Now Available: XRY 10.7, XAMN 7.7 and XEC 7.7

It’s here! The next chapter in DFIR excellence: remarkable upgrades and new features in MSAB’s flagship products

 

We are thrilled to introduce the latest releases of XRY, XAMN, and XEC. They’re smarter, faster, and packed with exciting new capabilities. Ready to take a peek?

 

Download new releases    Try XRY free for 30 days

 

The latest versions of the powerful MSAB products introduce a range of new features and other important enhancements. Each update is aimed at enhancing your mobile data extraction capabilities, the convenience of your digital evidence analysis, and the efficiency of your reporting process. From support for iOS 17 & Android 14, selective extractions for Full File System (FFS) or Berla iVe import, we’re featuring a host of upgrades and innovative additions.

These are some of the highlights:

 

Release highlights:

 

Discover the enhanced performance and groundbreaking features of XRY 10.7

XRY 10.7 brings significant extraction and decoding capabilities to more mobile devices, with the total number of supported devices exceeding 45.600 and over 4400 app versions.

• Support for iOS 17 and Android 14

Recently having hit the market (on September 18th, 2023), iOS 17 is the latest major release of Apple’s iOS operating system for the iPhone. Concurrently, Android 14 is the latest major release of the Android mobile operating system.

The arrival of iOS 17 and Android 14 has ramifications for the mobile forensics industry, as they usher in some novel changes and features. As phone users continually seek updates and the phone giants comply, so must we and our products.

XRY 10.7 offers support for both iOS 17 and Android 14.

• Optical character recognition (OCR) and content recognition in Apple Photos

Apple Photos applies OCR and content recognition on all pictures in the media partition. This means that machine and handwritten text in pictures, as well as the content in images, is recognized and decoded to be searchable in XAMN.

This new feature will significantly enhance the speed and comprehensiveness of digital investigations. It will be easier and more precise than ever to perform keyword searches, content searching, to analyze pictures that contain text, find place names and so much more.

• Selective extraction for apps supported for Full File System extractions

We are delighted to announce that we now offer selective extraction possibilities when you’re using an FFS. We’ve expanded our capabilities to now support app selection, meaning you can select from which specific apps to extract data for Full File System extractions. The benefits of this new feature are multifaceted.

It’s very valuable in cases where only a fraction of the data on the device is relevant to your case, and you want to speed up the data extraction process. While previously you might have waited for 40 minutes or an hour to perform a full file system extraction on a device, by extracting only the data from a specific app, you can now accomplish this feat in as little as two minutes.

Beyond the extraction speed, this new feature holds legal significance. In certain scenarios, you may encounter legal regulations dictating that you can only extract data relevant to your case. The ability to selectively extract data from specific apps of interest helps ensure strict compliance with these legal requirements.

This new feature is a game-changer when speed is of the essence and legal standpoints must be observed.

• WhatsApp: Decoding of locked chats and timestamps for edited messages

WhatsApp is, without a doubt, one of the most popular messaging platforms.

In May, the service introduced a new “Chat Lock” feature intended to make it easier to keep conversations more private. The locked chats can only be opened via biometrics. It’s not hard to see why this feature might appeal to criminals and individuals with malicious intent. So, we moved quickly and introduced support for this new feature. In the most recent version of XRY, locked chats are decoded.

Additionally, WhatsApp messages that have been edited are shown with the timestamp of when they were edited.

• Berla import

Just like mobile devices, vehicles also keep track of a lot of data. So, it comes as no shock that nowadays vehicle forensics plays a substantial role in many DFIR investigations.

Given the growing demand for vehicle forensics, you’ll be pleased to know that XRY 10.7 now supports the import of Berla iVe files for vehicle forensics data. This import decodes locations, routes, and vehicle events such as gear shifts or doors opened. It also decodes information from the vehicle’s entertainment system, such as any mobile devices that have been connected to the system.

Being able to investigate a mobile device and a vehicle in the same case within XAMN is going to prove extremely useful for digital forensics professionals going forward.

• XRY Pro: Physical extraction with AFU (After First Unlock) bypass for more Samsung Exynos devices

Physical extraction with AFU bypass is now available for these Samsung devices with Exonys chipsets: s9, s10, s20, and the a-series.

 

XAMN 7.7: Elevating your forensic data analysis capabilities

We are excited to introduce XAMN 7.7, featuring substantial enhancements aimed at simplifying your workflow and helping your investigations. We’re committed to making XAMN as user-friendly as possible, and this new release is one more step in that direction.

Some of the key improvements we brought to XAMN include:

• Improved artifact presentation in Maps

We’ve introduced four location classes (‘Visited’, ‘Referenced’, ‘Indicative’, ‘Other’), each assigned a different symbol. Individual location artifacts are displayed with different symbols indicating the classification of the location.

