News
Behind the Data: The Important Role of Chipsets in XRY and XRY Pro – Why chipsets are important in digital investigations
In digital investigations, the first and most crucial step is to gain access to the data.
In most cases, this process is simple: the device is automatically detected, the correct profile is applied, and removal goes smoothly.
However, not all devices follow this pattern. Sometimes the selected profile does not work or simply does not exist for that device. In these cases, understanding the underlying technology becomes essential.
Hechipset, the core hardware component that defines how a device communicates and stores data, may be the key to a successful extraction. By identifying the chipset and selecting the corresponding generic profile in XRY or XRY Pro, examiners can expand their access to data and improve their chances of success.
This article explains why chipset identification is important, how it works within XRY and XRY Pro, and how this approach helps deliver faster updates, greater coverage, and better results for examiners.
When the standard profile is not enough
Initiating an examination and locating relevant evidence is often crucial to the success of a digital forensic investigation. But what happens when the selected profile does not work, or worse, when there is no profile for that device?
It is satisfactory when the device is automatically detected, the correct profile is applied and the extraction flows smoothly. But when that doesn't happen, many examiners overlook alternative methods. Relying solely on automatic detection may lead to improper removal for the device. For example, you could lose access to aFile System (FFS)or even to a physical extraction if the detected profile applies a more limited method.
That's why it's important for examiners to check the chipset and explore manual options when necessary, ensuring the most complete access to data possible.
Unlocking more data through chipset identification
Fortunately, MSAB customers already have a powerful tool.
This involves identifying the chipset of a device that is not removing as expected, or when you want to determine if a more complete removal is possible.
This extra step may be the key to obtaining evidence that might otherwise seem unattainable. Often it is enough to identify the device chipset and select the appropriate generic profile in XRY.
Preparation and knowledge are essential. Before proceeding, it is important to confirm the model and chipset information using a reliable database such asGSMArena. Once the chipset is identified, XRY users can select the corresponding generic profile and pave the way to a successful extraction.
How to access generic profiles in XRY Pro
To access these additional extraction methods, simply navigate through the following familiar screens:
Step 1:Options screen in XRY Pro
Step 2:Extraction and filtering options screen in XRY Pro
Una vez que ubiques el perfil genérico requerido, puedes continuar la extracción con normalidad.
(Figure 1.0 – XRY Pro Options Screen)
(Figure 2.0 – XRY Pro Extraction and Filtering Screen)
Why generic profiles are important
So why does this method matter? Isn't the “device specific” profile always the best option?
It's a question we hear often at MSAB, and it makes sense.
The reality is that many different devices share the same chipset. Maintaining an individual profile for each device would be a slow process and could delay the updates that users receive.
By focusing on updating the generic profile, MSAB can ensure that a wide range of devices stay up to date through a more streamlined update process and regular updates.
What this means for XRY and XRY Pro users
This approach means more frequent updates, greater coverage, and a higher likelihood of successful removals across a wide variety of makes and models.
While MSAB continues to keep device-specific profiles up to date, the generic profile approach allows for faster improvements that benefit both MSAB and its customers, giving examiners more opportunities for success in their extractions.
Conclusion
Understanding chipsets and their relationship to device profiles is a key skill for every tester.
By identifying the chipset and selecting the correct generic profile in XRY or XRY Pro, users can access a wider range of devices and extraction types, increasing both efficiency and success rate.
More frequent updates, greater compatibility, and better performance come from this simple yet powerful method.
Ultimately, it's about giving examiners every possible opportunity to access the data that matters most.
XRY Pro First – MSAB
Author: Bethany Morgan
Product Specialist, MSAB
With a decade of experience in law enforcement—six of those years spent in computer forensics and incident response (DFIR)—Bethany is a passionate and highly skilled specialist in her field. Since his transition from the police to MSAB, he has been at the forefront of helping clients meet the challenges of DFIR while continuing to expand his expertise in this ever-evolving field.
His practical experience covers a wide range of forensic investigations: from analyzing evidence to training new officers and producing critical forensic reports for the courts.
Bethany's enthusiasm for sharing knowledge and growing professionally drives her to stay at the forefront of this ever-changing field. He is passionate about continuing to learn, innovate and contribute to the future of DFIR.