Andriller
Andriller is a software utility containing a collection of smartphone forensic tools. It performs read-only, forensically sound, non-destructive acquisition from Android devices. It has features such as powerful Lockscreen cracking for Patterns, Pin codes, or Passwords, custom decoders for app data from Android (some Apply iOS and Windows) databases for decoding communications, and extraction and decoders that produce reports in HTML and Excel formats.
Features of Andrillers:-
1. Data Extraction- Andriller extracts vital data from Android devices, including SMS messages, contacts, call logs, and more.
2. Application Data Parsing- Andriller can parse data from apps like WhatsApp, Chrome, and Telegram.
3. Decryption and Password Cracking- It can decode pattern locks, pins, and passwords from certain Android devices.
4. Report Generation- Andriller provides detailed reports of the extracted data in a user-friendly format.
5. Supports Rooted and Non-rooted Devices- While rooted devices allow for more extensive extraction, Andriller can still extract significant data from non-rooted devices.
STEP 1: DOWNLOAD AND INSTALL ANDRILLER
a. Visit the official Andriller website and download on your suitable system (Windows, Linux, macOS)
b. Here I have downloaded it in my Linux system by the following command:
sudo apt-get install android-tools-adb python3-tk
c. Create a virtual environment using Python3:
First install python latest version
sudo apt install python3.11-venv
python3 -m venv env
Activate the virtual environment (Linux/Mac):
source env/bin/activate
Install Andriller with its Python dependencies (same command to updrade it):
pip install andriller -U
Quick start by using command:
python -m andriller
STEP 2: PREPARE THE ANDROID DEVICE
a. Enable developers' option in your android device (Settings > About Phone > tap on Build Number seven times to enable Developer Options)
b. In the developer's option Enable USB Debugging
c. If a possible, root the device as Andriller can extract more information in rooted device but also can perform if the device is not rooted
d. Next using a USB cable connect your android device to your computer where Andriller is installed
e. Ensure that the device is in File transfer (MTP) mode for proper data access
f. Then allow USB debugging by clicking on "OKAY"
g. Next start your andriller application, it will automatically detect the android device and if not ensure that the USB debugging option is on and the drivers for your device are correctly installed
h. It will show you a pop up as below
STEP 3: CHOOSE EXTRACTION OPTIONS
You have different extraction modes to choose from like: -
a. Full Data Extraction- extract all accessible data from the device
b. App-specific Extraction- extract data from specific apps like WhatsApp, Telegram etc
c. Selective Extraction- extract specific data types (eg. call logs, SMS, contacts)
d. Choose the Appropriate Option- Depending on your investigation, choose the extraction mode that suits your needs
-Once you have made your choice click on 'Start Extraction'
-Wait for the process to complete
-After the process is completed, Andriller will notify you and generate the extracted data
-Andriller generates the extracted data in a readable format so these reports can be easily navigated
-The data will be organized by type for easier analysis
-If app-specific data was extracted, you can explore the conversations, media, and other things
STEP 4: DECRYPT PASSWORDS (OPTIONAL)
a. Andriller could decode and decrypt pattern locks and PINS for certain Android devices
b. If the device is locked and Andriller supports the model, start the decryption process to attempt to retrieve the unlock code
c. Once decoded, the pattern or PIN will be displayed for you to unlock the device
STEP 5: GENERATE REPORTS
a. Generate Forensic Reports- Andriller automatically generates reports in formats such as HTML, CSV, or JSON. These reports are essential for documenting your forensic investigation
b. You can review the reports directly within Andriller and export them for use in court cases, internal reports, or further analysis in other forensic tools like Autopsy
By following the steps outlined in this guide, you can effectively use Andriller to extract data from Android devices connected via USB, generate reports, and further analyze the results using other forensic tools like Autopsy.
Comments
Post a Comment