So, simple question.
We have been provided an .XRY file from an iPhone. One massive file, just a dump. No phone.
Unfortunately, after examining the download XRY is missing loads of data from it (manually viewing SQL Databases).
My question is… can this be opened in anything else that will actually read the data, e.g. CelleBrite or Oxygen?
Its obviously got an XRY header in the file, can this be modified?
Oxygen claims to import XRY DMG Files, but this failed?
Any help appreciated.
4R
Cellebrite should import it. select the device model number in the 4PC software and click the import button. that should then import the XRY dump of the device.
I'll give that a try, thanks.
No go sorry.
I'm using Physical Analyser to image with a iPhone chain (no import option in 4PC)
Its just failing as its pointing to one massive 40GB .XRY file
I may be wrong with this… but…
I've never had to import an XRY project file into another software suite, but my guess would be that the DMG file is embedded inside the XRY project file, and if exported Oxygen can analyze that?
At times, I've analyzed the data inside the project file, I use MSAB's XACT which displays the disk/partitions/files, which you can then export whatever you need. If you don't have a license for XRY, I'm not sure if you can get the data out of the project file though.
You need to convert the .XRY file to a .bin only then can UFED PA decode the file.
Hi 4Rensics, I've sent you a PM
Did you solve this?
I think you need XACT to extract the iphone's .bin file from the XRY extraction. You should be able to import the .bin as an iPhone physical in Physical Analyser.
As Amnesia said, Use XACT to extract the image from the xRY file, then import it into PA.