A forensic software utility for read-only, non-destructive data acquisition and analysis from Android smartphones.
Andriller is a forensic software utility that provides a collection of tools for acquiring and analyzing data from smartphones, primarily Android devices. It performs read-only, non-destructive data extraction to maintain forensic integrity while decoding app databases, cracking lockscreens, and generating investigative reports. The tool supports both rooted and non-rooted devices, parsing backups and producing outputs in HTML and Excel formats.
Digital forensic investigators, law enforcement professionals, cybersecurity analysts, and researchers who need to conduct forensic examinations of Android smartphones. It is also suitable for IT security teams performing internal investigations or data recovery.
Developers choose Andriller for its comprehensive, forensically sound approach to mobile data acquisition without altering device evidence. Its unique selling point is the combination of lockscreen cracking, app-specific decoders, and support for multiple extraction methods (backup, ADB, root) in a single Python-based utility.
📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Emphasizes read-only, non-destructive acquisition to preserve evidence integrity, ensuring data is not altered during extraction, as stated in the philosophy.
Powerfully cracks Pattern, PIN, and Password lockscreens (excluding gatekeeper), enabling access to secured Android devices for investigative purposes.
Custom decoders parse Android app databases for communications, with some support for iOS and Windows, allowing deep analysis of extracted data.
Supports both non-rooted (via Android Backup) and rooted devices (via ADB, recovery, or SU), providing multiple acquisition paths for different scenarios.
Non-rooted extraction relies on Android Backup with varied/limited support, mainly for Android 4.x, which may not cover newer versions without root access.
Requires external tools like adb and Python 3.6-3.10 with specific setup, adding installation hurdles compared to all-in-one forensic software packages.
As an open-source project, it lacks commercial support, regular updates, and certification that proprietary forensic tools offer for legal admissibility.