MSAB is a Swedish mobile forensic vendor founded in 1984, headquartered in Stockholm, and one of the three globally established providers of mobile device extraction tooling alongside Cellebrite and Oxygen Forensic. The company’s flagship product, XRY, is used by law enforcement, military, and intelligence agencies in more than 100 countries. MSAB is publicly listed on the Nasdaq Stockholm First North exchange and reports annually on its product portfolio, customer geographies, and revenue.
What it means in practice
XRY extracts data from mobile devices through logical, physical, and file system acquisition methods depending on the device, the operating system version, and the password protection state. The product supports thousands of mobile device models and recovers messages, contacts, photos, browser history, app data, deleted records, and operating system artefacts. MSAB also offers XAMN, the analysis platform that processes XRY extractions for investigators, and a Tactical product line for in-field deployment.
Specific things to know
MSAB’s customer base is heavily oriented toward Western law enforcement and military customers, with reported deployments in the US, UK, France, Germany, Australia, and the Nordic countries. The company has been less politically controversial than Cellebrite, partly because its customer base has fewer human rights flagged governments and partly because its marketing has been more restrained. MSAB’s revenue in 2024 was approximately 50 million euros, smaller than Cellebrite but in the same order of magnitude.
Change today
For anyone whose device may be subject to forensic extraction, the operational answer is the same regardless of which tool is in use: a strong passcode (alphanumeric, six characters minimum, ideally longer), regular operating system updates, and disciplined handling of devices at borders and during interactions with law enforcement. XRY, like Cellebrite UFED, exploits the same categories of vulnerabilities, and the same defensive baseline reduces extraction success across all comparable platforms.
Related articles
See our coverage of mobile forensic extraction, the differences between logical and physical acquisition, and the international forensic vendor market.