Now available: XRY 11.1, XAMN 8.2, UNIFY 25.5, XEC 7.14 and KTE 11.1

Introducing the latest MSAB Updates

Built for Faster, Smarter Mobile Forensics

Download new releases

We are excited to introduce the latest releases of XRY, XAMN, UNIFY, XEC and KTE, all designed to improve efficiency when working with mobile device extractions and analysis. XRY now includes file system export functionality to give you more flexibility in handling case data. In XAMN, opening new tabs is faster and easier with quick access buttons and a CTRL+T shortcut, taking you straight to your preferred view.

Release highlights in XRY 11.1

File System Export

Export the full file system, this export is an additional step from the extraction and decoding processes. Includes Android Keystore and iOS Keychain keys in JSON format for use in other tools.

Device Manual Enhancements

The Device Manual now features improved search functionality, new filters, and chipset-based browsing for easier device identification. Legacy profiles are grouped separately, and the Capability overview includes helpful tooltips and is now shown during extraction.

Android App Sandbox Extraction

XRY now includes a second extractor to enhance app sandbox extraction during Logical acquisitions. Supported for Android 9–14 with SPLs below June 1, 2024, and Android 12–13 with SPLs before October 2024.

PDF Report from Summary Page

XRY now auto-generates a PDF report from the Summary page after each extraction. It captures key details for separate systems and maintains chain of custody. (Disabled for Kiosk, Tablet, and Express.)

Android Wi-Fi Extraction Improvements

XRY now supports Wi-Fi 7 and allows simultaneous wired internet use during Wi-Fi extractions. On Windows 11, you can also select the Wi-Fi hotspot frequency band.

Pre-Scanned Data Update

XRY now captures and highlights key device status information such as Airplane mode, Wi-Fi, and Bluetooth before extraction. This data is saved in the XRY file and is searchable in XAMN.

XRY Pro

• Improved stability for multiple extractions using different access methods
• Expanded decryption support for Vivo Qualcomm devices

XRY RAMalyzer Updates:

• Define custom regex patterns via external config file (default regex_config.yaml included)
• Run regex searches across full RAM, including presets for emails and websites
• New cache-cleaning feature for quick data resets

XRY Brute Storm Enhancements:

• Supports more full disk encrypted devices
• Improved dictionary support and a new infinite brute force mode

The XRY Pro User Guide is now available in HTML via the Help menu (PDF still on the Customer Portal)

Release highlights in XAMN 8.2

Improved Ease of Use for Tabs

Opening new tabs to review artifacts is now faster and more intuitive, with quick-access buttons and a Ctrl+T shortcut, based on your default view settings.

Import Amazon and T-Mobile Warrant Returns

XAMN Pro 8.2 adds support for importing Amazon and T Mobile warrant returns, making it easier to consolidate and cross-examine evidence from multiple data sources.

Better Control of Artifact Viewing

XAMN now offers more ways to tailor how you view artifacts. Set your default tab type, retain Gallery view preferences like scroll mode and sort order, and hide low-interaction connections in the Connection view.

Easier Access to Biome and KnowledgeC Data

Artifacts stored in Apple’s Biome or KnowledgeC databases now appear linked to both the source app and the standard app, with dual app icons shown in List view, Column view, Details pane, and the Apps filter.

New Artifact sub-category for folders

A new Folders subcategory in the Collections category provides metadata such as folder size, number of files, and relevant timestamps, just like in Windows Explorer.

New Notes Block in Report Builder

The updated Notes block offers more editing options, including text styling, color changes, image insertion, and dynamic content like date, time, department, and case operator. It helps create clearer, easier to maintain reports and templates.

File Export Improvements

All zip exports in XAMN are now significantly faster. File metadata has been updated to align with XAMN Pro’s timestamp interpretation. Exports from the File Tree view can also include keystore data when available.

Release highlights in UNIFY 25.5

Improved Overview of UNIFY Server Instances

The Servers page in the UNIFY Management Console now groups server instances by type, making it easier to view and manage Authentication, Case, Storage, and Worker servers. Key details are now visible directly in the table.

Set Customer Caddy Service Port in Installer

The UNIFY installer now allows you to set a custom port number for the Caddy service instead of using the default port 443.

Release highlights in XEC 7.14

More Secure Evidence Password Handling

XEC Director 7.14 allows administrators to retrieve passwords for protected XRY, XRYCASE, and PDF files if lost. When enabled, entered passwords are encrypted and stored securely in XEC Director for recovery when needed.

Transfer or Revoke Shared Licenses

With Enterprise License Management, administrators can now transfer or revoke shared licenses for XRY Express version 11.1 or higher. Licenses can be moved between online devices or reclaimed from inactive sessions to ensure availability for urgent extractions.

Simplified License Management in Restricted Networks

XEC Director 7.14 enables administrators to distribute template licenses directly to client systems, removing the need for internet access to the MSAB license server. This supports compliance in restricted networks and is available with Enterprise License Management for XRY 11.1+ and XAMN 8.2+.

Filter the Log on Any Property

You can now filter log events in XEC Director by any property or property value, even those not shown in the event table columns. Use the new Property and Property Value filters to quickly find relevant log entries.

More Aligned Standard Reports

Four standard reports in XEC Director now present extraction-related information more consistently. They also clearly show when generic extraction profiles are used. Updated reports include Client System Activity, Client System Group Activity, User Activity, and User Group Activity.

Set a Limit for Client System Database Log Size

XEC administrators can now define a size limit for client system database logs. When exceeded, a warning appears on the Client Systems page and the log size is shown in red on the Overview tab for Kiosks and Tablets. A Clear database log option is also available.

Clear System Page Action Button Moved

To declutter the action ribbon, the Generate Standard Reports button on the Client Systems page has been moved to the right-click menu. It still opens the Standard Reports page with the selected client systems pre-filled.

Release highlights in KTE 11.1

Enhanced Handling of Password Protected Evidence

XEC Director administrators can now retrieve passwords for protected XRY, XRYCASE, and PDF files if lost. When enabled, passwords from Kiosks, Tablets, and XRY Express are securely encrypted and stored in XEC Director for recovery when needed.

Password Protection for Workflow PDF Files

PDF files generated from workflows are now automatically password protected when the workflow is set to apply document protection.

Support for BitLocker Protected USB Hard Drives

Kiosks and Tablets now support exporting files to USB hard drives secured with BitLocker, expanding beyond the previous support for BitLocker protected USB sticks.

If you want to learn more about what’s new in XRY, you’ll find a comprehensive version of the Release Notes from the MSAB Customer Portal.

Ready to upgrade? Download the new releases now!

Download new releases

If you need any assistance or have questions, don’t hesitate to reach out to our support team.