APPS SUPPORT XRY USED IN PISTORIUS TRIAL - …forensedigital.com.br/wp-content/uploads/2014/06/MSAB...XRY USED IN PISTORIUS TRIAL PHOTO: REUTERS/GIANLUIGI GUERCIA/POOL Physical support

RELEASE NOTES RELEASE DATE: W/C 2ND JUNE 2014

NEWS IN V. 6.10

Logical Extraction 177 4,974Physical Dumping

Physical Dumping 192 2,699Smartphone App

Physical Decoding 184 2,610Untested devices available

Security Code Only 21 831

App Versions 65 436

XRY Untested 66 865

Total 705 12,415

[email protected] | msab.com

NOW WITH12,415 DEVICE PROFILES SUPPORTED

The high court in South Africa granted permission to media groups to install TV cameras for the Oscar Pistorius trial. As a result for the first time ever the use of XRY software in a criminal court trial was broadcast live across the world. Captain Francois Moller, who presented evidence from the police investigation, said he had been able to extract some 35,654 pages’ worth of messages from Ms. Steenkamp’s phone. Several of these WhatsApp message exchanges were read out to court on day 14 of the high-profile trial.

XRY USED IN PISTORIUS TRIAL

PH

OTO

: REU

TER

S/G

IAN

LUIG

I GU

ERC

IA/P

OO

L Physical support for Nokia Asha. Physical support for more PNX based phones (Samsung GT-E1200). 400+ devices revisited for improved support. Improved logical support for over 100 Samsung devices. More PinPoint devices and chipsets supported. Improved detection of MediaTek & Spreadtrum phones with PinPoint. Decoding of IMEI and e-mail on many MediaTek based devices. Improved SMS extraction on MediaTek. iOS: Device info now extracts Apple Id, iCloud Id and OS Install Time.

Smartphone App Support documentation now in XRY Device Manual. New Apps for both Android & iPhone: Baidu Map, QQ, MOMO. Major update of Google Maps. iOS: Extraction of installed apps now includes app pictures. Android: Updated Malware list with 30 new apps including Sonicapp

Track, Spytic, Copy9.

New XRY wizard welcome page. New GUI on the import file popup. XRY Device Manual now also shows known “impossible” models

for logical extractions. Help file translated into Chinese, French, German, Brazilian

Portuguese, Russian and Spanish.

DEVICE SUPPORT

APPS SUPPORT

FEATURE SUPPORT

FORENSIC METHOD V.6.10 TOTAL

DEL FILE DECODERHave you noticed you are getting lots more deleted pictures back in XRY these days?You can thank the DELFILEDECODER which is working away in the background on physical examinations of SD cards and a large number of mobile devices to help you recover more deleted pictures. It’s an automatic file carving decoder that searches for PNG, GIF and JPEG file headers. It applies a degree of intelligence by first checking what pictures have already been recovered to minimise the number of duplications in the report. A number of customers have reported to us how impressive the results have been with a significant increase in the number of pictures recovered.

1 Please read the Device Manual first for device specific issues before calling support.

2 USB debugging usually needs to be enabled to connect to Androids otherwise it won’t work.

3 Check the App Version number if you are not getting data you expected.

4 The yellow micro USB cables are for specialist dumping they’re not standard cables.

5 Device times can’t be relied upon as accurate, because users can change the device clock.

TOP 5 FAQ FROM SUPPORT

XRY 6.10 RELE A SE NOTES | 2

Sony NTT DoCoMo Xperia Z1 – Japanese model devices now supported.

New View SummaryA new View Summary display has been added to the Sum-mary category in XRY, which means that the number of nodes or items per view is now displayed in this section. Please note that the View Summary is not available yet for Print or Export functions.

iOS: Apps Extraction of installed apps now includes app pictures. To the right is an example of the last application snap-shot that can be included in the Installed Apps view.

Apps Support In the Device ManualYou can now search for APPS by OS platform and get information on the support levels and version numbers just like you can for devices.

Quote from our Help File:

WHAT’S NEW IN THIS VERSION?

Samsung GT-E1200 – dumping and decoding support is now available for this popular ‘burner’ phone.

Devices

Nokia Asha 206 – one of 24 new Asha models intro-duced in v6.10.

iPHONE 4S/5/5S BYPASS WITH A PLIST

Q: How can I bypass the iPhone Passcode Lock on iPhone devices?

