Q: When I start Andriller, I get an error that MSVCR100.dll is missing.

A: Your PC needs to have the Microsoft Visual C++ 2010 Redistributable Package (x86) installed. Download it from here: http://www.microsoft.com/en-gb/download/details.aspx?id=5555

 

Q: Andriller did not extract as many Apps using the AB (Android Backup) method as it did in the past.

A: This has recently affected all forensic software, and is not unique to Andriller. The developers of applications (Facebook, WhatsApp, etc.) have setted up new permissions: they have opted out their Apps from being included in the Android Backup. Since the data from those Apps is no longer included in the backup - they do not appear in the report. In order to read data from such Apps, you must either:

  • Root your device. XDA Developers is a great source to find for such information.
    Our favourite rooting tools are Framaroot, TowelRoot, ActiveRoot, KingoRoot, or SuperOneClick.
  • Flash custom recovery, such as ClockWorkMod or TWRP. When booted in custom recovery you can either:
    - Do an ADB extraction with root permissions whilst booted in recovery (make sure /data and /system are mounted), or
    - Perform a backup in recovery menu, later parse the data.tar file in Andriller.

DISCLAIMER: you must only proceed with rooting or flashing custom recoveries if you know what you are doing and know the consequences of your actions. We take no responsibility for any damage, loss of data, bricked devices or voided warranties. Any actions carried out are your own responsibility. Please do not contact us for support on specifics of rooting/flashing your devices.

 

Q: Andriller does not detect my Android device.

A: Most likely you have a drivers issue with your PC. Make sure you check every of the following:

  • Do you have correct drivers installed? (Links: Samsung Drivers, Other)
  • Have you enabled USB Debugging? USB Debugging installs the ADB driver, and it is required to perform an extraction.

For Android versions 2.x:

Go to Settings > Applications > Development > USB Debugging; tick this option.

For Android versions 4.x:

Go to Settings > Developer options > USB Debugging; tick this option

For Android versions 4.2.2 and above, you must unhide the developer options first:

Go to Settings > About device > Build number; now tap Build number seven (7) times, this will unhide Developer options.

  • Accept RSA fingerprint. If you have an Android device running Android version 4.2.2 or above, when a device is accessed via ADB, the device will request if you wish to Accept or Reject the connection. Click Accept and tick the checkbox to remember your selection. The screen needs to be unlocked for this stage.

  • Check if your device is properly connected via USB cable. Try using a different USB cable.

 

Q: Does Andriller bypass lockscreen security on my device?

A: No. Andriller has a feature of cracking lockscreen credentials. The credentials need to be acquired via root or a physical extraction first.

 

Q: Can Andriller decrypt WhatsApp backups without a key file?

A: No.

 

Q: Can Andriller recover deleted data from my device?

A: No. Andriller decodes live data only.

 

© 2017 Andriller. All rights reserved.