XRY Certification

Your starting point for mobile forensics training. This is the core training that you will need.

XRY Intermediate

This next level course covers more detailed knowledge that you will need to maximize productivity.

Advanced Acquisition

This course focuses on the extraction and recovery of data via JTAG and Chip Off methods.

Kiosk & Tablet Training

Training for frontline users on the basics of mobile forensics.

Advanced Apps Analysis

A course to help examiners learn how to decode and decrypt smartphone apps.

XAMN Horizon

Analytic tool training for mobile forensics.

What training course is best for me?

Whether you are looking to gain expertise in XRY or take your analysis skills to the next level, we have the course for you. The objective is to pair you with a course that matches you or your organization’s needs.

Take our quick assessment and find out where you should start your training journey.

Training Guide

“Trainer did a great job. I learned a lot these days.”
XRY Training, Netherlands
“I’ve been to a million courses over the years, but this is the first time I was excited to come every single day (for a week). Very well done & presented – excellent information and practicals”
XRY Certification & Intermediate Course
Excellent course. I’ve been using XRY for several years now but I didn’t know what I didn’t know. I was able to learn all the little features I was never taught. […] I was leaving data on the cutting room floor and not knowing it. I will return knowing I can provide additional information.
XRY Certification Student Feedback

XRY Certification

Your Starting Point for Mobile Forensic Training

Welcome to the core training that you will need to progress with MSAB Training. We take you through the basics of cell phone and mobile device forensic examinations and the necessary principles to recover and preserve data using XRY in the correct manner to ensure safe preservation of data.

The course is two days long and covers all the essentials you will need to get started in mobile forensics using XRY. The information provided is extensive and covers all aspects of basic examinations of SIM Cards, Memory Cards, Feature Phones, GPS Navigation devices and Smartphones.

If you are new to mobile phone forensics or transferring from a computer forensics background then this course is ideally suited to get an understanding of the fundamentals and appreciation of the differences between mobile devices running various proprietary operating systems. Successful completion of this course will result in a formal certificate, ensuring the competence to meet the requirements of a mobile forensic examiner. With the basics covered you will be able to move with confidence to the next levels with our Intermediate and Advanced Training Courses.

» XRY Certification Training Sheet

  • Introduction to Networks

  • Intro to SIM Cards and Mobile Devices

  • SIM Cloning & Handset Extractions

  • Intro to Location Data

  • Common Challenges with Devices

  • Searching & Exporting

  • Review of Day 1

  • iDevice Basics

  • Intro to Location Data

  • Windows Phone Basics

  • Triage Setup

  • Exporting & Reporting

  • Filters, Quick Views, & Tagging in Spotlight

  • Assessment and Closure

“An excellent introductory course which progressed well and was filled with a good amount of practical exercises to reinforce the theory. The instructor was very knowledgeable and able to pass on great experience to the course attendees and is a credit to your organisation!”
Student Feedback, XRY Certification Training
Book Training!

XRY Intermediate

The next level in mobile forensic training

This is the next level course after successful completion of the Certification Course with MSAB Forensic Tools. The course is 3 days long and covers the next level knowledge you will need to maximize productivity with XRY. You will have full access to a XRY system in a professionally equipped classroom with plenty of hands-on exercises using numerous different devices that ensure you learn by doing, rather than listening.

If you have been using XRY for some time and want to take your skills to the next level to recover more data than ever before; then this course is ideally suited for you.

XRY Intermediate training builds confidence and expertise in our system and takes you through all the features and functionality available to ensure you get maximum value from your investment. Successful completion of this course will result in a formal certificate, ensuring the competence to meet the requirements of a mobile forensic examiner. After successfully completion of the Intermediate course, you are now confident and ready for the next level of training, the Advanced Training Courses.

» XRY Intermediate Training Sheet

  • Different Extraction Types

  • Android Logical Extractions

  • Next Level Logical Extractions

  • GPS Devices & Locations

  • Connection Types & Passcodes

  • Dumping and Decoding Feature Phones

  • Non-Standard Mobile Devices

  • Introduction to HEX

  • Introduction to XACT

  • File Systems & Memory Cards

  • HEX Searching & File Signatures

  • Data Hashing

  • RAM Disk & Bootloaders

  • Dumping & Decoding Smartphones

  • Import & Export

  • PLists & SQL Databases

  • Investigating Apps

  • Support Tools

  • Assessment

“Again, after having followed the Certification course at the beginning of this week, an excellent training with a lot of interaction and hands on exercises. Very very well done since some material was reaching the edge of my current knowledge on the subject and still managed to understand and process the information and exercises provided. Thanks a lot and see you at the Advanced Course!”
Student Feedback, XRY Intermediate Training
Book Training!

