FAQ

The powerful decoding and decryption technology used in XRY means that it is classed as a “dual-use” product and subject to export controls dictated by the United Nations.  ‘Dual-use’ items mean they can be used for both civilian and military purposes. These export controls include shipment of goods and also the transmission of software by electronic means.

As a responsible business we only sell XRY to recognized Law Enforcement, Military & Governmental Departments. In addition we can supply private sector businesses where they can demonstrate a legitimate business need for the technology. For example Mobile Phone Network companies and Accounting companies investigating corporate fraud etc.

However we will not supply XRY to certain countries where their governments are suspected of having breached international human rights. This is determined by the Swedish Inspectorate of Strategic Products who are responsible for enforcing export controls where XRY is produced.

Under EU export laws, parts of XRY are controlled. You are therefore required to accept and sign the export terms to enable the full features of XRY once your new equipment has been delivered. This is to allow us to confirm that the technology is in the right hands and in the right location before we export the most powerful component of the software which is controlled and approved.

Users of XRY are restricted from selling, lending or allowing access to XRY to any third party without our prior written agreement. End users are specifically prohibited from the re-export of XRY outside of their original nation state.

All exports of dual-use products require a license. What type of license depends on the type of organization using it, where the product will be used and also for what purposes it will be used.  In many circumstances we do not anticipate any difficulties in issuing our customers with a license. The XRY Forensic Pack EULA reflects the full terms and if you install XRY, you must accept these conditions before you can use the software.

This applies to customers who have not accepted and signed the EU export terms.

Please contact your local sales/support representative for MSAB or send an email to contactme@msab.com with your organization details and XRY license key number.

Yes but we don’t recommend it.

This is due to the potential to omit data extracted via a logical analysis of a mobile device which usually accounts for a significant amount of evidence from mobile devices.

• The SIM ID Cloner element of XRY is connected to the XRY Logical license and thus SIM Card reading would not be possible with XRY Physical only
• Physical imaging only of devices is a more complex process and the levels of support for devices is lower than for logical devices
• Physical extractions by their very nature usually take more time to complete than logical extractions
• Some of the Restricted license elements are present only in XRY Logical, so elements of the most powerful decoding would be missing
• Finally due to the levels of encryption present on some modern smartphones like the iPhone, whilst we can get a physical dump of the device, the data is usually encrypted (if the device is locked) so it has little value if you can’t decode it.

Physical extractions of mobile devices are not able to get complete disk images of a phone memory in the same way that users might imagine a complete image in traditional computer forensics; where a hard disk-drive is imaged. Mobile devices are proprietary live electronic devices and the data on-board is constantly changing from the moment the device is turned on, which is usually required in order to recover data. There are also encryption issues to overcome and many times the only way to recover certain elements of data is through a logical extraction.

For that reason we strongly recommend customers to purchase XRY Logical and XRY Physical as the most suitable option for the majority to recover the maximum amount of data.

In a word ‘no’. Mobile devices such as smartphones, GPS units, digital media players and tablets are all unique. Unlike the world of computer forensics it simply is not possible to provide support for every single device on the market because there are so many variants. Generally PC technology works with standard operating systems such as Windows, Linux and Apple Mac and standard components. However with mobiles there are literally hundreds of different proprietary operating systems, each with their own unique features. There is no forensic system available which can get all the data from every mobile device, but we are working hard to try to achieve this one day.

MSAB prides itself on offering the best support in the business. Provided you maintain your licence and don’t let it expire, you will receive full telephone, email and web forum support. Our hardware comes with a full warranty which remains in place whilst your XRY licence does. We supply all the necessary equipment for each package in the initial purchase and for those customers with an XRY licence; we supply new cables free of charge when support for new devices becomes available. Our software is updated at least quarterly to ensure you have support for all the latest mobile devices and we regularly update the systems with new features and functions. All of this support is included in our product licences.

There is no such thing as a court approved forensic device or a standard forensic tool applicable to all the different legal systems across the globe. In general terms a device has to demonstrate that it is fit for purpose in each geographical territory where it is used.
XRY is used in over 100 countries worldwide and has been used by law enforcement agencies on countless occasions as evidence in criminal proceedings since 2003. Whilst the mobile device is always ‘primary’ evidence as the original source of the data; the XRY report is often preferable because it makes it so much easier to display relevant evidence to the court.
In many nation states the government has independent legal bodies which can be used to test devices and check their validity and accuracy. NIST in the USA is a good example of such a body who have tested XRY and provided objective independent assessments to help the courts evaluate the product.
Best evidence rules in many nations also guide that a person submitting digital forensic evidence must be competent to do so, and that usually means they should have been properly trained, so that they can give evidence explaining the relevance and the implications of their actions.
Good practice also indicates that an audit trail should be created to record all processes applied to the electronic device (which XRY automatically creates for you). Such that an independent third party will be able to examine those processes and achieve the same result.