A: This requires that you have access to the computer that it was last synchronized with. You must go to the computer it was last synchronized with and locate these folders:

Windows 8 / 7 / Vista”C:\ProgramData\Apple\Lockdown”

Windows XP”C:\Documents and Settings\All Users\ Application Data\Apple\Lockdown”

Mac OS X/private/var/db/lockdown/Users/<username>/Library/Lockdown

Copy all the .plist files found in the folders listed above to the following folder on the PC where you perform the extraction (where XRY is installed):

Windows 8 / 7”C:\ProgramData\Apple\Lockdown”

After this is done, restart the extraction and you should be able to access the device properly without having to enter a passcode.

DEVICE SUPPORT HIGHLIGHTSApps

Telegram Messenger now supported in iOS and Android.

QQ-Tencent-IM app now supported in iOS and Android.


XRY CUSTOMER SURVEY GIVE US A HAND…Can you help us? We want to know what you think. We are working in the background to develop an improved solution and we would love to know what you think we could do to make XRY even better?

PRODUCT NEWS

is our latest solution designed to be fully integrated with XRY, allowing the user to take advantage of powerful decoding for non-standard devices; like Chinese chipset clone phones. PinPoint is primarily a software solution and is therefore easy to update in future versions of XRY.

PinPoint currently supports devices with chipsets from MediaTek and Spreadtrum and new chipsets will be added in future releases of XRY.

XAMN V6.10Expect to see XAMN v6.10 within a few weeks to complement this release. XAMN is our powerful analytical tool that helps users review up to 50 XRY files simultaneously in list, connections, time-line, geographic and conversation views.

WHITE LABEL TRAININGDid you know that MSAB can offer you ge-neric mobile forensic training to specifically meet your organization’s needs?

We can rent out our professional train-ers to offer onsite instruction on a variety of topics and we can even help design the course materials for you. Through a pro-cess of consultation, we can deliver training bespoke to your needs under your organisa-tions banner in a vendor neutral environ-ment. For more information please contact: [email protected].

We are celebrating 30 years of being in business this year. The company has been involved with mobile communications since 1984 and this year is our 30th anniversary.

30 YEARS OF EXCELLENCE

www.msab.com/company/survey-2014

NEW SMARTPHONE APP VERSIONS

Baidu Map (6.8.0)Baidu Map (7.0.0)Dropbox (2.4.1)Facebook (8.0.0.26)Facebook Messenger (5.0.0)Google Maps (7.6.0)Google Maps (7.7.0)Google Maps (8.0.0)Google+ (4.3.1)Hangouts (replaces Talk) (2.1.076)Instagram (5.1.7)Kakao Talk (4.4.0)Kik (7.1.0)Line (4.2.3)Line (4.3.0)Momo (4.10)QQ (4.6.1)QQ (4.6.2)QQ (4.7.0),QQ HD mini 2013 (2.2.2)QQ International (4.6.10)QQ International (4.6.11)QQ Lite (1.0.0)Skype (4.7.0)Snapchat (4.1.07)Snapchat (5.0.5)Tango (3.6.84179)Telegram (1.4.12)Twitter (5.1.3)WeChat (5.2.1)WhatsApp (2.11.186)WhatsApp (2.11.238)Viber (4.3.0)

ANDROID

Baidu Map (百度地图) (6.8.0)Baidu Map (百度地图) (7.0.1)BlackBerry Messenger (2.0.1.36)Facebook (10.0)Facebook (9.0)Facebook Messenger (4.2)Facebook Messenger (5.0)Gmail (3.0.2)Google Maps (2.7.4)Google Maps (3.0.0)Google Mobile (3.2.1)Google Mobile (4.0)Grindr (2.0.11)Instagram (5.0.9)Kakao Talk (4.0.6)KeepSafe (2.0.16)Kik Messenger (7.1.0)Line (3.10.1)Line (4.0.0)Momo (English) (2.0.1)QQ (腾讯 QQ) (4.6)QQ International (4.5.10.52)Skype (4.17.135)Snapchat (7.0.1)Tango (3.6.84179)Telegram (2.1)TigerText (4.5.55)Twitter (6.4.1)Waze (3.7.7)WeChat (5.3.0.16)WhatsApp (2.11.8)Viber (4.2)

iOS


AlcatelOT-1011dOT-206aOT-356OT-4012x FireOT-5020T EvolveOT-585aOT-6032 Idol AlphaOT-6043d Idol XOT-7047d POP C9 DualOT-800a TribeOT-8020x HeroOT-918d

