MSAB has released its Q2 2026 update across the XRY, XAMN, XEC Director, and KTE product families. The release advances support for the latest Android and iOS versions, improves the quality of physical extractions, and delivers targeted efficiency gains for investigators working across complex, high-volume cases.
Faster Android Extraction and Smarter RAM Capture
Extraction of the latest-generation Android devices is significantly faster in this release. File uploads to the device are no longer required as part of the process, which removes a step that previously added time to every workflow.
XRY Pro now captures RAM before initiating brute-force access on physical extractions. This ensures the volatile memory snapshot reflects the device’s state before any forced authentication begins, preserving evidence that might otherwise be altered or lost.
Enrichment That Processes Only What You Need
In XRY 11.5, enrichment runs in the post-processing phase rather than during decoding, and applies only to the data selected for extraction. For selective extractions, this directly cuts processing time as you can extract and enrich selected messages and call logs, instead of the entire device.
Smarter, Faster Video Review
XAMN 8.8 introduces intelligent thumbnails generated at scene changes rather than fixed timestamps. Hovering over a thumbnail lets investigators scrub through surrounding footage without opening the video player which reduces the time between finding a video artifact and understanding what it shows. When XRY 11.5 and XAMN 8.8 are used together, thumbnails are also rendered at higher resolution.
Cleaner Reporting, Safer Database Management
XEC Director 7.18 updates the reporting platform to display clear, descriptive dataset names in place of underlying database view labels. Reports are now readable without cross-referencing reporting architecture. A new pause function lets administrators safely apply database updates without risk of data loss mid-operation. A synchronization issue between the XEC Database Tracker and XEC Report Service during installation has also been resolved.
Expanded Decoding and Cryptocurrency Evidence from RAM
App decoding updates cover Signal (Stories surfaced as Status updates, linked replies, group display pictures), Telegram (new message types), and Google Messages (conversation and group improvements). XRY 11.5 also surfaces cryptocurrency evidence directly from RAM, including wallet seeds, IDs, and addresses across ten cryptocurrencies, with CRC validation and a dedicated icon in XAMN.
The Q2 2026 update is available now via the MSAB Customer Portal. Join MSAB on 23 June for a live walkthrough of the Q2 release.
About MSAB
MSAB is a world leader in forensic technology for mobile device examinations. It is trusted by law enforcement agencies, government bodies, and digital forensic labs in over 100 countries. With decades of experience and continuous investment in mobile extraction and evidence analysis, MSAB equips investigators with the tools to recover more evidence, work faster under operational pressure, and present results with confidence in their integrity.