We have not made our Device support list public for the simple reason that our customers have asked us not to. However if you are genuinely interested in obtaining a list before you make a purchase decision, then of course we can help. Just email us, explaining who you are and why you would like the list and we can email it to you, along with more information about our product ranges. The XRY Device Manual is a fantastic tool which lists every single device that is supported and details exactly what data you can and cannot expect to recover during an extraction.

Contact Sales for a List of Supported Devices >>

This information is stored in the Documentation folder of the Forensic Pack that you install on your computer. Please go to: C:\Program Files\Micro Systemation\Forensic Pack\Documentation where you will find a spreadsheet listing all the devices we support.

Alternatively you can download a spreadsheet from the MSAB Customer Portal > Support > Quick Guides > Supported Features. You will need a username and login to access this document.

The simple answer to this question is “It depends”

Mobile forensics is a relatively new field in the digital forensic arena and there is not so much published information as there is for computer forensics. As a result we receive a lot of requests from students all over the world asking us questions about various issues related to mobile forensics.

If you want us to provide information it helps to be as specific as possible and ensure that you don’t expect us to spend hours drafting answers. Occasionally we get the more enterprising students who try to delegate responsibility for what seems like their entire dissertations to us and we have to say no. For that reason we may not always be able to answer your questions.

Data can be extracted by using specific software, such as the XRY products. The data is extracted from digital devices either directly from the device memory, or by communicating with the operating system. MSAB has developed and implemented the ability to do “selective extractions”, meaning that, for example, law enforcement agencies could extract only the data on a victim’s or witness’s cell phone that is relevant for a specific criminal investigation. This ensures the right to privacy and minimizes intrusion.

Data extraction software are programs on either a mobile device or a computer that can assist investigators in accessing data on digital devices. XRY is a flagship data extraction and recovery software that runs on the Windows operating system. The XRY supports data recovery from an always increasing number of devices and app profiles and has formal support for the latest version of iOS.

Mobile data extraction means accessing and recovering data, such as apps and files. More specifically, MSAB specializes in extracting data from mobile devices such as cell phones and tablets. Data extraction is vital in many operations today since mobile devices are ubiquitous in our modern world. Extracting data from mobile devices can speed up investigations and offer results faster, yet still in a secure matter, with sound digital evidence.

Mobile data extraction is critical in many fields but especially so in the military context. The world of military operations today is heavily focused on preventing and combating terrorism and serious criminality. Digital information extracted from phones, drones and vehicle information systems are critical sources of intelligence which can potentially save lives and achieve mission success on the battlefield.

This depends on many factors, such as the device in question, what data is needed, and which tools are available in your organization.

With the various platforms offered by MSAB, the time to extract data – live or deleted – has shortened significantly. With mobile forensic devices in the hands of frontline personnel, the data can be extracted on the spot within minutes, as opposed to being sent to the forensic lab to await analysis. This allows the investigators to make quick, informed decisions, thus speeding up the process.

For example, in some cases XRY can recover and extract vital iOS data in around 5-10 minutes, or even less, including the time for decoding information.

The challenges of mobile device forensics are unmistakably around protecting an individual’s right to privacy. The nature of law enforcement work is complex on its own, as lives are possibly hanging in the balance. Not only are the speed and effectiveness of technology of utmost importance, but also the integrity and the accountability of the approach. The processes provided by MSAB have data privacy considerations at the heart of all the approaches, ensuring that the rights of the innocent, victims and witnesses are protected.

MSAB continues to be a global leader in privacy and integrity. A recent launch of features, based on the concept of “selective extraction”, helps further the privacy of individuals’ personal data while still being able to extract relevant information for investigations. MSAB is also dedicated to advancing digital safety and security in the EU by being involved in FORMOBILE, a project to secure an end-to-end mobile forensic investigation chain. The focus on ensuring that fundamental rights are respected is evident in the way MSAB has played an important role in funding and supporting research so that close attention is paid to fundamental rights to privacy and a fair trial.

Other challenges of mobile forensics include the increasing password security and data encryption in mobile devices, anti-forensic techniques exploited by criminals, and lack of proper tools and equipment.

Various types of evidence can be extracted from mobile devices, even deleted data. One of MSAB’s guiding principles is integrity, which also applies to data extraction processes – the privacy rights of the innocent are at the heart of all approaches.