AltekA14 Leo

aosonM721

AppleiPad Air TD-LTE (A1476)*iPad mini 2 TD-LTE (A1491)*

AsusGoogle Nexus 7 – 2 WiFi (K008)

BASELuteaVaria*

bassoonPad mini

BeetelGD660

BLUA270a Advance 4.0D142 Dash Jr 4.0D272a Dash Music 4.0D290a AmourD910i Vivo 4.3*Deejay Touch S200*Electro T600*Lindy Q60S280 Neo XT*

BMLONE mini (E19)

CECTNokia E73 TV Mobile

Chinese ChipsetsBMW 760BWM 760 car keyCCK E71G700H11 (4 SIM)H5 TV WIFINokia C5-03Nokia E7 (RM-357)Samsong H500F

SoftwinerEvb Q88V668 Gold Ferrari

Coolpad72358010

CubotGT72

DaxianXY100

DOOGEEDG120 CoLLo 2

DopodF3188*

DoroPhoneEasy 520X*

EricssonT20sc*T28sc*

E-TENGlofiish X650*InfoTouch M550*

EverexNeon*ExcelvanH80w*

ExplayGPS CLS5GPS iD-52B

GarminNuvi 2447Nuvi 2467Nuvi 2497Nuvi 2557Nuvi 2597Nuvi 2797Nuvi 3597

G-TIDEE60*M99

HaierA66

HaiPaiSamsung i9377

HoneywellDolphin 60s PHS8-E*

HTC6800EVO 4G LTE*Jetstream LTE (PG09410)

One M8 2014 LTE-A (6525LVW)S523 Snap US (MAPL130)

HTMH10H1020H925M1X5292-w (G20)

HuaweiM866 Ascend Y

U8652 NFC Sonic*

iBallGlam4e

i-mobileIQ3

iProFX3 Pro (4 SIM)

iviewCyberPad (435TPC-WT)

JiakeJK11N900

JiayuG2S

K-TouchT619+

KyoceraC5133 Event

LandvoL800

LenovoA208tA269iA680A690IdeaPhone A800IdeaTab A3000 3GLePhone A390

LGAS680 Optimus 2C555 Optimus ChatE450 Optimus L5 IIE460 Optimus L5 II*L38C Optimus DynamicL75c Optimus ZipP940 Prada 3.0VM701 Optimus SliderVM720 Optimus F3VS870 Lucid 2 4GVS980 G2 4G LTE*

MedionLifetab E10320 (MD98641)

M-Horse7562920mini

moiiE896

More009

MotorolaA854 MilestoneMZ601 XoomMZ603 Xoom*V80WX442 CitrusXT1080 Droid Ultra*

MysagaC1C4

NavGearStreetMate RSX-50 3D (PX-4700-675)

NinetologyR1 (i9431)Stealth 4X (i9501)Z1 (i9570)Z1+ (i9502)

Nokia6720c-1b classic (RM-564)*702T (RM-730)*8800 Gold Arte (RM-451)*Asha 205.1 (RM-863)Asha 206.1 (RM-873)C2-05.1 (RM-725)C5-06 (RM-816)E6-00 (RM-609)Lumia 510.2 (RM-898)*Lumia 520 (RM-914)Lumia 610.6 NFC (RM-849)*Lumia 900.1 (RM-808)*Lumia 925 (RM-892)*X Dual Sim (RM-980)X2-05 (RM-772)

NTT DoCoMoF-05D Arrows X LTEF-11D Arrows Me

O2XDA Stealth*

Omnitech15223

OndaV975m

OpticonH16b*

OrangeTactile Internet*

PearlVX-50 Easy

PiPOT1

Play MobileBackyard

PlumZ401 Axe (B902E)

