In-depth Android forensics guides, from choosing an extraction level to building a device timeline.
How to acquire an Android phone: what logical, ADB backup, bugreport, full file system and physical extraction each reach, and how FBE and lock state decide.
Prove when an Android phone was used and which app was on screen: usagestats, Digital Wellbeing, batterystats, recent tasks and notifications, combined.
Collect and read an Android bugreport: dumpstate layout, the dumpsys sections that matter for forensics, logcat, time handling, privacy and tools like MVT.
Place an Android phone in space and time: Google Maps Timeline after the on-device move, Wi-Fi and Bluetooth, cell data, photo EXIF, and how to weigh them.
Triage an Android phone for stalkerware and spyware: sideloaded APKs, accessibility, notification access, device admin, permissions, and MVT with androidqf.
How to acquire and analyse WhatsApp, Signal, Telegram and Google Messages on Android: where each stores chats, what encryption blocks, and what survives.
Build an Android device timeline: every timestamp format on the phone, converting to UTC, ALEAPP and Plaso output, merging sources, and pivoting from anchors.