MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsMSAB
MSAB XRY Pro
XRY Pro is the advanced tier of the XRY family, aimed at locked and encrypted devices that standard modules cannot reach. MSAB restricts it to practitioners who hold a current XRY certification.
SoftwareCommercialCurrentWindows
Profile
- Manufacturer
- MSAB
- Category
- Mobile forensics
- Product type
- Software
- Platforms
- Windows
- Licensing
- Commercial
- Product status
- Current
- Educational level
- Advanced
- Last verified
- 2 November 2026
XRY Pro is a current MSAB product name, listed under MSAB Extract alongside XRY Logical, XRY Physical and XRY Cloud. MSAB's XRY Pro page states that a current XRY certification is required for eligibility and lists Windows 10/11 among requirements. MSAB's press release dates the launch to December 2022.
What MSAB XRY Pro is
MSAB launched XRY Pro in December 2022 and lists it today as a current product under MSAB Extract. It exists for the cases where XRY Logical and XRY Physical stop: a handset that is locked, encrypted or built on a chipset for which no ordinary method exists. MSAB describes it as its most advanced tool for extraction and decryption, with access to challenging devices and regular updates as new capabilities arrive. It also includes a RAM analysis tool, which MSAB presents as an industry first for mobile work.
This is not software for a beginner. MSAB states that a current XRY certification is required before a practitioner can take on XRY Pro and recommends its on-demand training. In a lab the same governance that applies to any advanced access applies here: a documented legal basis, a decision by a supervisor, preservation of the device before the attempt and a record of what was tried. The published requirements point to a Windows 10 or 11 workstation with a reasonable processor and memory.
Primary applications
Where it is used
- Extraction from locked and encrypted devices under a court order
- Access to handsets on chipsets that standard XRY modules do not support
- Decryption of data that a normal extraction returns in encrypted form
- RAM analysis on supported devices
- Escalation path when XRY Logical and XRY Physical have been exhausted
Who uses it
- Certified XRY practitioners in agency laboratories
- Senior mobile examiners who handle escalations
- Laboratory managers approving advanced access work
- Students studying the governance of device access rather than its operation
Capabilities and limits
Major capabilities
- Advanced extraction and decryption beyond XRY Logical and XRY Physical
- Regular capability updates for new devices and chipsets
- RAM analysis tool
- Unlimited unlocks and extractions within the licence as described by MSAB
- Works within the same XRY, XAMN and XEC workflow
- Also offered on the XRY Pro Express front-line platform
Technical limitations
- Eligibility requires a current XRY certification, so it cannot be bought and used in isolation
- No vendor can promise access to every device; support depends on model, chipset and software version
- A failed attempt can change device state, which must be anticipated and recorded
- Advanced access must rest on legal authority; without it the act is unlawful
Learning with DFRTI
Independent professional education covering the principles and workflows of MSAB XRY Pro. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- Working experience with XRY Logical and XRY Physical
- Understanding of mobile encryption and the states in which a device is protected
- Legal procedure for authorised examination of seized devices
Disciplines
Related tools
- MSAB XRYXRY is MSAB's mobile data extraction software, sold as a family of modules and delivered on office, field, kiosk and tablet platforms. Its output is analysed in XAMN and managed through XEC.MSAB
- MSAB XAMNXAMN is where an XRY extraction becomes readable evidence. MSAB sells XAMN Pro for analysis and gives away XAMN Viewer so that others in the case team can open the same files.MSAB
- Cellebrite PremiumPremium is Cellebrite's advanced access capability for locked and encrypted handsets. Cellebrite has said the Premium name is going away as its capabilities are folded into Inseyets.Cellebrite
- Magnet GraykeyGraykey is Magnet Forensics' device access product for locked iOS and Android handsets. Magnet sells it only to public safety agencies in selected countries and vets every enquiry through an agency email address.Magnet Forensics
Courses that cover this tool
MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reports
MobileMobile & IoT ForensicsiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone cases
LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.Official source
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.