Q MobileE750

RugGearSwift Plus - RG220

SamsungGT-B5330 Galaxy ChatGT-C6625v*GT-E1086a*GT-E1086iGT-E1087tGT-E1100c Anycall*GT-E1170T*GT-i5800L Galaxy 3*GT-i8260 Galaxy Core*GT-i8262 Galaxy Core DuosGT-i8262b Galaxy Core Duos*GT-i9000T Galaxy S*GT-i9082L Galaxy Grand Duos*GT-i9200 Galaxy Mega 6.3GT-i9205 Galaxy Mega 6.3 LTE*GT-i9220 Galaxy Note*GT-S5282 Galaxy Star DualGT-S5301 Galaxy Pocket plusGT-S5302 Galaxy Pocket DuosGT-S5303b Galaxy Y Plus Duos*GT-S5310 Galaxy Pocket Neo*GT-S5310b Galaxy Pocket Neo*GT-S5310g Galaxy Pocket NeoGT-S5312 Galaxy Pocket Neo Duos*GT-S5312L Galaxy Pocket Neo DuosGT-S5600v Blade*GT-S5603 Preston*

NEW DEVICES IN XRY LOGICAL

Continued on next page


GT-S5839i Galaxy Ace VE*GT-S6310n Galaxy Young DSGT-S6312 Galaxy Young DuosGT-S6500T Galaxy mini 2*GT-S7262 Galaxy Star Pro DuosGT-S7262L Galaxy Star Pro Duos*GT-S7580 Galaxy Trend PlusSCH-R680 ReppSCH-R740c Galaxy DiscoverSCH-R830 Galaxy AxiomSCH-R830c Admire 2 (Cricket)SCH-R930 Galaxy S AviatorSGH-i467 Galaxy Note 8.0 LTESGH-i577 ExhilarateSGH-M919v Galaxy S IV*SGH-T155g TracFoneSGH-T289 Gravity QSGH-T399 Galaxy LightSHV-E270s Galaxy GrandSHW-M250S Galaxy S IISM-G900f Galaxy S5 LTE-ASM-G900h Galaxy S5 HSPASM-N9007 Galaxy Note III*SM-N900A Galaxy Note III LTESM-N900T Galaxy Note III LTESM-T2105 Galaxy Tab 3 KidsSM-T211 Galaxy Tab III 7.0 3G*SM-T217a Galaxy Tab 3 7.0 4G LTESM-T217s Galaxy Tab 3 7.0 4G LTESPH-L300 Galaxy Victory 4G LTESPH-L720T Galaxy S IV TD-LTE

SFR152 Text Edition*S300+*v1615*

SocialFB100

SonyXperia L C2105Xperia ZR C5503 (M36i)*

Sony EricssonU5at Vivaz*W958c*

Starmini 7100

Taiwan MobileAmazing A3

TecnoM5

TelstraT96*

teXetTM-510R*

THLW100*

TimmyE120L

T-MobileGroove

TomTomGO 520 (4M00)Go 550 Live (4CP0)

TreelogicTL-501 4GB

UbtelQ1

UTimeG7

VerykoolR80*

YusunT22

ZTCM1ZTE

N850 FuryN859 RenderU790U791V790

*Untested devices

AlcatelOT-112OT-206awOT-255dOT-305OT-585aOT-800a TribeOT-918dOT-C717OT-C825Playboy B01A

AnyCoolS300 (3 SIM)T518

Aoke10 Watch phone

aosonM721

Argom TechA18C900

BASELutea

BLUDisco2GO IILindy Q60Q333w Hero ProS192 Hero IISamba

CECTA007KA09 Mini (Nokia 5800)M810 Watch Mobile PhoneP111

ChangjiangA710

Chinese Chipsets9700 (Blackberry clone)9800 TV (Blackberry clone)A380iB8BWM 760 car keyC3+ TVCCK EG100doov V9E73F32 (3 SIM)F699 FerrariF938 FerrariFerrari F2010Ferrari F918H11 (4 SIM)H802H808 (HTC Tatto clone)H916i8 (iPhone 4 clone)

K550 Smart PhoneLand Rover S8 (Sonim Clone)Ming Xing A008My Phone M11N91Nckla E89No nameNokia 6300iNokia C5-03Nokia C9 (3 sim)NOKIA E6-00Nokia F122Nokia H11Nokia N99iNokia Z100Q5 WristWatchQ9 (3 SIM)S8 MINI Fashion bagSoftwinerEvb Q88SX01T25 FashionT500W3000V918 (iPhone 4 clone)Watch Mobile Spy Camera StainlessX10

