XRY by MSAB: Advanced Mobile Data Extraction

Published March 1, 2026 | By Digital Evidences

In the world of mobile forensics, having access to multiple extraction tools is essential because no single platform can handle every device and scenario. XRY by MSAB is one of the most respected mobile forensic solutions available, used by law enforcement agencies and forensic professionals in over 100 countries. Its unique approach to mobile data extraction and its compact, field-ready design make it an indispensable tool in the digital forensics toolkit.

What Is XRY?

XRY is a complete mobile forensic system developed by MSAB, a Swedish company specializing in mobile device examination technology. The platform includes both hardware and software components designed to extract data from smartphones, tablets, GPS devices, drones, and other mobile platforms. XRY supports thousands of device profiles across iOS, Android, and legacy operating systems, with new profiles added regularly to keep pace with the constantly evolving mobile landscape.

Extraction Methods

XRY provides multiple extraction methods to accommodate different devices and security configurations. Logical extraction retrieves data through the device's standard interfaces, accessing contacts, messages, call logs, media files, and application data. Physical extraction goes deeper, accessing the raw storage of the device to recover both active and deleted data. File system extraction provides a complete view of the device's file structure, including hidden and system files.

For devices with advanced security protections, XRY offers chip-off and JTAG capabilities through its XRY Physical product line. These hardware-level extraction methods bypass software-based security entirely by reading data directly from the storage chip or through the device's debugging interface. This is particularly valuable for damaged devices or those with unknown passcodes where other extraction methods cannot be applied.

XAMN: Analysis and Reporting

MSAB's companion analysis tool, XAMN, works with data extracted by XRY to provide detailed examination and reporting capabilities. XAMN organizes extracted data into intuitive categories, allowing examiners to quickly navigate through messages, contacts, media, applications, and location data. The tool includes timeline visualization, relationship mapping, and powerful search and filter functions that help investigators identify relevant evidence within large datasets.

XAMN also supports data from other forensic tools, making it a versatile analysis platform that can correlate evidence from multiple extraction sources. Reports generated by XAMN are formatted for court presentation and include all necessary metadata, hash values, and chain of custody documentation.

Field-Ready Design

One of XRY's distinguishing features is its portable, self-contained design. The XRY Kiosk and XRY Field models are specifically built for on-site extraction, allowing forensic examiners to collect data at crime scenes, border crossings, or field offices without needing to transport devices to a laboratory. This rapid deployment capability can be critical in time-sensitive investigations where evidence may be remotely wiped or altered if the device remains in the field.

Complementary to Other Tools

Professional forensic laboratories often use XRY alongside tools like Cellebrite UFED and Oxygen Forensics Detective. Different tools may succeed with different devices or recover different data artifacts from the same device. Using multiple extraction platforms and comparing results ensures the most complete and thorough evidence collection possible. This multi-tool approach is considered best practice in the forensic community and strengthens the defensibility of findings in court.