Andriller - Android Forensic Tools

Andriller - is a program for Windows with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices. It has other features, such as powerful Lockscreen cracking for Pattern, PIN code, or Password; custom decoders for Apps data from Android (and some Apple iOS) databases for decoding communications. Decoders produce reports in a HTML format.

Basic Setup


Andriller comes as a lightweight Setup installable. It requires no dependable to be installed, only USB drivers for your Android device, and a web browser for viewing results. Simple.

Features


  • Automated data extraction and decoding
  • Data extraction of non-rooted without devices by Android Backup (Android versions 4.x)
  • Data extraction with root permissions: root ADB daemon, CWM recovery mode, or SU binary (Superuser/SuperSU)
  • Selection of individual database decoders for Android and Apple
  • Lockscreen cracking for Pattern, PIN, Password

First-time run


Download Andriller from the downloads page, and install the Setup file. Run Andriller form the Shortcut or the Start menu. If using for the first time, it will ask for the License key. Click on the button [Get License], and register your copy of Andriller. Free trial licenses available.

Database Decoders


This feature allows importing individual App database files for automated parsing of the data. There are decoders mainly for Android and some for Apple iOS Apps. Once successfully decoded, reports will be shown your web browser. Databases can be exported from mainstream forensic tools, such as XRY, UFED Cellebite, Oxygen Forensic, and imported into Andriller for individual decoding. The output from Andriller offers cleaner output data.

  • Synchronised accounts
  • Phonebook contacts
  • Call logs register
  • Call logs (Samsung) register
  • SMS messages
  • Wi-Fi passwords (WPA-PSK/WEP)
  • Android browser saved passwords
  • Android browser browsing history
  • Google Chrome saved passwords
  • Google Chrome browsing history
  • BBM BlackBerry Messenger (Android, Apple iOS) chat messages
  • Facebook chat/messenger messages
  • Facebook user notifications
  • Facebook user viewed photographs
  • Kik Messenger chat messages
  • WhatsApp contacts list
  • WhatsApp chat messages
  • Viber chat messages
  • Tinder chat messages
  • MeowChat messages
  • Grindr (Apple iOS) messages/users

This list will be getting bigger in the future!

Data Extraction from Androids


Connect an Android device by a USB cable, have USB Debugging enabled; make sure the device drivers are installed.

First, select the [Output] directory where you wish extraction data to be saved to. Second, click [Check] to see if Andriller detected your connected device. You may wish Andriller to open the Report on extraction's completion, or ignore root permissions (would extract by the Android Backup method for Androids 4.x). To begin an extraction, hit [Go!] button to commence data extraction. Andriller should run, download any data, and decode it all at once.

Note 1: Android version 4.2.2+ requires to authorise the PC to accept RSA fingerprint. Please do so, and tick the box to remember for future.

Note 2: Devices with Superuser or SuperSU App require to authorise root access from an unlocked screen. Please grand permissions if requested.

Reporting


After the data extraction finishes, all data is saved in the folder in the directory specified before extraction. The main index file of extraction is REPORT.html. It will contain the summary of the device examined, and will list any data extracted. From there, you can navigate to other data extracted, like SMS or Contacts.

There will also be the following files and folders, which may be of interest:

db/ - folder where downloaded databases are stored
db/md5sums.txt - file containing MD5 hashes of the databases after they were downloaded, but before the content was decoded;
log-errors.txt - text file containing log of any downloading or decoding failures or errors;
backup.ab - if a backup method was used, the full backup file also will be stored in the directory;

Lockscreens Bypass


Andriller has the means of decoding pattern locks, and cracking PIN codes and Passwords.

Pattern Lockscreen
You require to submit the gesture.key file, which will open a web browser, and get the value decoded online.

PIN and Password Cracking
These features require a little more processing power, so are best to be performed locally on your own machine. The methods are explained below.

Get Salt from...
Salt is an integer value, which is required for cracking the passwords. Salt can be positive as well as negative integers. The salt value can be obtained by parsing setting.db or locksettings.db files; when sucessfully fetched, the Salt value will be printed into the main terminal window.

Lockscreen PIN code cracking


  1. Select start and max value of the PIN code. By default, the max value is set to 9999, increase if required.
  2. Enter the value of password.key file
  3. Enter the salt value as an integer.
  4. Press Start for cracking to begin

Once Start is clicked, a percentage progress will be displayed.

You can pause and resume cracking at any time. Last tried PIN will be shown just to let you know how far you've gone.

Lockscreen Password cracking


  1. Click Browse and select a word list file (recommended word list files to download from here)
  2. Enter the value of password.key file
  3. Enter the salt value and an integer.
  4. Press Start for cracking to begin

Once Start is clicked, tried password will be displayed while cracking.

You can pause and resume cracking at any time, just like with PIN cracking.


Performance (passwords/second)
Intel i7-3810 CPU:615,000+
Intel Pentium B960 CPU:367,000+

Supported data extraction


Non-root devices (All Android versions):
  • Android device make and model
  • IMEI, build version, OS version
  • Wifi mac address
  • Time and date check
  • SIM card details (for a some Galaxy Sx devices only)
  • Synchronised accounts
Non-rooted devices (via AB method, Android versions 4.x and above):
  • Wi-Fi passwords (WPA-PSK/WEP)
  • Phonebook contacts (device dependant)
  • Call logs register (device dependant)
  • Call logs (Samsung) register (device dependant)
  • Samsung SMS snippets (device dependant)
  • SMS messages (device dependant)
  • Android browser saved passwords
  • Android browser browsing history
  • Google Chrome saved passwords
  • Google Chrome browsing history
  • Dolphin web browsing history
  • Facebook chat messages
  • Facebook user viewed photographs
  • Facebook user notifications
  • WhatsApp contacts list
  • WhatsApp chat messages
  • Kik Messenger chat messages
  • BBM chat messages (Blackberry Messenger)
  • Viber calls register
  • Viber chat messages
  • Tinder matches
  • Tinder chat messages
  • MeowChat messages
Rooted devices (via root adbd or 'su' binary, all Android versions):
  • Security lockscreen pattern gesture extraction (decoding online)
  • Wi-Fi passwords (WPA-PSK/WEP)
  • Synchronised accounts and profile picture
  • Bluetooth mac address and name
  • Phonebook contacts
  • Call logs register
  • Call logs (Samsung) register
  • Samsung SMS snippets
  • SMS messages
  • Android browser saved passwords
  • Android browser browsing history
  • Google Chrome saved passwords
  • Google Chrome browsing history
  • Dolphin web browsing history
  • Facebook chat messages
  • Facebook user viewed photographs
  • Facebook user notifications
  • WhatsApp contacts list
  • WhatsApp chat messages
  • Kik Messenger chat messages
  • BBM chat messages (Blackberry Messenger)
  • Viber calls register
  • Viber chat messages
  • Tinder matches
  • Tinder chat messages
  • MeowChat messages