USING ALEAPP FOR DATA EXTRACTION
ALEAPP (Android Logs, Events, and Protobuf Parser) is designed to parse Android artifacts into a readable format. It's beneficial for forensic analysts who need to extract and analyze data from Android devices.
Step 1: Setting up ALEAPP
a. First ensure you have downloaded and installed Python 3.x for Windows from the official website.
b. During installation, make sure to check the box that says "Add Python to PATH "
c. Download the ALEAPP repository form GitHub as a ZIP file:
d. Download the one that says 'ALEAPP-windows.zip'
e. After downloading, extract the zip file and you will see two options. Open the 'GUI' one
f. Now you will see this interface of ALEAPP
Step 2: Running ALEAPP
a. Here you can choose to import your backup as a single file or a directory
b. You'll also have to specify an output folder
c. The left-hand side of the tool also has the different modules listed. You can select or deselect whichever ones you may be interested in
d. Once completed, ALEAPP will give us a "Processing completed" pop-up
e. Once we click "OK" on the Processing Completed box, we will be presented with the summary report
f. All the applications and data categories it parsed out will be on the left-hand side
g. Generate a Forensic Report- create a report summarizing the findings from ALEAPP, including relevant screenshots and references
h. Store and Preserve Evidence- securely store all evidence and reports, maintaining the chain of custody
In summary:
ALEAPP is an essential tool in the Android forensic toolkit, offering a fast, efficient, and reliable way to parse and interpret Android-specific data. Its continuous updates and support from the forensic community ensure it remains relevant in uncovering evidence crucial to investigations.
Comments
Post a Comment