Now Available: XRY 10.8, XAMN 7.8 and XEC 7.8

Discover new features and upgrades to enhance your digital forensics toolkit

Breaking new ground: Introducing the latest releases of XRY, XAMN, and XEC.

Download new releases    Try XRY free for 30 days

The cutting-edge updates in MSAB’s latest product releases are tailored to elevate your mobile data extraction capabilities, simplify digital evidence analysis, and enhance your reporting efficiency.

From support for iOS 17.1 & the iOS 17.2 Beta, speech to text transcription of video and audio files, dark mode added to XAMN, we’re featuring a host of upgrades and innovative additions that will further amplify the efficiency and power of XRY, XAMN, and XEC.

Here’s what you can expect from our latest major release:

Release highlights:

XRY 10.8 raises the bar with improved performance and cutting-edge features

XRY 10.8 continues to improve mobile data extraction and decoding. In the latest version of our flagship product, we have over 46.000 device profiles supported and over 4500 app versions. And it only gets better from here.

Some other highlights from XRY include:

• Support for iOS 17.1 & 17.2 Beta

XRY now supports iOS 17.1 and the iOS 17.2 Beta. That comes hand in hand with improved general data decoding for iOS. Moreover, we’ve added support for Apple Journal, a new app in the iOS 17.2 Beta which allows users to add journal entries, including pictures, videos, and other types of media. We’re proud to announce that we offer support for Reflections (content written by users), locations, and any attachments, such as pictures and videos.

• Speech to text – transcription of video and audio files.

We have added the ability to transcribe video and audio files, so they become searchable within XAMN.

• XRY 10.8 now supports Samsung Warrant Returns.

We have also added support for Samsung Warrant Returns. This addition brings a wealth of potential data for examination. Things like Contacts, installed apps, SMS, calls (and more) are now decoded by XRY.

• UFDX format supported for import.

Understanding the importance of having a variety of tools at your disposal, we’re pleased to share that XRY now enables the import of the UFDX file format, supporting single and multiple file imports. This will thereby ensure you have more flexibility and compatibility for comprehensive investigative work.

• XRY Pro

We’re ending the year on a high note when it comes to XRY Pro, as well.

A new exploit is available for Qualcomm chipsets produced between 2018 and 2020. Our Exynos support continues to expand. Additionally, you can now extract RAM from certain UNISOC models.

If you want a refresher for how to perform RAM extractions with XRY, check out this #MSABMonday episode.

XAMN 7.8: Transforming your forensic data analysis experience

XAMN has also gone through several significant user experience and performance improvements.

Your requests haven’t gone unnoticed! We’re excited to announce that a much asked for feature is now available in the latest release. XAMN 7.8 introduces Dark Mode to align with your device settings.

• Partial Artifact Redaction

XAMN 7.8 also comes with the possibility for granular artifact reduction. Suppose you’re dealing with data in a case that is sensitive or for legal/regulatory purposes cannot be visible (i.e., legal privilege). It is now possible to redact that specific information and exclude it from the case. The redaction is done for individual properties of an artefact. With this new feature as part of your toolbox, you’ll be able to confidently share files ensuring you align with legal privilege and sensitive cases.

• More flexible areas of interest

In the previous release, we introduced Areas of Interest. With this new version of XRY we continue to build on and improve this amazing feature.

Now, you can edit areas of interest. They can be renamed, moved, and resized to better fit the needs of your investigation.

• Database source references.

This is common knowledge amongst DFIR professionals, but the golden rule in this line of work is to validate, validate, validate.

Now, with XAMN 7.8, we have made it easier than ever to validate the data we decode by informing you of the table, column and row from where the data was parsed. This makes it significantly easier to locate the data in the SQLite database, if needed for validation.

• Better handling of calls for Relativity exports.

If you use Relativity, you’ll be glad to learn we’ve brought enhancements to how we export call information to the platform.

XEC Director 7.8: Mobile forensics management made better

This release introduces some exciting enhancements to XEC Director 7.8.

Some of these include (but are not limited to):

• User levels in user groups.

In the 7.8 release of XEC, you now have greater control over user levels in user groups. Among other things, you can define the extraction actions the users can access in XRY as part of a workflow. Setting user permissions based on user levels within the user groups is significant and will help you ensure that people are performing work only according to their competence and training level.

Additionally, user levels have become more dynamic. Kiosk users must meet certain criteria to remain on a specific level, and should they not meet your set criteria, they will be downgraded to the level below.

• Distribute Known data library via XEC

As you are well aware, during the device extraction process, a significant portion of the data will be system and application files, which by default contain no valuable information. MSAB offers a hash library file of known data, empowering you to efficiently eliminate irrelevant system and application files from the case.

Now, with this release, the known data library can now be distributed via XEC, allowing for more efficient analysis and distribution of the library.

For a little recap of how to effortlessly exclude Known Data Library files, System files, and Application files, which are pre-installed and unmodified by the user, check out our #MSABMonday video.

• Windows updates for Kiosks & Tablets.

System admins can now turn on Windows updates for Kiosks and Tablets, allowing group policy updates to be pushed out to Kiosks and Tablets.

Kiosk, Tablet & Express: Maximizing Frontline Performance

With this new release, KTE introduces these new improvements:

• Aborted/failed extractions can now be recorded in Forensic Process Statements.

KTE products can now record aborted or failed extractions in forensic process statements. This new feature will once more help automate your processes.

• Signature field improvements.

Refinements have been made to the signature panel when it is used within a workflow.

• PDF Viewer added to Kiosks & Tablets

A PDF viewer has been added so PDFs can easily be reviewed on the Kiosk or Tablet. This will make it a lot easier to handle Forensic Process Statements, like SFR and similar documents, which are often created in a PDF format.

For a complete description of all updated product capabilities, supported devices and apps, as well as a closer look at all the improvements that were brought to XRY, XAMN, and XEC, download the latest product releases and Release Notes from the MSAB Customer Portal.