Online forensic extraction of cloud based smartphone data
XRY Cloud is a digital forensic extraction solution from MSAB designed for the recovery of data beyond the mobile device.
Apps on smartphones often function without the need for users to constantly enter their username and password details. This is because of credential tokens held on the device that verify identity automatically. These tokens offer forensic examiners a window of opportunity to recover data from cloud based storage centers.
Recover even more data
XRY Cloud is a separate license controlled extraction tool developed by MSAB. It enables authorized forensic examiners to recover more data beyond the device, from connected cloud storage solutions. XRY Cloud offers data access to services such as Facebook, Google, iCloud, Twitter and Snapchat.
Constructed as a separate component within the familiar XRY software, XRY Cloud will allow users to recover data in two modes; automatic or manual. XRY Cloud can be used as a standalone product or as part of a suite of tools within the wider MSAB Ecosystem.
In automatic mode users will need physical possession of the phone. Based on app tokens that were recovered during a standard smartphone extraction with XRY, the user can then recover cloud data. Additionally, XRY Cloud will also show the authorized examiner recovered elements that can be used to locate data online. Assuming Internet connectivity is enabled, then all the user has to do is simply select and click to recover the cloud based data via XRY.
Recovery without the device
XRY Cloud also allows investigators to recover cloud based data without actual physical possession of the mobile device. In manual mode users have the option to enter user id and password login details for app services that may have been recovered from alternative sources.
Users will be able to select supported apps within XRY and attempt to recover data, whilst the extraction computer is connected to the Internet. All the cloud data can be combined into an XRY Case File, to ensure all the data is held together in one place.