How to install Andriller on Windows step by step?

Download Python 3.6-3.10, ensure 'Add Python to PATH' is checked, install via pip in a virtual environment, and run 'python -m andriller' for the GUI. The README provides detailed commands for setup.

Can Andriller crack iPhone lockscreens?

No, Andriller's lockscreen cracking is specifically for Android Pattern, PIN, and Password; it has limited iOS database parsing but not comprehensive iPhone forensic tools like lockscreen bypass.

Andriller vs. Oxygen Forensic Suite: which is better for Android investigations?

Andriller is free and open-source, ideal for custom workflows and lockscreen cracking, while Oxygen Forensic Suite is commercial with broader device support, updates, and support, but at a higher cost.

How to decrypt WhatsApp databases with Andriller?

Ensure you have the correct key file, then use Andriller's decryption feature to convert .crypt to .crypt12 files; the tool parses these encrypted archives during data extraction.

Does Andriller work on Android 11 or 12 without root?

Support may be limited, as non-rooted extraction via Android Backup is primarily for Android 4.x; for newer versions, rooted methods or backup file parsing might be necessary, but compatibility isn't guaranteed.

How to generate Excel reports from extracted data?

After running data extraction and decoding, Andriller automatically produces forensic reports in HTML and Excel formats, which can be saved and analyzed directly from the output.

Open-Awesome

Andriller

MITPython3.6.3

A forensic software utility for read-only, non-destructive data acquisition and analysis from Android smartphones.

GitHub

1.6k stars257 forks0 contributors

What is Andriller?

Andriller is a forensic software utility that provides a collection of tools for acquiring and analyzing data from smartphones, primarily Android devices. It performs read-only, non-destructive data extraction to maintain forensic integrity while decoding app databases, cracking lockscreens, and generating investigative reports. The tool supports both rooted and non-rooted devices, parsing backups and producing outputs in HTML and Excel formats.

Target Audience

Digital forensic investigators, law enforcement professionals, cybersecurity analysts, and researchers who need to conduct forensic examinations of Android smartphones. It is also suitable for IT security teams performing internal investigations or data recovery.

Value Proposition

Developers choose Andriller for its comprehensive, forensically sound approach to mobile data acquisition without altering device evidence. Its unique selling point is the combination of lockscreen cracking, app-specific decoders, and support for multiple extraction methods (backup, ADB, root) in a single Python-based utility.

Overview

📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.

Use Cases

Best For

Conducting forensic investigations on Android smartphones
Cracking Pattern, PIN, or Password lockscreens on Android devices
Decoding and analyzing data from Android app databases (e.g., WhatsApp, communications)
Extracting data from Android backup files (.ab, tarballs) forensically
Performing read-only data acquisition from rooted or non-rooted Android devices
Generating forensic reports in HTML or Excel format for legal or investigative purposes

Not Ideal For

Investigations focusing primarily on iOS or Windows Phone devices, as support is limited to some database parsing and not comprehensive forensic analysis.
Real-time forensic analysis or live device monitoring during active use, since Andriller is designed for static data acquisition from backups and connected devices.
Environments requiring certified forensic tools with commercial support, training, and integration into enterprise suites, as it's open-source and community-driven.

Pros & Cons

Pros

Forensic Integrity Focus

Emphasizes read-only, non-destructive acquisition to preserve evidence integrity, ensuring data is not altered during extraction, as stated in the philosophy.

Lockscreen Cracking Power

Powerfully cracks Pattern, PIN, and Password lockscreens (excluding gatekeeper), enabling access to secured Android devices for investigative purposes.

Comprehensive App Decoding

Custom decoders parse Android app databases for communications, with some support for iOS and Windows, allowing deep analysis of extracted data.

Flexible Extraction Methods

Supports both non-rooted (via Android Backup) and rooted devices (via ADB, recovery, or SU), providing multiple acquisition paths for different scenarios.

Cons

Limited Non-Rooted Support

Non-rooted extraction relies on Android Backup with varied/limited support, mainly for Android 4.x, which may not cover newer versions without root access.

System Dependency Complexity

Requires external tools like adb and Python 3.6-3.10 with specific setup, adding installation hurdles compared to all-in-one forensic software packages.

Community-Driven Limitations

As an open-source project, it lacks commercial support, regular updates, and certification that proprietary forensic tools offer for legal admissibility.

Frequently Asked Questions

Related Projects

Mobile-Security-Framework MobSF

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Stars21,483

Forks3,732

Last commit2 days ago

Drozer

The Leading Security Assessment Framework for Android.

Stars4,578

Forks842

Last commit3 months ago

Runtime Mobile Security (RMS)

Runtime Mobile Security (RMS) 📱🔥 - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime

Stars3,052

Forks411