Coolpad7235

DoroPhoneEasy 610


EyoGiK180 (4 SIM)

FlySL500i


Global High TechTwinsim T55

Gright1130

HaiPaiSamsung i9377

HTC6800S523 Snap US (MAPL130)

i-mobileIQ3

iProFX3 Pro (4 SIM)


JeepA9

JincenJC-3T (3 SIM)

KENEKSIK4

LavaM20

LenovoIdeaPhone A800LePhone A390

LGAS680 Optimus 2KP220P940 Prada 3.0SU870 Optimus 3D Cube

MoreQ9+++

MotorolaA854 Milestonei1x TitaniumWX442 Citrus

MTTDakar Botoo

MustangM31

myPhone1070 Chiaro


NIUGO 50

NokiaAsha 200 (RM-761)Asha 201 (RM-799)Asha 201.2 (RM-800)Asha 202 (RM-834)Asha 203 (RM-832)

NEW DEVICES IN XRY LOGICAL NEW DEVICES IN XRY PHYSICAL DUMPING



Asha 205 (RM-862)Asha 205.1 (RM-863)Asha 206 (RM-872)Asha 206.1 (RM-873)Asha 210 Dual Sim (RM-924)Asha 210.2 (RM-928)Asha 210.5 (RM-926)Asha 305 (RM-766)Asha 306 (RM-767)C1-01 (RM-607)C1-02 (RM-643)C2-00 (RM-704)C2-01 (RM-721)C2-02 (RM-692)C2-03 (RM-702)C2-05 (RM-724)C2-05.1 (RM-725)C2-06 (RM-702)C3-00 (RM-614)X Dual Sim (RM-980)X2-02 (RM-694)X2-05 (RM-772)

NPTEL618

NTT DoCoMoGalaxy S II SC-02CL-07C Optimus bright

O2Jet (O2J1)

PearlVX-50 Easy

PhilipsX128 XeniumX216 Xenium 9@9

PlumP008 BlastZ401 Axe (B902E)

PolaroidPro A618

SamsungGT-E1086iGT-E1087tGT-E1105TGT-E1182 DuosGT-E1182L DuosGT-E1200 Keystone 2GT-E1200m Keystone 2GT-E1200t Keystone 2GT-E1202 DuosGT-E1205L Keystone 2GT-E1205t Keystone 2GT-E1207t DuosGT-E1225tGT-E2152GT-i9190 Galaxy S IV mini

GT-i9192 Galaxy S IV mini DuosGT-i9200 Galaxy Mega 6.3GT-S3310SCH-R830 Galaxy AxiomSCH-R830c Admire 2 (Cricket)SGH-i467 Galaxy Note 8.0 LTESHV-E270s Galaxy GrandSHW-M250S Galaxy S IISPH-L720T Galaxy S IV TD-LTE

SigmatelFXD S76

SocialFB203 Micro

Sony EricssonJ132aJ220cJ220i

SpiceD-88n


TreelogicTL-501 4GB

Verykooli500

Vodafone155

XentiP220

ZhaNaMa-DosKZ-001

ZTC0076131B170V99

ZTEU790

AlcatelOT-112OT-206aOT-255dOT-305OT-585aOT-800a TribeOT-918dOT-C825

AnyCoolS300 (3 SIM)T518

Aoke10 Watch phone

aosonM721

AppleiOS iTunes Backup

Argom TechA18C900

BASELutea

BLUDisco2GO IILindy Q60Q333w Hero ProS192 Hero IISamba

CECTA007KA09 Mini (Nokia 5800)M810 Watch Mobile PhoneP111

ChangjiangA710

Chinese Chipsets9700 (Blackberry clone)9800 TV (Blackberry clone)A380iB8BWM 760 car keyC3+ TVCCK EG100doov V9E73F32 (3 SIM)F699 FerrariF938 FerrariFerrari F2010Ferrari F918H11 (4 SIM)H802H808 (HTC Tatto clone)H916

i8 (iPhone 4 clone)K550 Smart PhoneLand Rover S8 (Sonim Clone)Ming Xing A008My Phone M11N91Nckla E89No nameNokia 6300iNokia C5-03Nokia C9 (3 sim)NOKIA E6-00Nokia F122Nokia H11Nokia N99iNokia Z100Q5 WristWatchQ9 (3 SIM)S8 MINI Fashion bagSoftwinerEvb Q88SX01T25 FashionT500W3000V918 (iPhone 4 clone)Watch Mobile Spy Camera StainlessX10

