Extract. Analyse. Present.
MSAB is a Swedish mobile-forensics specialist, focused end-to-end on mobile-device evidence: extraction, analysis, and case management. Depth over breadth, built for law enforcement, military, intelligence, customs, and financial crime.
About MSAB
Focused specialists, since 1984.
MSAB has done one thing for four decades: mobile-device forensics, done thoroughly.
Founded in Stockholm in 1984, MSAB (Micro Systemation AB) is one of the longest-established specialists in mobile forensics. The company is publicly listed on Nasdaq Stockholm, holds a AAA credit rating, and employs approximately 250 people across European, APAC, and Five Eyes markets.
The product range spans three software families and six hardware platforms. XRY handles extraction, XAMN analysis, XEC centralised case management. Each hardware platform (Office, Field, Kiosk, Tablet, Express, Frontliner) packages the same underlying engine for a different operational context: lab examiner, field operator, station kiosk, or frontline officer.
Where broader forensic platforms span mobile, computer, and cloud in one product, MSAB stays inside mobile and goes deep. Chinese chipset coverage (Mediatek, Spreadtrum, CoolSand, Infineon) remains a differentiator in organised-crime and counter-narcotics investigations. Hashing, traceability, and chain of custody are intrinsic to the workflow.
The software portfolio
Four families, one case format.
MSAB organises around four software families: XRY for extraction, XAMN for analysis, XEC for centralised case management, and UNIFY for multi-investigator collaboration. Every product across the range writes to the same secure .XRY case format for chain-of-custody continuity from field to court.
Extract
The extraction engine. Over 43,400 supported device profiles and 4,300 application versions. Logical, physical, cloud, and Photon screen-capture methods across the range.
- XRY Pro: advanced extraction with BruteStorm Surge for GPU-accelerated PIN and pattern recovery
- XRY Physical: deep physical extractions from locked and encrypted devices
- XRY Logical: fast logical extractions for everyday casework
- XRY Cloud: consent-based cloud data acquisition
Analyse
Analysis and reporting for the extracted evidence. Search, filter, visualise, decode, and produce court-defensible reports at the end of it.
- XAMN Pro: advanced analysis, filter, and search across vast datasets
- XAMN Viewer: free tool for prosecutors, expert witnesses, and reviewers
Manage
Centralised oversight for forensic operations at scale. Fleet management, policy enforcement, role-based access, and centralised evidence storage.
- XEC Director: fleet management and role-based access control
- XEC Export: batch outputs across the case portfolio
UNIFY Collaborate
Collaborate. Centralise. Safeguard.
Enhancing efficiency and security across mobile-forensics operations. Real-time collaboration lets multiple investigators work the same case simultaneously, with centralised evidence storage and native ingest for Cellebrite UFDR and GrayKey extractions alongside .XRY.
Real-time collaboration across specialists, investigators, and reviewers. Multiple people work the same case simultaneously, with centralised evidence storage and role-based access. No sequential handoffs, no version drift.
Where UNIFY earns its place is in mixed-vendor environments. Cellebrite UFDR and GrayKey extractions ingest natively alongside .XRY, so agencies with existing extraction investments consolidate case management without switching tools. For multi-jurisdiction task forces and long-running investigations, UNIFY is the layer that keeps everyone on the same case, at the same time, with the same audit trail.
- Task forces
- Multi-jurisdiction
- Long-running cases
- Mixed toolchains
- Real-time multi-investigator case work
- Centralised evidence, role-based access
- Ingests Cellebrite UFDR + GrayKey + native .XRY
- Reduces single-vendor lock-in risk
- Full audit trail across every action
Frontline
Equip and empower your frontline.
The MSAB Frontline range puts XRY extraction into the hands of operational officers. Turnkey packages for kiosks, tablets, secure Windows deployments, and advanced field extraction: reducing lab backlogs, accelerating suspect processing, and preserving forensic integrity at every step.
XRY Pro Express
Advanced extractions, built for the frontline
The XRY Pro Express brings the power of XRY Pro into the simplicity of XRY Express, giving frontline teams the tools to extract critical data quickly and confidently.
Frontline advanced extraction, ISO 17025 compliant deployments.
XRY Kiosk
Secure, high-volume extractions in controlled environments
A turnkey touchscreen terminal running the full XRY engine. Guided workflow walks users through each step, enabling frontline personnel to perform fast, consistent extractions with minimal training. Locked-down configuration and automatic audit logging support ISO 17025 and ISO 27037:2012 compliance.
Police station triage, volume-crime processing, backlog reduction.
XRY Tablet
Portable, on-scene extractions for frontline staff
Lightweight ruggedised tablet with detachable keyboard. Whether the device belongs to a victim, witness, or suspect, the Tablet lets users recover only the relevant data on the ground, minimising disruption and accelerating investigations. Includes 12-month XRY Logical and/or Physical licence and XAMN Express for analysis and reporting.
Victim, witness, or suspect extractions on-scene.
XRY Express
Simplified XRY extractions on any standard workstation
XRY Express delivers a simplified, locked-down workflow for easy mobile device extractions on Windows-based PCs. Brings the same guided interface used in XRY Kiosk directly to your workstation, enabling frontline users to recover actionable evidence in minutes.
Distributed operations where dedicated hardware isn't practical.
Strategic capability
Two capabilities that change the timeline.
Mobile forensics is not standing still. MSAB has invested in two areas where the case timeline compresses from days to minutes, or opens up an evidence category that wasn’t reachable before.
XRY Pro capability
BruteStorm Surge
Password recovery in minutes, not days.
As mobile encryption strengthens, traditional CPU-based brute forcing has stopped keeping up. BruteStorm Surge uses commodity GPU hardware (NVIDIA GeForce RTX 3090, 4090, 5090) to accelerate password recovery by orders of magnitude, without risking device integrity.
Smart password mutation expands the wordlist automatically. Adaptive cracking workflows match the complexity of the case. Linear scaling across multiple GPUs. And it runs offline (no device connection required), enabling secure high-speed cracking on dedicated systems.
- Fully supports Android FBE and FDE encryption
- Integrates seamlessly with XRY Pro
- Offline operation, no device connection needed
- Two hours of MSAB consultancy included for initial setup
Vehicle forensics
Berla iVe
Vehicle data inside the same case file.
Modern vehicles carry as much digital evidence as the phones inside them: infotainment history, connected-device logs, telematics data, navigation tracks. Berla iVe is the mature vehicle-forensics platform, and MSAB's formal partnership means vehicle data ingests directly into the XAMN workflow alongside the mobile evidence.
MSAB delivers the Berla iVe Certification training as part of the MSAB Academy programme, and the resulting extractions land in the same case format as the rest of the workflow, with no re-tooling required to correlate vehicle evidence with device evidence.
- Vehicle infotainment and telematics extraction
- Certified training programme delivered by MSAB Academy
- Data ingests directly into XAMN alongside mobile evidence
- Single case-file view across vehicle and device
Ready to talk?
MSAB for your operational context.
- Law Enforcement
- Military
- Border Control
- Corrections
- eDiscovery
Every deployment is different. Let's find the right fit for yours.