The evidence that can be extracted from mobile devices include apps, deleted chat messages, files such as pictures and videos, and encrypted and cloud-based data.

Mobile forensics is important because mobile devices, goldmines of data, play a major role in today’s world. In an era where 98% of investigations and intelligence work rely on digital evidence, it is often the most critical factor. Having software, hardware and tools to extract, recover and search for data in these devices is crucial for frontline investigations. Mobile forensics offers faster and more efficient ways to access evidence that could otherwise take much longer to uncover in forensic labs.

The purpose is to uncover data on the spot so that users on the field can make informed decisions quicker without delays while fully maintaining the integrity of the evidence. In law enforcement, for example, having the opportunity to work with tailored mobile forensic solutions while solving crimes will create a safer and more efficient process suited to any law enforcement organization. By adopting new technology, crime solving will become more efficient and keep pace with the level of criminal investigation required today. In short, it will simply save resources.

Mobile forensics is the extraction and analyzation of digital data from mobile devices – such as cell phones and tablets – to help investigators uncover evidence. Mobile forensics, as opposed to computer forensics, enables portable, easy-access data analyzation on-the-go, making it a vital part of any law enforcement unit in today’s digital world.

XRY

XRY is supplied with a license key for a set period of time and during that time you can perform unlimited extractions from mobile devices. Once the license expires, you can continue to use XRY with the current release version you are working on indefinitely. In other words your license will never stop working provided you are happy to continue using the version of XRY you were using when it expired.

However because the world of mobile devices moves so fast we would encourage you to maintain your license to ensure you are kept up to date. Maintaining your XRY license means you will be able to download and use new versions of XRY with new features, receive cables for new devices which are supported and get full technical support should you ever need it.

On top of all that if you maintain your XRY license without letting it expire, then we offer you an extended warranty on all MSAB hardware in your possession for the duration of your license. So if anything breaks we will replace it free of charge.

XAMN

There are different options available for XAMN, the license can stop working on expiry or it can continue to work only on the current version of XAMN software like XRY. Access to online maps will also expire when the license does. Please discuss the options with your local sales representative.

We can send you a personalized quote for the supply of XRY in your area once we know a little more about you and your business need. Please send us an email explaining who you are and why you are interested and we will be delighted to respond.

Please have a look at our Partners Page first which lists all officially authorized resellers of XRY. If you cannot find anyone listed in your local area, then contact us directly to see if we can assist you.

XRY is developing all the time and we recently added support for new languages.

If you want to change the language displayed in XRY, simply go to the OPTIONS tab and select any one of the following language packs.

1. 1. Arabic
   2. Brazilian Portuguese
   3. Bulgarian
   4. Castellano
   5. Chinese (simplified)
   6. Czech
   7. Danish
   8. Deutsch
   9. Dutch
   10. Eesti
   11. English UK
   12. English US
   13. Finnish
   14. French
   15. Georgian
   16. Hungarian
   17. Indonesian
   18. Italian
   19. Japanese
   20. Korean
   21. Latvian
   22. Lithuanian
   23. Malay
   24. Norwegian
   25. Polish
   26. Portugese
   27. Romana
   28. Russian
   29. Slovensko
   30. Spanish
   31. Swedish
   32. Turkish
   33. Vietnamese

Brilliantly of course, but we would say that wouldn’t we? So instead of listening to us, why not try our solutions for yourself before you buy, so you can be sure they are right for you. Please visit our Sales Options page for more details of how to try XRY for free with a 30 day evaluation.

Yes but we don’t recommend it.

This is due to the potential to omit data extracted via a logical analysis of a mobile device which usually accounts for a significant amount of evidence from mobile devices.

• The SIM ID Cloner element of XRY is connected to the XRY Logical license and thus SIM Card reading would not be possible with XRY Physical only
• Physical imaging only of devices is a more complex process and the levels of support for devices is lower than for logical devices
• Physical extractions by their very nature usually take more time to complete than logical extractions
• Some of the Restricted license elements are present only in XRY Logical, so elements of the most powerful decoding would be missing
• Finally due to the levels of encryption present on some modern smartphones like the iPhone, whilst we can get a physical dump of the device, the data is usually encrypted (if the device is locked) so it has little value if you can’t decode it.

Physical extractions of mobile devices are not able to get complete disk images of a phone memory in the same way that users might imagine a complete image in traditional computer forensics; where a hard disk-drive is imaged. Mobile devices are proprietary live electronic devices and the data on-board is constantly changing from the moment the device is turned on, which is usually required in order to recover data. There are also encryption issues to overcome and many times the only way to recover certain elements of data is through a logical extraction.

