MSAB is excited to introduce the latest releases of XRY, XAMN, XEC and KTE
Now available: XRY 10.12, XAMN 8.0, XEC 7.12 and KTE 10.12
Providing broader support & increased efficiency for smarter investigations
MSAB is excited to introduce the latest releases of XRY, XAMN, XEC and KTE that will take you to the next level in mobile data extraction and analysis. XRY sees improved third-party app extraction for unlocked Android devices, an updated Investigate pane has been added to XAMN, making it easier than ever to access the most relevant data quickly and efficiently.
Release highlights in XRY 10.12
Improved third-party app extraction for unlocked Android devices
When extracting an Android device with a Logical (Full read) extraction and the Full File System (FFS) extraction fails, XRY will now automatically try to extract app sandboxes. If this succeeds, XRY will extract all app data.
Enhanced Android FFS (Full File System) Unlocked Generic profile
The Android FFS Unlocked generic profile continues to improve with a further two exploits added that will allow you to extract even more data than before.
Added support for FFS extractions from iPhones via an agent
With the Apple iOS FFS Agent Unlocked Generic profile in XRY 10.12, you can use an agent to extract FFS from unlocked iPhones. iOS versions 15.0-15.7.1/16.1.2 are supported.
Support for UNISOC feature devices in XRY
UNISOC feature devices are now supported in XRY. An XRY Physical or XRY Burner License is required.
Improved Wi-Fi extraction capabilities
XRY now includes the ability to set up a local Wi-Fi hotspot, allowing you to pair your device with XRY. Once connected, XRY uses this connection to communicate with the device and extract the data.
XRY Pro
New BFU (Before First Unlock) brute forcing and extraction support for Exynos devices
XRY RAMalyzer - new feature Deep scan added
XRY Brute Storm updates - now possible to enter known digits as part of the mask
Release highlights in XAMN 8.0
Updated Investigate pane, get straight to the relevant data
In XAMN 8.0, we've made it easier for you to focus on the most relevant data. When you open a case, you'll now find two tabs in the Investigate pane; Highlights and All data. By default, Highlights is selected.
Match on PhotoDNA hashes when running Project VIC check
With a Project VIC database containing hashes for known child sexual abuse material (CSAM), XAMN can automatically grade pictures in the case that have hashes which match a hash in the database. From this release of XAMN, you can choose to also automatically grade pictures which are similar to any of the known CSAM.
Configure hiding of graded pictures and videos per category
The Project VIC functionality in XAMN comes with the possibility to hide graded pictures and videos, to prevent investigators from being exposed to known child sexual abuse material. This release adds granular options so you can choose which categories to hide.
Open an artifact directly in another view
When reviewing artifacts in one view, you sometimes want to open it in another view that is more suitable for further investigation of that type of artifact, while still retaining the context in the current work tab. This is now made easier. Right-click the artifact to show the available options.
Show pictures and videos on hover in the Column view
When working in Column view, you can now hover over the file name of any pictures or videos to show a thumbnail preview in a pop-up. This makes it easier to quickly review artifacts of different types in the Column view.
Languages added to the XAMN Text Intelligence Pack
The XAMN Text Intelligence Pack, used for offline translation and language detection, now supports three additional languages: Greek, Haitian Creole and Malay.
Increased support in XAMN Viewer
The Maps filter view is added, making it possible to get a geographical overview of artifacts with location data. This requires access to online maps.
The Timeline filter view is added, making it easier to filter artifacts based on a specific time span.
The Conversations view is added, making review of messaging artifacts more efficient.
The Recognized content filter is added, for review of results produced by image content recognition processing.
Release highlights in XEC 7.12
Remotely wake up Kiosks
From the 7.12 release of XEC Director, you can remotely wake up a Kiosk. Just right-click the client system and select Wake up.
Detailed information about last logged-in user
The information on which user that was last logged in to a client system is now more clearly presented.
Set a global KioskAdmin password in XEC Director
The global password can now be changed and configured for all XEC-connected Kiosk, Tablet, and XRY Express client systems.
Enterprise license fallback from XRY Pro to XRY Office
When using Enterprise License Management with both XRY Office and XRY Pro licenses, you can allow XRY Pro client systems to fall back to run XRY Office instead if no shared XRY Pro licenses are currently available.
See BitLocker status for each client system
In this release of XEC Director, a blue lock icon is shown if BitLocker is active on a client system. This is useful to easily get an overview of which client systems have BitLocker enabled.
Refreshing the full name of Active Directory users
Users can be added in XEC Director via the organization's Active Directory.
Improved reporting for Enterprise License Management systems
New reporting views have been added in XEC Director to provide insights on the usage of client systems in an XEC Enterprise Licence Management system.
Release highlights in KTE 10.12
Improved creation of automated documentation during workflows
Several improvements have been made to make use of Microsoft Word templates in the creation of automatic documentation, such as Forensic Process Documentation, easier, more robust, and more efficient.
Export Pre-scan information in XRY Express
In XRY Express, it's now possible to export the Pre-scan information to a PDF file.
Test connection to XEC to troubleshoot connection issues
On XEC-connected Kiosk and Tablet client systems, it's now possible for the Kiosk Administrator to test the connection to XEC Director.
For more information about the latest release, please join us on December 18 for our release webinar via this link or to access the recording at a later date –
To view the more detailed release notes please visit msab.com
