Q2 2026 Major Release is now available

Q2 2026 Release: More Devices, Deeper Evidence, Faster Review

Mobile platforms do not pause for forensic workflows. The latest operating systems are already in the hands of users, and in the hands of suspects. Every OS update that outpaces an extraction tool is a potential gap in evidence. Closing that gap consistently, across every device type and every operating system version, is one of the fundamental challenges in digital forensics today.

MSAB’s Q2 2026 release closes several of those gaps at once. It extends OS support to the very latest versions of both major mobile platforms, introduces extraction for a class of device that has historically been out of reach, improves the quality of physical extraction by addressing the precise moment RAM is captured, and surfaces evidence from apps and device features that were previously invisible to forensic tools. Alongside these, XAMN 8.8 reduces the time investigators spend reviewing video, and XEC Director 7.18 tightens control over shared forensic infrastructure.

Download the Q2 26 Release

Explore the key product highlights below:

XRY Pro 11.5

Faster extraction on the latest Android devices and improved RAM extractions

Extraction and brute-forcing on the latest generation of Android devices is significantly faster, with file uploads to the device no longer required as a step in the process. XRY Pro also now captures RAM before initiating brute-forcing on all physical extractions. Capturing RAM first means the snapshot reflects the device’s state before any forced authentication begins. For investigators whose cases depend on what is held in volatile memory, this sequence change directly improves what they can recover.

XRY 11.5

Enrichment when you need it, on the data you’ve selected

In XRY 11.5, enrichment runs in the post-processing phase rather than during decoding so it only processes the data you actually selected. For selective extractions, that directly reduces processing time: extract messages and call logs, and enrichment runs on messages and call logs, not the entire device.

XAMN 8.8

Video evidence that reflect what is actually on screen

Video is one of the most time-intensive evidence types to review, and one of the most likely to be handled quickly under case pressure. The new intelligent thumbnail feature in XAMN 8.8 changes the approach.
Instead of capturing a frame at a fixed timestamp, thumbnails are now generated at scene changes. Hovering over a thumbnail in the List, Gallery, or Column view allows scrubbing through the surrounding footage without opening the video player. When XRY 11.5 and XAMN 8.8 are used together, those thumbnails are also generated at higher resolution than before. For any case with significant volumes of video evidence, this reduces the time between finding a video artifact and understanding what it contains.

XEC 7.18

Reporting that speaks the same language as your team

XEC Director 7.18 updates the reporting platform so that datasets use clear, descriptive names rather than the underlying database view names they were previously labelled with — making reports readable without needing to cross-reference the reporting architecture. A new pause function lets administrators safely run database updates without the risk of data loss mid-operation. An installation timing issue, where the XEC Database Tracker could fail to synchronise with the XEC Report Service during setup, has also been resolved, reducing the risk of unreliable reporting configurations after install.

Alongside these highlights, the Q2 2026 release brings usability and efficiency improvements across the suite.

XRY Pro 11.5

• Expanded RAM dump support across an additional access method, and media file carving added for the Upload Mode Generic extraction profile.
• BruteStorm Surge extended to support the latest Android version. Brute-force dialog updated to handle Unicode paths and wide strings, including Japanese and Korean characters in file names.

XRY 11.5

• New access methods for Full File System (FFS) Unlocked added across latest Android devices.
• App decoding updates: Signal Stories as Status updates, linked replies, group display pictures; Telegram new message types; Google Messages conversation and group decoding improvements.
• Crypto evidence from RAM: wallet seeds, wallet IDs, and addresses across ten cryptocurrencies, with CRC validation and dedicated icon in XAMN.

XAMN 8.8

• SMS, MMS, and chat messages consolidated under Communication > Messages. Delivery method preserved as a per-artifact property.
• Device > Process artifact sub-category introduced for RAM process artifacts, with navigable relationships to associated evidence.

XEC 7.18

• Quick log filters: Today, Last 7 days, Last 30 days, and Last year available as single-click filters in the Log pane.
• Shared licence blocking: specific client systems can be blocked from receiving shared licences.

KTE 11.6

• Smart lock screen displays active workflow stage and running extraction module while the device is locked. Requires password-protected lock screen to be enabled.
• Keyboard navigation updated in the XRY Kiosk File List: Tab and arrow keys to navigate, Space to select.

Visit the Customer Portal to explore the full list of the Q2 2026 updates and see how MSAB continues to lead the way in mobile forensic excellence.

Download the Q2 26 Release