Coolpad7235

DoroPhoneEasy 610


EyoGiK180 (4 SIM)

FlySL500i


Global High TechTwinsim T55

Gright1130

HaiPaiSamsung i9377

HTC6800S523 Snap US (MAPL130)

i-mobileIQ3

iProFX3 Pro (4 SIM)


JeepA9

JincenJC-3T (3 SIM)

KENEKSIK4

LavaM20

LenovoIdeaPhone A800LePhone A390P50

LGAS680 Optimus 2KP220P940 Prada 3.0SU870 Optimus 3D Cube

MoreQ9+++

MotorolaA854 Milestonei1x TitaniumWX442 Citrus

MTTDakar Botoo

MustangM31

myPhone1070 Chiaro8870 Teo


NIUGO 50

NokiaAsha 200 (RM-761)Asha 201 (RM-799)Asha 201.2 (RM-800)


NEW DEVICES IN XRY PHYSICAL DUMPING NEW DEVICES IN XRY PHYSICAL DECODING


Asha 202 (RM-834)Asha 203 (RM-832)Asha 205 (RM-862)Asha 205.1 (RM-863)Asha 206 (RM-872)Asha 206.1 (RM-873)Asha 210 Dual Sim (RM-924)Asha 210.2 (RM-928)Asha 210.5 (RM-926)Asha 305 (RM-766)Asha 306 (RM-767)C1-01 (RM-607)C1-02 (RM-643)C2-00 (RM-704)C2-01 (RM-721)C2-02 (RM-692)C2-03 (RM-702)C2-05 (RM-724)C2-05.1 (RM-725)C2-06 (RM-702)C3-00 (RM-614)X Dual Sim (RM-980)

X2-02 (RM-694)X2-05 (RM-772)

NPTEL618

NTT DoCoMoGalaxy S II SC-02CL-07C Optimus bright

O2Jet (O2J1)

PearlVX-50 Easy

PhilipsX128 XeniumX216 Xenium 9@9Plum

P008 BlastZ401 Axe (B902E)

AmoiWP-S2

AudiovoxCDM-8500

BeelineC100

KyoceraQCP-2255S2150 Kona (Cricket)

LGAN270 ExchangeAX4750

MN270 BeaconUX245

MotorolaRazr VE20 (Alltel)

Nokia106.1 (RM-962)

OrangeNew York

PantechCaper (TXT8035PP)

SamsungSCH-W699SGH-P250SGH-T155g TracFoneSGH-T289 Gravity QSPH-A503 Drift HelioSPH-M210

UTStarcomCDM-9200

ZTEF866

NEW DEVICES IN XRY PHYSICAL DECODING

NEW DEVICES IN XRY SECURIT Y CODES

PolaroidPro A618

SamsungGT-E1086iGT-E1087tGT-E1105TGT-E1207t DuosGT-E1225tGT-i9190 Galaxy S IV miniGT-i9192 Galaxy S IV mini DuosGT-i9200 Galaxy Mega 6.3SCH-R830 Galaxy AxiomSCH-R830c Admire 2 (Cricket)SCH-U360 GustoSCH-U365 Gusto 2SGH-i467 Galaxy Note 8.0 LTESHV-E270s Galaxy GrandSHW-M250S Galaxy S IISPH-L720T Galaxy S IV TD-LTE

SigmatelFXD S76

SimvalleySP-60 (PX-3428-675)

SocialFB203 Micro

SpiceD-88n


TreelogicTL-501 4GB

Verykooli500

Vodafone155

XentiP220

XKSSTELX16

ZhaNaMa-DosKZ-001

ZTC0076131B170V99

ZTEU790

Box 17111, SE-104 62 Stockholm, Sweden | Visiting address: Hornsbruksgatan 28, StockholmPhone: +46 8 739 02 70 | Fax: +46 8 730 01 70 | [email protected] | msab.com

Don’t forget to register your licenseBy registering your license you ensure that you receive new information about XRY software updates and new cables free of charge: msab.com/licreg

Samsung Galaxy S5

HTC One M8