Forensics Investigation of Android Phone using Andriller

Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices. It has other features, such as powerful Lockscreen cracking for Pattern, PIN code, or Password; custom decoders for Apps data from Android (and some Apple iOS) databases for decoding communications. Extraction and decoders produce reports in HTML and Excel (.xlsx) formats.

Features

·         Automated data extraction and decoding

·         Data extraction of non-rooted without devices by Android Backup (Android versions 4.x)

·         Data extraction with root permissions: root ADB daemon, CWM recovery mode, or SU binary (Superuser/SuperSU)

·         Data parsing and decoding for Folder structure, Tarball files (from nanddroid backups), and Android Backup ('backup.ab' files)

·         Selection of individual database decoders for Android and Apple

·         Decryption of encrypted WhatsApp archived databases (msgstore.db.crypt, msgstore.db.crypt5, msgstore.db.crypt7, msgstore.db.crypt8)

·         Lockscreen cracking for Pattern, PIN, Password

·         Unpacking the Android backup files

First Download Andriller from here : and install in your Computer.

Now open the Andriller and select output folder. You will get a pop up and select your desired folder.

Now connect your Android phone with computer using Data cable. IN Andriller software click on Check option, if your Android phone is successfully connected with Andriller it will give a Serial ID.

Once you get Serial ID then select the check box which says Open Report & Use AB method and click on GO.

Your will get a Pop up click ok.

On your Android Phone you will get a screen says Full Back up , at the bottom right of your phone screen you will see Back up my data click on that.

Now Andriller will start taking the Back up of your phone and you can see the logs on Andriller as well.

Once the Backup is complete, you can see the complete data in the folder your selected.

You will see a pop up on your browser which will show you the complete phone report.

You can select any of the option to see the details as shown in the below image. Example select WiFi password, you will get all the details which is saved under this folder.

Same way select another option says Android Download history in this you will see all downloads.

Same way select another option says Android Call logs in this you will see all Call details.

Same way select another option says SMS Snippets in this you will see all Overview.