Forensics product

01

MSAB Office

The All-in-One Mobile Forensic System from MSAB.

MSAB Office is the all-purpose forensic system from MSAB offering the XRY product solutions in a package. MSAB Office allows investigators to access all possible methods to recover data from a mobile device.With a choice of Logical, Physical, Cloud & PinPoint recovery tools for all supported devices the Office kit works on your PC to produce a secure forensic report containing data extractions from mobile handsets.

 

02

MSAB Field

For Mobile Units in Demanding Conditions.

MSAB Field is ideally suited for mobile units in demanding conditions. This equipment is designed for examiners in the field, such as military intelligence, crime scene investigators and international organizations like United Nations peacekeepers. The Field Version incorporates all of these features – with hardware and software combined to perform a complete and rapid analysis for the vast majority of mobile devices available today.

03

MSAB Tablet

A Lightweight Portable Solution for Faster Examinations.

With a touch screen interface, the MSAB Tablet is designed to quickly and easily recover data from mobile devices. Tablet allows you to plug in the mobile device, touch the screen and extract the data within minutes, wherever you are. Whilst complex cases or devices will always need highly trained personnel, the Tablet can help speed up the ‘triage’ process of assessment by allowing investigators quick access.

Add-ons

XRY Logical

The starting point for mobile forensics

WHAT IS XRY LOGICAL?
XRY Logical is the quickest extraction method because it enables you to access and recover live and file system data from the device right on the crime scene. It extracts data from digital devices by communicating with the operating system of the device. The service is automated but is the equivalent of manually examining each screen on the device and recording what is displayed. With the proprietary XRY file format, the data and the integrity of your evidence is kept safe from extraction all the way to court and conviction.
XRY Logical is our entry-level solution for forensic investigators and the starting point for our license options.

XRY Photon

Acquire Android app data when other tools can’t

What is XRY Photon?
As app versions and security protocols are constantly improved, mobile extraction tools can fail to extract decrypted app data. Until now, this has forced examiners to use time-consuming manual processes such as using a camera to capture, review and present app data.
XRY Photon is like an automated version of manual app examination for Android devices, with the added benefit of storing the documented data in a searchable way, which enables text search, filtering and other types of analysis.

XRY PinPoint

The solution for non-standard mobile devices

WHAT IS XRY PINPOINT?
XRY PinPoint lets you extract and decode data from non-standard mobile devices, such as cheap imitation phones from Asia. Since the connector is the main forensic challenge here, this solution is comprised of powerful software that automatically detects the pin-out configuration and compact hardware.
XRY PinPoint is fully integrated and uses the familiar and easy-to-use XRY Logical/Physical interface, but requires a separate license. It is continuously updated so it stays current and improves over time.
PinPoint supports devices with chipsets from MediaTek, SpreadTrum, Coolsand and Infineon.

XRY Physical

Physical recovery of data from mobile device

WHAT IS XRY PHYSICAL?
XRY Physical lets examiners bypass the operating system to dump all the raw data from the device. This memory dump gives you access to system, protected and deleted data, and also allows you to overcome security and encryption challenges on locked devices. Using XAMN Spotlight, you can see the hex code quickly and by activating source mode, you can verify the original raw data.
XRY Physical is the next level license for the physical recovery of data from mobile devices.

 

XRY Cloud

Recovery of data beyond the mobile device

WHAT IS XRY CLOUD?
XRY Cloud recovers data beyond the mobile device itself from connected cloud based storage by using the tokens on mobile devices that enable apps to function without the need for users to re-enter their login details. This is particularly useful when looking for online social media data and app-based information for services such as Facebook, Google, iCloud, Twitter, Snapchat, WhatsApp, Instagram and more.
You can use XRY Cloud both with the actual device in your possession and without. XRY Cloud is a separate component within the XRY software. XRY Cloud can be used as a standalone product or as part of a suite of tools within the wider MSAB Ecosystem.

XRY Camera

Gather supporting picture and video evidence

WHAT IS XRY CAMERA?
XRY Camera gives forensic examiners the opportunity to complement their XRY reports with photos of the examined device from an HD camera. Sometimes a screenshot is the only way to capture relevant evidence and help validate device extraction results.
Securing unique smudge markings on a smartphone screen, unusual identifying features or the IMEI on the device sticker underneath the battery can be critical in a case. XRY Camera lets you include these critical supporting images in the relevant XRY files and add examiner notes in real-time to support your case. And it is all done in an evidentially sound manner.
XRY Camera is a separate, hardware-based solution.

XAMN Viewer

A free and easy-to-use analysis tool

XAMN Viewer is a simplified analysis tool that is free to download and use. It can be distributed to anyone in your organization that needs to open, view, analyze and/or report on mobile device data. Like XAMN Spotlight, XAMN Viewer is designed to help users slice, dice and search through large volumes of data to find key evidence and/or intelligence.
XAMN Viewer is a no-installation software application that can be provided along with extracted data to any authorized person – supervisors, investigators, legal advisors, court administrators, prosecution staff and others — to give them access to digital information found in mobile devices.

XAMN Elements

Advanced data reconstruction made easier

WHAT IS XAMN ELEMENTS?
The new XAMN Elements helps you make sense of the extracted data and find the critical pieces of evidence your investigations need. It lets you dive deeply into the hex data, with full searching capabilities even across different data sets, using powerful search engine functionality. You can also identify, investigate and validate information more easily thanks to Elements’ precise bookmarking and highlighting functionality. Furthermore it lets you manually reconstruct data, allowing you to carve out and make sense of undecoded binary information.
Using the Unified Elements Map, you know where you are at all times, which makes it easier to navigate and reconstruct all the data safely, find the missing evidence and analyze it. XAMN Elements also helps to pre-identify decoded data, visualizing the undecoded data as white areas so you can zero in on the most fertile areas and work quicker. Furthermore it is fully integrated with XAMN Spotlight, enabling a seamless workflow that includes combined reporting. And very importantly, Elements makes it easier to defend the validity of your findings. Plus the intuitive modern user interface combined with the software’s high performance significantly cuts down processing time.

XAMN Spotlight

Automatic image recognition
and Location Range Filter

You need a lot of investigative power to search through millions of artifacts. XAMN Spotlight gives it to you, enabling you to get through massive amounts of data faster. Current users of MSAB Office or MSAB Field also receive a Spotlight license.

Spotlight now lets you view images by categories such as drugs, weapons and people, enabling faster searches of large volumes of images. And you can now focus your searches by geographic location as another time-saving option.

XAMN Horizon

Visualize extracted data in new, useful ways

WHAT IS XAMN HORIZON?
XAMN Horizon has three added viewing capabilities: Geographic view, Timeline view and Connection view. These views enable you to discover and investigate data from different perspectives.
Zoom in or out to focus your analysis on any point in time using the Timeline view.
The Geographic view lets you navigate data by location. Find places of interest and investigate the data connected to those places – such as calls made or received, pictures taken and more.
And finally, use the incredibly powerful Connection view to discover and investigate the interactions between different device owners and accounts.