android-forensics

LockKnife: The Ultimate Android Security Research Tool. A unified TUI workspace and headless CLI for deep Android security research, built for researchers and hackers. Powered by Python orchestration and a Rust-accelerated core, enabling AI agent–driven hacking, credential recovery/cracking, APK analysis, intelligence gathering, runtime inspection.

Parse XML output from SMS Backup & Restore Android app

Open-source desktop workbench for digital forensic analysis. Inspect ZIP/TAR/7z archives and iTunes/Android backups. Parse and view ABX, SQLite, SEGB, (B)PLIST, REALM, Protobuf, Logs,hex, JSON, XML, and more — all in one GUI.

Forensic extraction for WhatsApp, Signal, and Telegram — 8-layer SQLite recovery, anti-forensics detection, court-ready reports.

Unified digital forensics platform bringing disk, RAM, container drift, logical acquisition, and backup analysis together for Windows, Linux, Docker, Android, and iOS.

Utility for recovering ES File Explorer encrypted files (.eslock)

Django-WebADB - ADB in browser but more powerful with Django 5, also can do some acquisition task and more

Dump's Victim Android Device Entirely to AWS Server. Backend Made in Spring boot. (Educational Purpose only)

A comprehensive Model Context Protocol (MCP) server for Android device forensic data acquisition using Android Debug Bridge (ADB).

Useful tools for (not only) digital forensics

Three mobile forensics examinations: iOS full filesystem analysis (Cellebrite), legacy mobile device artifact recovery (Autopsy/FTK), and Android APK static & dynamic analysis (JADX/PCAPdroid).

Advanced Android digital forensics lab for acquisition planning, anti-forensics evaluation, memory triage, evidence integrity, and research-aligned casework.

Advanced Android Security, Threat Hunting & Digital Forensics Framework for authorized device auditing, APK analysis, YARA scanning, evidence-based threat assessment, and mobile DFIR.

Android mobile forensic investigation project analyzing call logs, SMS, browser history, and device artifacts using standard digital forensic methodology. IFSO-oriented academic project.

Parses the HistoryLog SQLite database from a Samsung device's Secure Folder (user profile 150) to produce forensic CSV and HTML reports of file move-in/move-out activity.

A tool to decrypt files from the android application "Folder Lock"

Скрипты сбора информации об android устрйостве

For dissertation.

Android Recovery is a read-only command-line tool for acquiring recoverable Trash items and extracting deleted-media from non root android devices over ADB. It runs as Android's shell account, writes only to the host computer, and does not use root or UI automation.