XRY Advanced Features

Vernon Fryer, one of our inhouse experts at Risk Diversion, is excited about deploying the latest XRY 10.7 which brings significant extraction and decoding capabilities to more mobile devices, with the total number of supported devices exceeding 45.600 and over 4400 app versions. The recent release is the latest major release of Apple’s iOS operating system for the iPhone. Concurrently the Android 14 is the latest major release of the Android mobile operating system.

The arrival of iOS 17 and Android 14 has ramifications for the mobile forensics industry, as they usher in some novel changes and features. As phone users continually seek updates and the phone giants comply, so must we and our products.

The precise and accurate OCR recognition in Apple Photos applies OCR and content recognition on all pictures in the media partition. This means that machine and handwritten text in pictures, as well as the content in images, is recognized and decoded to be searchable in XAMN.

This new feature will significantly enhance the speed and comprehensiveness of digital investigations. It will be easier and more precise than ever to perform keyword searches, content searching, to analyse pictures that contain text, find place names and so much more.

Fryer says in addition we are delighted to announce that we now offer selective extraction possibilities when you’re using an FFS. We’ve expanded our capabilities to now support app selection, meaning you can select from which specific apps to extract data for Full File System extractions. The benefits of this new feature are multifaceted.

It’s very valuable in cases where only a fraction of the data on the device is relevant to your case, and you want to speed up the data extraction process. While previously you might have waited for 40 minutes or an hour to perform a full file system extraction on a device, by extracting only the data from a specific app, you can now accomplish this feat in as little as two minutes.

Beyond the extraction speed, this new feature holds legal significance. In certain scenarios, you may encounter legal regulations dictating that you can only extract data relevant to your case. The ability to selectively extract data from specific apps of interest helps ensure strict compliance with these legal requirements.

This new feature is a game-changer when speed is of the essence and legal standpoints must be observed.

WhatsApp is, without a doubt, one of the most popular messaging platforms.

The new “Chat Lock” feature intended to make it easier to keep conversations more private. The locked chats can only be opened via biometrics. It’s not hard to see why this feature might appeal to criminals and individuals with malicious intent. So, we moved quickly and introduced support for this new feature. In the most recent version of XRY, locked chats are decoded.

Additionally, WhatsApp messages that have been edited are shown with the timestamp of when they were edited.

Fryer added, just like mobile devices, vehicles also keep track of a lot of data. So, it comes as no shock that nowadays vehicle forensics plays a substantial role in many DFIR investigations.

Given the growing demand for vehicle forensics, you’ll be pleased to know that Risk Diversion now supports the import of Berla iVe files for vehicle forensics data. This import decodes locations, routes, and vehicle events such as gear shifts or doors opened. It also decodes information from the vehicle’s entertainment system, such as any mobile devices that have been connected to the system.

Being able to investigate a mobile device and a vehicle in the same case within XAMN is going to prove extremely useful for digital forensics professionals going forward.



Until next time, Risk Diversion. Your partner in Digital Forensic.