”

    – Lieutenant, Sheriff’s Office in the US

    Sign up for a free trial

  • XRY recovers crucial mobile forensic evidence to secure a conviction

    When the former Olympic sprinter Oscar Pistorius admitted shooting his girlfriend Reeva Steenkamp, there was no need to prove who was responsible for her death. Instead, the question became whether the shooting was in self-defense, an accident, a crime of passion or a premeditated action.

    The XRY data recovery software retrieved the deleted WhatsApp messages from the phone of a scared Reeva Steenkamp and helped seal the conviction.

    Learn more about our solutions

  • XRY- best mobile forensics solution for demanding situations

    • I have used both XRY and other systems in tactical and strategic commands. I find XRY has many advantages over the competition. It’s an easy choice if one has tested for themselves the abilities of each system as I have.

      – A commander, The United States of America

    • Download product overview
  • Top-notch mobile forensics training

    Well-pitched delivery for novice as well as more experienced students. Workbooks are very useful for future reference when in the field.

    • – XRY Certification Feedback

    Book Your Course Today!

Mobile extraction

XRY Photon

XRY Photon is included in our XRY Logical product and does not require a separate license. XRY Photon is like an automated version of manual app examination for Android devices. As app versions and security protocols are constantly improving, mobile extraction tools can fail to extract decrypted app data. XRY Photon can acquire Android app data when other tools cannot while providing storage for the documented data so that searching, filtering and other types of analysis is possible.

XRY Photon is available in two modes: Automatic and Manual. The automatic mode is extremely fast and requires very little interaction as it is tailored to the structure of the supported apps. Currently WhatsApp, WhatsApp Business, Signal and Telegram are supported. The manual mode requires more user interaction but supports extracting virtually any app that allows taking screenshots. It is a highly flexible tool and ideal when you examine an app that does not have automatic mode support.

XRY PinPoint

XRY PinPoint is the solution for extracting data from non-standard mobile devices, such as cheap imitation phones from Asia. The connector pin-outs are the main forensic challenge here, as they vary and may not even be known. As PinPoint can automatically detect the pin-out configuration required to communicate with the mobile device, this solution is comprised of both compact hardware and powerful software.
Decoded data can range from call logs and contacts to deleted data and chip IDs.

XRY PinPoint requires a separate license but is fully integrated and uses the familiar and easy-to-use XRY Logical/Physical interface. This then enables the use of the software’s powerful decoding functionality. With the specific PinPoint software being regularly updated, the usual frozen firmware is avoided as they go out of date quickly.

XRY Camera

XRY Camera is a separate, hardware-based solution requiring a separate license. It gives forensic examiners the opportunity to complement XRY reports with actual pictures and video taken with a HD camera. In some cases, the only way to capture relevant evidence and help validate device extraction results is to take a screenshot, document unique smudge markings or other unusual identifying features of the smartphone or capturing the IMEI on the sticker behind the phone battery. These all might be critical evidence to a case, and the XRY Camera provides them while done in an evidentially sound matter providing another layer of credibility to your case.

XRY Logical

The starting point for mobile forensics

XRY Logical is the quickest extraction method as it enables you to access and recover live and file system data from the device right at the crime scene. Read more about XRY Logical, the fast and efficient forensic tool for mobile phone data recovery.

Contact us

XRY Physical

Get greater access to system and deleted data

XRY Physical lets examiners bypass the devices operating system to allow access to protected and deleted data; it also allows them to overcome certain security and encryption challenges on locked devices. Read more about XRY Physical, a data recovery software to bypass the mobile operating system.

Contact us

XRY Photon

Acquire Android app data when other tools can’t

XRY Photon Manual lets you recover smartphone app data that is inaccessible through normal extraction techniques, using an exclusive screen-scraping function to capture the data electronically. Read more about XRY Photon.

Contact us

XRY Cloud

Recovery of data beyond the mobile device

XRY Cloud recovers data from beyond the mobile device itself by examining connected cloud-based storage. This is particularly useful when looking for online social media data and app-based information. Read more about our cloud forensics solution.

Contact us

XRY Express

Uncover evidence quickly with a simplified, locked-down workflow

XRY Express provides a simplified, locked-down workflow for mobile device extractions, enabling quick and easy processing by field-based investigators and others. Read more about XRY Express, our user-friendly mobile device data extraction solution.

Contact us

XRY PinPoint

The solution for non-standard mobile devices

XRY PinPoint lets you extract and decode data from non-standard mobile devices, such as cheap imitation phones from Asia. Read more about XRY Pinpoint, our data extraction solution for non-standard mobile devices.

Contact us

XRY Camera

Gather more picture and video evidence

XRY Camera gives forensic examiners the opportunity to complement their XRY reports with photos of the examined device from an HD camera. Read more about XRY Camera.

Contact us

Accelerate your mobile data extraction speed for iOS devices

Are you a digital forensic examiner or investigator?

The Checkm8 exploit is now integrated in XRY, enabling faster iOS data extractions.

Get started

In our testing, XRY has demonstrated that it has the necessary resources in place to help support us as examiners and the MSAB team are working hard to implement their research and development into the functionality of the tool.

Patrick Siewert
– Principal Consultant of Pro Digital Forensic Consulting

Contact us about mobile data extraction

If you are a potential customer interested in learning about our mobile device extraction solutions or services, please use this form for your inquiry.

"*" indicates required fields

FAQ – Mobile data extraction

What is mobile data extraction?

Mobile data extraction means accessing and recovering data, such as apps and files. More specifically, MSAB specializes in extracting data from mobile devices such as cell phones and tablets. Data extraction is vital in many operations today since mobile devices are ubiquitous in our modern world. Extracting data from mobile devices can speed up investigations and offer results faster, yet still in a secure matter, with sound digital evidence.

Mobile data extraction is critical in many fields but especially so in the military context. The world of military operations today is heavily focused on preventing and combating terrorism and serious criminality. Digital information extracted from phones, drones and vehicle information systems are critical sources of intelligence which can potentially save lives and achieve mission success on the battlefield.

What is a mobile data extraction software?

A data extraction software is a program on either a mobile device or computer that can assist investigators to access data on digital devices. XRY is the flagship data extraction and recovery software that runs on the Windows operating system. The latest version of XRY supports data recovery from more than 40,000 devices and app profiles and has the formal support for the latest version of iOS.

How can data be extracted from a mobile device?

Data can be extracted by using specific software, such as the XRY products. The data is extracted from digital devices either directly from the device memory or by communicating with the operating system. MSAB has focused on “selective extraction”, meaning that, for example, law enforcement agencies can only access data on a victim’s or witness’s cell phone that are useful for the criminal investigation. This is to ensure the rights to privacy and to minimize intrusion.