Advanced Acquisition

Learn How to Perform a Chip-Off from Mobile Devices

This course focuses on the extraction and recovery of data via JTAG and Chip Off methods, and teaches how to decrypt the recovered data. This practical knowledge is invaluable when automatic dumping and decoding is no longer an option. Advanced Acquisition is the next natural step after completion of the XRY Certification and Intermediate courses.

As the more advanced training course, this class is five days long and covers all elements of knowledge required to maximize your productivity and expertise. If you have been using XRY for quite some time and want to demonstrate excellence in the recovery of mobile data; then the XRY Advanced Acquisition Certification Training Course is for you.

By the end of this course, you will be able to use alternative methods to extract mobile device data and import it into XRY. You will understand how and where data is stored on mobile devices and how to get that data recovered. The advanced nature of this course curriculum requires that all attendees have passed both the XRY Certification and Intermediate Courses before attending.

» Advanced Acquisition Training Sheet

  • Course Introduction

  • XACT re-familiarization

  • Advanced Extraction Methods

  • JTAG Extraction Practical

  • Health & Safety

  • Memory Chip Knowledge

  • Intro to eMMC

  • Chip-Off Equipment

  • USB eMMC Chip-Off Practical

  • Handset eMMC Chip Off Practical

  • Importing Data Dumps

  • Working with Data Dumps

  • Partition & File Systems

  • Android & ADB

  • Rooting

  • Swipe PIN Decoding

  • USB Disabled Devices

  • DD & Nanddump

  • Encryption Schemes

  • Decryption Android User Data Partition

  • App Programming Languages

  • Decompiling APK Files

  • Reverse Engineering Apps – Android

  • Decryptiong Apps

  • Assessment & Closure

“I thought the training course was excellent and the information obtained will allow me the enhance my department’s ability to extract data from more devices.”
Police Officer, Memphis Police Dept.
Book Training!

Advanced Apps Analysis

The Highest Level of Knowledge in Mobile Forensics

Are you interested in taking your knowledge of smartphone forensics higher than ever before? The AAA course is our brand new Certification Training course designed for professionals who need to know everything there is to know about Apps. Eventually you will come across a situation where you need to decrypt data from an app that is not supported and this course shows you how to do it.

The Advanced App Analysis course has been put together by a team of professional full time trainers who know exactly what examiners need to be taught in order to make them self-sufficient in the decryption and decoding of apps. The course is five days long and by the end of day 5 you will be proficient in app analysis and have acheived the highest level of training MSAB now offers.

The course covers all elements of knowledge required to recover, decode, decrypt and explore the hidden SQL & PList data on modern smartphones. We show you how to utilize Python to analyze the contents and find the wealth of hidden information in smartphone apps and their databases. The high level of the Advanced Apps Analysis Course curriculum requires all attendees to have passed both the XRY Certification and Intermediate courses before attending.

» Advanced Apps Analysis Training Sheet

  • Intro to Apps

  • SQL Data Structures

  • App Data Storage

  • App Practical

  • Hands-on App Practical

  • Create SQLite Database

  • Rebuilding Databases

  • Deleted Contents in Database

  • Intro to Python

  • Python Math Operators

  • Python Variables

  • Python Lists & Tuples

  • Python Loops

  • File Output

  • Modules Datetime SQLite3

  • Python Practical

  • XACT Python API & Help File

  • Adding Data to XRY Report

  • Python Dictionaries

  • Multi-Table Databases

  • Python App Practicals

  • Intro to Encryption

  • Android App Reverse Engineering

  • Reverse Engineer Encrypted App

  • Group Exercise

  • Assessment & Closure

“Hugely informative, well aimed and balanced course. Presented with the genuine passion and knowledge, that has become the MSAB training trademark. An excellent resource for the advanced examiner.”
Student Feedback, Adv Apps Analysis Training
Book Training!

Kiosk & Tablet Training

Training for Frontline Users on the Basics of Mobile Forensics

The Kiosk and Tablet are frontline forensic tools designed for users where mobile data recovery is just one part of their responsibilities. With touch screen interfaces both tools are designed to quickly and easily recover data from mobile devices for non-specialized staff.

Whilst they are simple to use, recent court cases have demonstrated that the need for effective training of personnel is vital so that they can explain their actions in court. Hard won evidence can easily be rejected by courts simply due to the inability of the officer to effectively explain either how the technology works, whether the extraction process was operated properly and whether the software is known to be reliable. This is where formal training on Kiosk & Tablet will pay dividends ensuring that staff know how to use the equipment to the best of their abilities.

XRY Tablet frontWe offer training on these solutions for both standard users and Administrators to ensure that you maximize your return on investment. A typical training course would cover a 2 day period with day 1 dedicated to the set up and workflows of the Kiosk tailored to the needs of the organization and training of the Administrators. Day 2 of the course would then deliver the core training on mobile forensics knowledge to standard users.

