MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsMSAB
MSAB XAMN
XAMN is where an XRY extraction becomes readable evidence. MSAB sells XAMN Pro for analysis and gives away XAMN Viewer so that others in the case team can open the same files.
SoftwareCommercialCurrent
Profile
- Manufacturer
- MSAB
- Category
- Mobile forensics
- Product type
- Software
- Platforms
- Not stated by the manufacturer
- Licensing
- Commercial
- Product status
- Current
- Educational level
- Intermediate
- Last verified
- 2 November 2026
MSAB's XAMN page lists XAMN Pro and XAMN Viewer under MSAB Analyze. XAMN Elements is not on that page; an MSAB blog post describes it as the successor to XACT, bundled with XRY Physical, so its current status is not confirmed here. The page does not state an operating system.
What MSAB XAMN is
MSAB groups its products into Extract, Analyze and Manage. XAMN is the Analyze line. After XRY has pulled data from a handset, XAMN opens that extraction and lays it out as contacts, calls, chats, pictures, files and locations, each tied back to the record it came from. The MSAB page names two products today, XAMN Pro for full analysis and XAMN Viewer, a simplified version that is free to download so an investigator or a prosecutor can look at the data without owning a licence.
XAMN Pro is not limited to XRY output. MSAB says it can take in data from third-party forensic tools, call detail records from telecom operators and returns from online service providers, so a case with several sources can be filtered in one place by content type, text, time, phone, file size, location, deletions and patterns. The tool also classifies images into categories such as weapons, drugs and people. That classification is a pointer for the examiner, not a conclusion. Every image that matters must be looked at and described by a person before it reaches a report. An older product, XAMN Elements, handled raw binary data; it is not listed on the current product page.
Primary applications
Where it is used
- Reviewing XRY extractions from Android, iOS and feature phones
- Filtering a large extraction down to the records that answer the investigation's question
- Bringing call detail records and service provider returns into the same case as device data
- Checking parsed chats and media against the raw record behind them
- Preparing reports and sharing them through the free XAMN Viewer
Who uses it
- Mobile examiners who extract with XRY
- Investigators reviewing extractions in XAMN Viewer
- Analysts combining telecom records with device data
- Students learning how a decoded extraction is structured
Capabilities and limits
Major capabilities
- Opens XRY extractions, including pre-indexed files that load in seconds
- Ingests data from third-party tools, call detail records and online service provider returns
- Filters by content type, text, time, phone, file size, location, deletions and patterns
- Automatic image classification into categories such as weapons, drugs and people
- Reporting in standard forensic report formats and other file formats
- XAMN Viewer, a free simplified version for review across an organisation
- Thirty-day trial of XAMN Pro on request
Technical limitations
- XAMN reads what XRY or another tool extracted; a poor extraction gives a poor analysis
- Image categorisation is automated and must be confirmed by a human before it is reported
- XAMN Viewer is described by MSAB as simplified, so deeper analysis needs XAMN Pro
- The product page does not state the operating system, so the platform is not listed here
- XAMN Elements, the binary data tool, no longer appears on MSAB's product page
Learning with DFRTI
Independent professional education covering the principles and workflows of MSAB XAMN. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- The XRY extraction types and what each one contains
- How SQLite and app databases hold messages and media
- Report writing that keeps a tool's output separate from the examiner's finding
Disciplines
Related tools
- MSAB XRYXRY is MSAB's mobile data extraction software, sold as a family of modules and delivered on office, field, kiosk and tablet platforms. Its output is analysed in XAMN and managed through XEC.MSAB
- MSAB XRY ProXRY Pro is the advanced tier of the XRY family, aimed at locked and encrypted devices that standard modules cannot reach. MSAB restricts it to practitioners who hold a current XRY certification.MSAB
- MSAB XECXEC is MSAB's Manage line. XEC Director connects every XRY installation in an organisation into one network for oversight and updates, while XEC Export batch-exports XRY files.MSAB
- Cellebrite Physical AnalyzerPhysical Analyzer is the decoding and analysis side of Cellebrite's mobile workflow. PA 7 is being discontinued and the database-backed PA Ultra has become Inseyets.PA 10.x.Cellebrite
- Oxygen Forensic DetectiveOxygen Forensic Detective is an all-in-one extraction and analysis tool for phones, cloud accounts, drones and other connected devices. On 2 November 2026 the maker's website could not be checked, so this profile is marked unverified.Oxygen Forensics
- Magnet AxiomAxiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.Magnet Forensics
Courses that cover this tool
MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reports
MobileMobile & IoT ForensicsiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone cases
LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.Official source
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.