The introduction of this new feature in XAMN 7.7 will make it easier to differentiate between a suspect’s real-world movements and irrelevant data, and, subsequently, determine if a location artifact is pertinent to the case or not.

• More flexible areas of interest

Areas of interest are used to find artifacts that have location metadata within a defined geographical area. And the good news is that with the introduction of XAMN 7.7, this function has improved significantly. Now, users have complete flexibility when defining their areas of interest.

In the new Maps filter view, there are new ways of drawing areas of interest. You can now draw the area of interest as a rectangle, a circle, or a polygon.

This feature is particularly useful when investigating violations of restraining orders, when dealing with cases related to drug offences or people trafficking, and so much more.

• Support for external reference data in Maps

The possibility to import external reference data is another game-changing feature introduced in our latest release. This adds a new way of determining if a person has been near a place which is defined in a database.

XAMN 7.7 supports import of external data in shapefile format, which is a geospatial vector data format commonly used in geographic information system (GIS) software. In most countries, data sets in this format are available in Open Data Portals. If your organization manages geographic data in a format that is not supported in XAMN, most formats can be easily converted to the shapefile format.

Curious about practical ways to leverage this new feature? We have you covered!

For instance, you can use this feature to import data of the location of all military facilities or airports and then check if a person has been near any of those locations. Another example is importing the known positions of surveillance cameras to quickly figure out which ones are relevant for a warrant to export video material.

Tip: See the MSAB Customer Forum for links to official sources of geographic reference data and a guide on how to create or convert your own data set for use in XAMN.

• Store offline maps in a centralized location

It is now possible to select where to store offline maps. This means that you can choose to store them in a centralized location and use the same maps for multiple users. This is valuable to save storage space, especially when investigators work on virtual machines.

• Berla iVe import support

We’ve already highlighted the crucial role of vehicle forensics in various investigations. We aim to simplify the process of integrating your mobile forensics investigations with your vehicle forensics cases, given that in practice they will often be intertwined.

The Berla iVe import in XAMN makes it possible to import vehicle data, extracted using Berla iVe. This data includes what locations the vehicle has visited and the recorded speed, but also vehicle events like when the doors have been opened or closed and what mobile devices have been connected to the vehicle’s entertainment system.

Importing the vehicle data to XAMN is useful to view vehicle data side by side with data from a mobile device, or to view the data from multiple vehicles at the same time.

• Design your report cover page in Report Builder

The latest XAMN release comes with a greatly improved cover page designer in Report Builder. With the new designer, you have a lot more control and flexibility over things like the size, color, and placement of the text, and you can add multiple images.

Additionally, with the new cover page designer you can now add dynamic content, like dates, time, organization information, or case information. This reduces the need for maintenance because the dynamic content is either updated automatically or loaded from a central location. So, you only need to update it in one place and then you’re set.

 

XEC Director 7.7: Where mobile forensics management meets innovation

XEC Director is your go-to for more productive management of your operations.

• XRY Pro supported as a client system type in XEC Director

XRY Pro is now added as a new client system type. This makes it possible for you to manage XRY Pro installations from XEC Director.

• Increased logging of XAMN actions to XEC Director

The number of XAMN actions logged to XEC Director has been increased from 10 to 90. This is an outstanding 800% increase, and it comes with a lot of great applications is practice.

With this new update you have significantly more possibilities to filter and report on who did what in XAMN, from what part of the system, and at what time. That is also applicable for installations that are connected to XEC.

 

Kiosk, Tablet & Express: Maximizing Frontline Performance

Empowering frontline personnel with innovative tools speeds up investigations and delivers better results. That’s why our frontline solutions have been significantly improved in this release. In addition to the selective extraction for FFS that we discussed in the XRY section, some other enhancements we brought to our KTE products include:

• Dynamic Full File System action for Android consent devices

A new FFS action is added and by default selected for devices where this action is applicable. This action has a separate check for device vulnerability to verify that this action can be used.

• Control Kiosk LED lights from the workflow

It is now possible to control the LED lights on the Kiosks from the workflow. For example, LED lights can be used to indicate completed or failed extractions.

Why is this new function so valuable? Considering that some extractions can take a long time, it is easier to step away and do other things while waiting for an extraction to finish. Once the extraction has been completed, you’ll be alerted by the LED lights. Overall, it makes the flow of your operations smoother.

You’ll be able to control the following things on the Kiosk LED light:

• The color
• The frequency of blinks
• When it should be turned on or off

• New setting to calculate the hash value of XRY files

A new setting is introduced to calculate the hash value of XRY files. This is useful for forensic units that create a master extraction and then create working copies of that extraction. It can help you show that the hash value has not changed and that there is a complete chain of custody.

 

For a complete description of all updated product capabilities, supported devices and apps, as well as a closer look at all the improvements that were brought to XRY, XAMN, and XEC, download the latest product releases and Release Notes from the MSAB Customer Portal.