For that reason we strongly recommend customers to purchase XRY Logical and XRY Physical as the most suitable option for the majority to recover the maximum amount of data.

XRY is unique in having a Device Manual which lists each and every device we support individually with a complete breakdown of what information can be recovered. Just as importantly we list what currently cannot be recovered from a mobile device in the hope that this will save you valuable time in your workload planning. With the XRY Device Manual you can know in advance precisely what sort of data can be recovered through both logical and physical extraction methods and the unique properties of each device.

Our Device Manual also contains the combined knowledge of our customer base: for devices not yet tested by MSAB, but found to be working by our customers, we list them as ‘Untested’ devices so you can benefit immediately rather than waiting for us to complete our full forensic procedures. We even list ‘impossible’ models to help save you time, for those mobiles we know just can’t be extracted from at the current time. By doing this examiners can know immediately that others have tried and failed before them, so they can move onto other devices quicker and avoid wasting valuable time.

These are the minimum and recommend specifications:

• Intel 6th Generation (Core i3 or above) or equivalent, 8 GB RAM minimum
• 4 GB of hard-disk space required for XRY program installation
• 256 GB HDD for data storage minimum ~ recommended 500GB or more
• 2 USB-ports minimum – recommended 3 or more
• Windows 8 or 10 (64 bit)
• Microsoft .NET Framework 4.5
• Screen monitor 1366 x 768 resolution minimum

XRY/XAMN/XEC work with Windows 8 or 10 (64 bit). You will also need to ensure that Microsoft .NET 4.5 or above is installed on your system.

XRY is developing all the time and we recently added support for new languages.

If you want to change the language displayed in XRY, simply go to the OPTIONS tab and select any one of the following language packs.

1. 1. Arabic
   2. Brazilian Portuguese
   3. Bulgarian
   4. Castellano
   5. Chinese (simplified)
   6. Czech
   7. Danish
   8. Deutsch
   9. Dutch
   10. Eesti
   11. English UK
   12. English US
   13. Finnish
   14. French
   15. Georgian
   16. Hungarian
   17. Indonesian
   18. Italian
   19. Japanese
   20. Korean
   21. Latvian
   22. Lithuanian
   23. Malay
   24. Norwegian
   25. Polish
   26. Portugese
   27. Romana
   28. Russian
   29. Slovensko
   30. Spanish
   31. Swedish
   32. Turkish
   33. Vietnamese

We have not made our Device support list public for the simple reason that our customers have asked us not to. However if you are genuinely interested in obtaining a list before you make a purchase decision, then of course we can help. Just email us, explaining who you are and why you would like the list and we can email it to you, along with more information about our product ranges. The XRY Device Manual is a fantastic tool which lists every single device that is supported and details exactly what data you can and cannot expect to recover during an extraction.

Contact Sales for a List of Supported Devices >>

This information is stored in the Documentation folder of the Forensic Pack that you install on your computer. Please go to: C:\Program Files\Micro Systemation\Forensic Pack\Documentation where you will find a spreadsheet listing all the devices we support.

Alternatively you can download a spreadsheet from the MSAB Customer Portal > Support > Quick Guides > Supported Features. You will need a username and login to access this document.

Yes but we don’t recommend it.

This is due to the potential to omit data extracted via a logical analysis of a mobile device which usually accounts for a significant amount of evidence from mobile devices.

• The SIM ID Cloner element of XRY is connected to the XRY Logical license and thus SIM Card reading would not be possible with XRY Physical only
• Physical imaging only of devices is a more complex process and the levels of support for devices is lower than for logical devices
• Physical extractions by their very nature usually take more time to complete than logical extractions
• Some of the Restricted license elements are present only in XRY Logical, so elements of the most powerful decoding would be missing
• Finally due to the levels of encryption present on some modern smartphones like the iPhone, whilst we can get a physical dump of the device, the data is usually encrypted (if the device is locked) so it has little value if you can’t decode it.

Physical extractions of mobile devices are not able to get complete disk images of a phone memory in the same way that users might imagine a complete image in traditional computer forensics; where a hard disk-drive is imaged. Mobile devices are proprietary live electronic devices and the data on-board is constantly changing from the moment the device is turned on, which is usually required in order to recover data. There are also encryption issues to overcome and many times the only way to recover certain elements of data is through a logical extraction.

For that reason we strongly recommend customers to purchase XRY Logical and XRY Physical as the most suitable option for the majority to recover the maximum amount of data.