Mobile forensics for all mobile devices
Retrieving the optimal forensic data is what matters. MSAB helps you through the challenges of mobile forensics. Recover data fast, in a secure, efficient, and lawful manner.
Mobile forensics
Mobile device forensics
MSAB is a global leader in mobile forensics technology with a focus on offering solutions for mobile device data analyzation and extraction. With the rapid digitalization of the modern world, mobile devices have become a key source of evidence in investigations. This is where the solutions offered by MSAB come in, to empower investigators in uncovering the truth – for a safer world.
MSAB offers a whole ecosystem of mobile forensics products, platforms and services for customers. The product categories include the XRY Family, the XAMN Family and the XEC Family. These combined offers your organization the best workflows for all stakeholders: front-line personnel, investigators, analysts and managers.
Six hardware platforms are available through MSAB: MSAB Office, MSAB Field, MSAB Kiosk, MSAB Express, MSAB Tablet and MSAB Raven. MSAB supplies the software for different hardware platforms, which fall under two categories: Open and Turnkey. The Office and Field are Open platforms which are designed for traditional Windows computers with point-and-click interfaces. The Kiosk and Tablet are Turnkey platforms, which are easy-to-use systems with touch screen interfaces.
MSAB also provides thorough and in-depth services for customers that include strategy, implementation, training and support. More specifically, MSAB assists through four different avenues of support services: Access Services, Advanced Acquisition Lab, Strategy and Implementation.
Mobile forensics with lawful access and analysis to digital intel
MSAB provides you with top mobile forensics solutions to speed up your operations and to allow you to easily acquire and analyze evidence and intelligence from more mobile devices with greater functionality and control.
Frontline Extractions
MSAB understands the current challenges facing frontline personnel in the first few critical hours. You need to find vital evidence, insights and intel as quickly as possible. We can help.
Lab Extractions
In modern forensic labs you need solutions that can bypass device locks, acquire passcodes, extract, and decode digital evidence and intel — quickly and in a forensically sound way.
Need help solving a challenging case or accessing a mobile device?
Through the Access Services, MSAB mobile forensics experts can access, recover and decrypt data from even the most challenging mobile phones using advanced forensically sound techniques. This service is provided in one of our secure MSAB forensic facilities with written documentation throughout the process. In selected special cases, service may be able to take place on site at a customer facility. Once the process is finished, customers will receive a XRY file containing all recovered data and have the mobile device returned to them. The MSAB Access Service has a tried and tested track record of success in various pivotal investigations and cases.
The Advanced Acquisition Lab (AAL) offers customers specialized on-site training at the customer’s location. After this training, the customer is able to perform unlimited unlocks of, and extractions from, some of the most secure devices using a MSAB forensic lab kit (including computer hardware and software). This service is ideally suited for existing MSAB customers who regularly encounter challenging devices and who frequently need immediate access to mobile data.
MSAB can assist you in reaching your business objectives by identifying user demands and employing customer-focused feasibility studies. Taking into consideration that most organizations are overwhelmed by ever-increasing data volumes and backlogs of digital investigations, it is key that your processes are scalable. By reducing backlogs and turnaround time, you can dedicate your primary energies to your core business activities. With a documented, consistent process in place, you will have a framework at hand to manage people, processes and technology effectively. Leverage our mobile forensics experience and insights to allow your organization to take digital forensics to a higher level of operational delivery.
After all the strategic frameworks are in place, MSAB will partner to help you with implementation of the configured solutions to fit your budget, priorities and specifications. We offer to help you through all the steps – installation, configuration and mobile forensics solution architecture. With a designated project manager, the customer-proven implementation process will be fitted according to your project schedule. This partnership will help you get up and running faster, leaving room for continuous fine-tuning of your processes. The end game is ensuring you get the most out of your investment.
Ten reasons to choose XRY over other mobile forensics tools
- More data recovery from over 40,000 mobile devices and app profiles.
- Quickly refine extractions to data categories, apps or individual files within specified time ranges.
- Simultaneously extract and decode data from three phones at a time with a single license.
- Decode images with automated image recognition up to 20 times faster with Nvidia CUDA enabled GPUs.
- Support for the latest Android and iOS versions.
- Recover and decode Warrant Returns, Cloud Data and iCloud Backups.
- Secure your chain of evidence in a forensically sound file format with a complete audit log.
- Includes XRY Photon for acquiring unencrypted data from encrypted apps, when other methods don’t work.
- Market leading support for Chipsets like Exynos, Qualcomm, Kirin, MTK, Spreadtrum, Coolsand & Infineon.
- Retrieve more location data along with related timestamps from embedded files in both iOS and Android databases.
Managing mobile forensics with XEC
MSAB offers XEC as your digital forensic management solution to speed up your operations and manage your team from a central control point. With personnel in various locations, XEC brings these together by seamless distribution of data between users, locations, departments and other agencies. XEC ensures the integrity and proper management of your digital evidence, and helps you optimize your team performance, track key goals and generate the reports you need.
XEC Director
With XEC Director, you can manage and connect all the MSAB mobile forensic extraction tools into a single network. From there, you can build, tailor and streamline a truly functioning mobile forensics system for your unique organization.
XEC Director helps you to remotely review the logs for all devices in your system to see who performed what function and where. The powerful reporting features include tailor-made reports of important management information that let you make more informed decisions and so allocate resources better. The excellence of the centralized management is evident since the updating of software, managing licenses and selecting automatic routines for entire systems from one place is possible with XEC. In addition, remote assistance and diagnostics is possible in case of difficulties.
XEC Export
XEC Export is an innovative standalone tool specifically designed for users who need batch export capability. Export gives you the option to export specific or multiple XRY files to alternative data formats such as PDF, Word, Excel and more. Automating the process of manually exporting a batch of XRY reports, Export allows users to complete the job with a single click by running it as service either on a dedicated server or on your workstation.
XRY Logical
The starting point for mobile forensics
XRY Logical is the quickest extraction method as it enables you to access and recover live and file system data from the device right at the crime scene. Read more about XRY Logical, the fast and efficient forensic tool for mobile phone data recovery.
XRY Physical
Get greater access to system and deleted data
XRY Physical lets examiners bypass the devices operating system to allow access to protected and deleted data; it also allows them to overcome certain security and encryption challenges on locked devices. Read more about XRY Physical, a data recovery software to bypass the mobile operating system.
XRY Photon
Acquire Android app data when other tools can’t
XRY Photon Manual lets you recover smartphone app data that is inaccessible through normal extraction techniques, using an exclusive screen-scraping function to capture the data electronically. Read more about XRY Photon.
XRY Cloud
Recovery of data beyond the mobile device
XRY Cloud recovers data from beyond the mobile device itself by examining connected cloud-based storage. This is particularly useful when looking for online social media data and app-based information. Read more about our cloud forensics solution.
XRY Express
Uncover evidence quickly with a simplified, locked-down workflow
XRY Express provides a simplified, locked-down workflow for mobile device extractions, enabling quick and easy processing by field-based investigators and others. Read more about XRY Express, our user-friendly mobile device data extraction solution.
XRY PinPoint
The solution for non-standard mobile devices
XRY PinPoint lets you extract and decode data from non-standard mobile devices, such as cheap imitation phones from Asia. Read more about XRY Pinpoint, our data extraction solution for non-standard mobile devices.
XRY Camera
Gather more picture and video evidence
XRY Camera gives forensic examiners the opportunity to complement their XRY reports with photos of the examined device from an HD camera. Read more about XRY Camera.
Are you…
Accelerate your extraction speed for iOS devices
Are you a digital forensic examiner or investigator?
The Checkm8 exploit is now integrated in XRY, enabling faster iOS extractions.
In our testing, XRY has demonstrated that it has the necessary resources in place to help support us as examiners and the MSAB team are working hard to implement their research and development into the functionality of the tool.
Patrick Siewert
– Principal Consultant of Pro Digital Forensic Consulting
Contact us about mobile forensics
If you are a potential customer interested in learning about our mobile forensics solutions or services, please use this form for your inquiry.
"*" indicates required fields
FAQ – Mobile forensics
What is mobile forensics?
Mobile forensics is the extraction and analyzation of digital data from mobile devices – such as cell phones and tablets – to help investigators uncover evidence. Mobile forensics, as opposed to computer forensics, enables portable, easy-access data analyzation on-the-go, making it a vital part of any law enforcement unit in today’s digital world.
Why is mobile forensics important and what is its purpose?
Mobile forensics is important because mobile devices, goldmines of data, play a major role in today’s world. In an era where 98% of investigations and intelligence work rely on digital evidence, it is often the most critical factor. Having software, hardware and tools to extract, recover and search for data in these devices is crucial for frontline investigations. Mobile forensics offers faster and more efficient ways to access evidence that could otherwise take much longer to uncover in forensic labs.
The purpose is to uncover data on the spot so that users on the field can make informed decisions quicker without delays while fully maintaining the integrity of the evidence. In law enforcement, for example, having the opportunity to work with tailored mobile forensic solutions while solving crimes will create a safer and more efficient process suited to any law enforcement organization. By adopting new technology, crime solving will become more efficient and keep pace with the level of criminal investigation required today. In short, it will simply save resources.
What type of evidence can be extracted from a mobile device?
Various types of evidence can be extracted from mobile devices, even deleted data. One of MSAB’s guiding principles is integrity, which also applies to data extraction processes – the privacy rights of the innocent are at the heart of all approaches.
The evidence that can be extracted from mobile devices include apps, deleted chat messages, files such as pictures and videos, and encrypted and cloud-based data.
Why is mobile device forensics complicated?
The challenges of mobile device forensics are unmistakably around protecting an individual’s right to privacy. The nature of law enforcement work is complex on its own, as lives are possibly hanging in the balance. Not only are the speed and effectiveness of technology of utmost importance, but also the integrity and the accountability of the approach. The processes provided by MSAB have data privacy considerations at the heart of all the approaches, ensuring that the rights of the innocent, victims and witnesses are protected.
MSAB continues to be a global leader in privacy and integrity. A recent launch of features, based on the concept of “selective extraction”, helps further the privacy of individuals’ personal data while still being able to extract relevant information for investigations. MSAB is also dedicated to advancing digital safety and security in the EU by being involved in FORMOBILE, a project to secure an end-to-end mobile forensic investigation chain. The focus on ensuring that fundamental rights are respected is evident in the way MSAB has played an important role in funding and supporting research so that close attention is paid to fundamental rights to privacy and a fair trial.
Other challenges of mobile forensics include the increasing password security and data encryption in mobile devices, anti-forensic techniques exploited by criminals, and lack of proper tools and equipment.
How long does mobile forensics take?
With the various platforms offered by MSAB, the time to extract data – live or deleted – has shortened significantly. Now with mobile forensic devices in the hands of frontline personnel, the data can be extracted on the spot within minutes, as opposed to being sent to the forensic lab to await analyzation. This allows the investigators to make quick, informed decisions, thus speeding up the investigation.
For example, XRY can recover and extract vital iOS data in around 5-10 minutes, or even less, including the time for decoding information.