MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsMSAB
MSAB XRY
XRY is MSAB's mobile data extraction software, sold as a family of modules and delivered on office, field, kiosk and tablet platforms. Its output is analysed in XAMN and managed through XEC.
SoftwareCommercialCurrent
Profile
- Manufacturer
- MSAB
- Category
- Mobile forensics
- Product type
- Software
- Platforms
- Not stated by the manufacturer
- Licensing
- Commercial
- Product status
- Current
- Educational level
- Intermediate
- Last verified
- 2 November 2026
MSAB's product pages group XRY under MSAB Extract, with XAMN under MSAB Analyze and XEC under MSAB Manage. The platform names Office, Field, Kiosk, Tablet and Express are MSAB's current terms. The operating system is not stated on the XRY family page, so platforms are left empty here.
What MSAB XRY is
MSAB, originally Micro Systemation, is the Swedish company behind XRY. Where Cellebrite sells one suite, MSAB splits the work into three product lines: Extract (XRY), Analyze (XAMN) and Manage (XEC). XRY itself is a family. XRY Logical is the quickest route and recovers live and file system data through the phone's own interfaces. XRY Physical bypasses the operating system to reach protected and deleted data where the hardware allows. XRY Cloud collects from connected cloud storage. XRY Photon recovers Android app data that normal extraction cannot reach by driving the app on screen and reading what appears. XRY Camera adds photographs of the handset to the report. XRY Pro is the advanced tier for hard devices.
The software is delivered on MSAB hardware platforms: Office for the lab, Field as a ruggedised laptop build, Kiosk and Tablet for front-line use in a controlled setting and Express for speed. MSAB has put weight on chain of custody features in recent releases, so an examiner can show which module ran, when and with what result. The examiner's judgement remains: which module to try first, what the phone's state allows and how to record each step.
Primary applications
Where it is used
- Logical and file system extraction from Android and iOS devices
- Physical extraction from supported devices to reach deleted data
- App data recovery through on-screen capture where decoding is not available
- Cloud data collection linked to a lawfully examined device
- Front-line extraction at a kiosk or tablet under laboratory policy
- Feeding extractions to XAMN for analysis and to XEC for management
Who uses it
- Police and agency mobile examiners
- Forensic laboratory analysts
- Front-line officers using Kiosk or Tablet platforms under supervision
- Students learning extraction methods
Capabilities and limits
Major capabilities
- XRY Logical for live and file system data
- XRY Physical for operating-system-level bypass on supported hardware
- XRY Cloud for connected cloud storage
- XRY Photon for Android app data via screen capture
- XRY Camera for photographing the exhibit into the report
- Pre-indexing of extracted files for faster loading in XAMN Pro
- Delivery on MSAB Office, Field, Kiosk, Tablet and Express platforms
Technical limitations
- Locked and encrypted modern phones need XRY Pro or external access services, which are licensed separately
- Screen-capture methods such as Photon are slow and capture only what the app displays
- Analysis needs XAMN; XRY on its own is the extraction step
- Device support changes with each release, so release notes must be read before an examination
Learning with DFRTI
Independent professional education covering the principles and workflows of MSAB XRY. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- Extraction grades and what each can and cannot recover
- Android and iOS storage and security basics
- Documentation and hashing of extractions
Disciplines
Related tools
- MSAB XRY ProXRY Pro is the advanced tier of the XRY family, aimed at locked and encrypted devices that standard modules cannot reach. MSAB restricts it to practitioners who hold a current XRY certification.MSAB
- MSAB XAMNXAMN is where an XRY extraction becomes readable evidence. MSAB sells XAMN Pro for analysis and gives away XAMN Viewer so that others in the case team can open the same files.MSAB
- MSAB XECXEC is MSAB's Manage line. XEC Director connects every XRY installation in an organisation into one network for oversight and updates, while XEC Export batch-exports XRY files.MSAB
- Cellebrite UFEDUFED is the name most examiners know for Cellebrite's phone extraction tool. Today it continues as the access and extraction part of the Inseyets suite.Cellebrite
- Oxygen Forensic DetectiveOxygen Forensic Detective is an all-in-one extraction and analysis tool for phones, cloud accounts, drones and other connected devices. On 2 November 2026 the maker's website could not be checked, so this profile is marked unverified.Oxygen Forensics
- MOBILedit ForensicCompelson now sells its phone forensics tool as MOBILedit Forensic. The Forensic Express name survives only in old web addresses. The product comes in editions, from a single-phone licence to the ULTRA edition that the maker classes as a dual-use item.Compelson
Courses that cover this tool
MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reports
MobileMobile & IoT ForensicsiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone cases
MobileMobile & IoT ForensicsSIM / Memory Card ForensicsICCID, IMSI and SMS from SIM cards, plus FAT and exFAT recovery from SD and microSD cards
NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.Official source
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.