Android Forensics — Blog https://www.androidforensics.app/en/blog Latest from Blog en Sat, 31 Oct 2026 15:26:59 GMT Android Acquisition: Logical, ADB Backup, Bugreport, FFS https://www.androidforensics.app/en/blog/android-acquisition-methods https://www.androidforensics.app/en/blog/android-acquisition-methods How to acquire an Android phone: what logical, ADB backup, bugreport, full file system and physical extraction each reach, and how FBE and lock state decide. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT Android App Usage and Pattern of Life Forensics https://www.androidforensics.app/en/blog/android-app-usage-pattern-of-life https://www.androidforensics.app/en/blog/android-app-usage-pattern-of-life Prove when an Android phone was used and which app was on screen: usagestats, Digital Wellbeing, batterystats, recent tasks and notifications, combined. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT Android Bugreport and dumpsys Forensics https://www.androidforensics.app/en/blog/android-bugreport-dumpsys https://www.androidforensics.app/en/blog/android-bugreport-dumpsys Collect and read an Android bugreport: dumpstate layout, the dumpsys sections that matter for forensics, logcat, time handling, privacy and tools like MVT. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT Android Location Forensics: Timeline, Wi-Fi, EXIF https://www.androidforensics.app/en/blog/android-location-forensics https://www.androidforensics.app/en/blog/android-location-forensics Place an Android phone in space and time: Google Maps Timeline after the on-device move, Wi-Fi and Bluetooth, cell data, photo EXIF, and how to weigh them. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT Android Stalkerware and Malware Triage with MVT https://www.androidforensics.app/en/blog/android-malware-stalkerware-triage https://www.androidforensics.app/en/blog/android-malware-stalkerware-triage Triage an Android phone for stalkerware and spyware: sideloaded APKs, accessibility, notification access, device admin, permissions, and MVT with androidqf. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT Android Messaging Apps Forensics: WhatsApp to RCS https://www.androidforensics.app/en/blog/android-messaging-apps-forensics https://www.androidforensics.app/en/blog/android-messaging-apps-forensics How to acquire and analyse WhatsApp, Signal, Telegram and Google Messages on Android: where each stores chats, what encryption blocks, and what survives. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT Android Timeline Analysis: ALEAPP, Epochs and UTC https://www.androidforensics.app/en/blog/android-timeline-analysis https://www.androidforensics.app/en/blog/android-timeline-analysis Build an Android device timeline: every timestamp format on the phone, converting to UTC, ALEAPP and Plaso output, merging sources, and pivoting from anchors. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT