[Android General] den4uk:
Moderators: if this thread is in wrong place please forgive and move it to a location best suitable for this thread.

Self-introduction I come from law-enforcement digital forensics background aimed at data extractions from mobile devices.

I would like to introduce a tool that I created.

Andriller

http://andriller.com

Andriller is a Windows GUI forensic tool, that performs read-only, forensically sound, non-destructive acquisition from Android devices. The executable is run from a terminal or by executing directly; it produces results in the terminal window, and a report in a HTML format.

Usage:

Download Andriller from the download page and install. To use the software you need to obtain a license key (free trial available). Instructions on doing this will be provided on the page

Note: Android version 4.2.2+ requires to authorise the PC to accept RSA fingerprint. Please do so, and tick the box to remember for future.

Note: Devices with Superuser or SuperSU App require to authorise root access from an unlocked screen. Please grand permissions if requested.

Description:

Once andriller is executed, it will produce permilinary results in the terminal window; for rooted devices it will download and decode the content automatically. It will produce a new folder in the location where it was executed, where the main "REPORT.html" file can be opened in a web browser.

Supported data extraction:

Non-root devices (Android versions 2.x):

- Android device make and model

- IMEI, build version, OS version

- Wifi mac address

- Time and date check

- SIM card details (for a some Galaxy Sx devices only)

- Synchronised accounts

Non-rooted devices (via backup method, Android versions 4.x and above)

- Wi-Fi passwords (WPA-PSK/WEP)

- Call logs (Samsung) register

- Android browser saved passwords

- Android browser browsing history

- Google Chrome saved passwords

- Google Chrome browsing history

- Facebook* chat messages

- Facebook* user viewed photographs

- Facebook* user notifications

- WhatsApp* contacts list

- WhatsApp* chat messages

- Kik Messenger* chat messages

- BBM* chat messages (Blackberry Messenger)

- Viber* chat messages

Rooted devices (via root adbd or 'su' binary, any Android versions):

- Security lockscreen pattern gesture extraction (decoding online)

- Security lockscreen PIN code cracking (up to 8 digits long)

- Wi-Fi passwords (WPA-PSK/WEP)

- Synchronised accounts and profile picture

- Bluetooth mac address and name

- Phonebook contacts

- Call logs register

- Call logs (Samsung) register

- SMS messages

- Android browser saved passwords

- Android browser browsing history

- Google Chrome saved passwords

- Google Chrome browsing history

- Facebook* friends list

- Facebook* chat messages

- Facebook* user viewed photographs

- Facebook* user notifications

- WhatsApp* contacts list

- WhatsApp* chat messages

- Kik Messenger* chat messages

- BBM* chat messages (Blackberry Messenger)

- Viber* chat messages

* = if an Application is installed

Disclaimer:

Andriller comes with absolutely no warranty. Even though Andriller was written in a way to be a forensically sound read-only utility, I do not take any responsibility to any damage or harm caused to your computer systems or your Android devices, which may be believed to have been caused by executing Andriller. I also do not take any responsibility of any unsolicited, non-consensual or unlawful misuses of this utility. It is the end user's responsibility to believe an appropriate consent or a lawful excuse was obtained if the utility is used with an other's Android devices, and they are aware what the utility does.

Visit http://andriller.com to download the latest software