» Kiosk & Tablet Training Sheet

  • Administrator Training Day & Installation

  • Workflow Procedures

  • Administrator Functions

  • Password and User Profiles

  • General Procedures for Standard Users

  • Introduction to Mobile Forensics

  • Equipment Overview

  • SIM Cards & Cloning

  • Memory Cards

  • Handsets

  • Smartphones Acquisitions

  • Reports, Search & XRY Reader

“The trainer has been first class. A laid back but informative approach and willing to help and explain further when required. A good balance of information/coursework together practical hands on experience.”
Student Feedback, XRY Kiosk Training
Book Training!

XAMN Horizon

Analytic Tool Training for Mobile Forensics

XAMN is the analytical tool designed for users who need to analyse data from multiple mobile devices. This one day training course is designed to help you make the most of XAMN and quickly get to grips with the product. If you want to learn how to visualize connections between different devices through link analysis, timeline or geographical views, then this training is for you.

This certification training course is designed to introduce you to XAMN , assuming no previous experience and teach you all the fundamental aspects of the product. Users will leave confident about all the features and how best to use them in the world of mobile forensic analysis.

XAMN certification training teaches users first-hand through practical exercises and scenarios how to make quicker, faster, more efficient decisions with the aid of visualizing mobile forensic data.

» XAMN Certification Training Sheet

“Brilliant. Thanks you guys are great!”
Student Feedback, XAMN Training, South Africa
Book Training!

XRY Investigator

What do you know about Mobile Device Forensics?

  • Are you aware that mobile devices store a whole host of useful intelligence?
  • Did you know that location data can be recovered from some mobiles?
  • Did you know that smartphone apps like Skype can reveal VOIP calls?
  • Did you know that deleted text messages & images can often be recovered?

You will gain an immediate appreciation for the types of evidential data and actionable intelligence that can be recovered from a mobile device. You will understand how the data is recovered and when & where to find the useful elements for law enforcement, military and intelligence operations.

Understanding the difference between certain types of mobile devices and the methods with which the data is extracted is fundamental to appreciating what sort of intelligence material can be gathered. With our training course you will be able to understand what you can expect from any particular device in advance and just as importantly why.

» Investigator Training Sheet


Law Enforcement, Military & Intelligence Agents, Analysts & Investigators & Corporate Security Personnel


1 Day Training

For more information, please contact training@msab.com

Book Training!

Online Training

Too difficult to travel, why not learn from your desk?

Here you can access the following:

  • Webinar Recordings
  • Tutorials
  • On-Demand Short Courses
  • Full online Certification Courses

Users can earn badges as they progress through the available courses to show experience gained.

All customers who are registered on the MSAB Customer Portal can access the Online Training Portal. Simply use your existing MSAB login details.

Book Training!

On Site Training

Your place or ours?

In addition to the standard training programs we can also perform on-site training at customer premises. We know that sometimes it is easier for us to come to you, especially if you have a larger group of personnel to train.

We are happy to discuss arrangements and the training can either be in the form of our standard certification training program or as a customized training program specifically arranged to suit your needs. If you can provide a suitable location for the training to be delivered, then we can make all the arrangements to bring our qualified trainer and equipment to you.

For customer specific trainings please consult with your regional sales representative or send your request directly to training@msab.com

“The trainer was extremely patient and up to date with all information. He did not rush me in any way. The learning environment was calm and I would highly recommend this training to several officers..”
Student Feedback, XRY Certification Training
Book Training!

Academic Training

Training on Mobile Forensics for Academic Institutions

MSAB offer special training solutions for academic institutions that wish to use XRY for research and educational purposes. The demand for knowledge about the latest forensic tools is growing and you can give your educational establishment an edge, by ensuring that students have access to the latest tools. XRY is already embedded in a number of academic institutions across the globe and MSAB help them integrate new cell phone forensic course material into their existing digital forensics classes.

If you are responsible for training and degree courses in the field of digital forensics at an academic institution and would like to include modules on mobile & smartphone forensics then please contact us. Embedding formal XRY certification into existing degree qualifications means that students can leave with both academic and industry qualifications when they leave to look for work. This represents a win-win scenario for all, whereby the academic institution benefits from being able to offer a differentiator and students looking for work in the field of digital forensics make themselves more employable by possessing industry based training certificates.

If you are interested in putting phone forensics into your courses, then we would be delighted to discuss with you the possibility of specially discounted equipment pricing and training modules to help your students learn about the future of digital forensics.

“Excellent course by a very knowledgable instructor”
Student Feedback, XRY Intermediate Training
Book Training!