Android forensic parsers and tools

Every parser and tool referenced on this site, with its licence and the artifacts it handles. Open an artifact for how to use it.

45 tools

Tool	Type	Artifacts
Browser Forensics	In browser	Chrome History Samsung Internet (History)
Disk Image Parser	In browser	Installed packages (packages.xml)
Hash Extractor	In browser	ADB backup (.ab)
Messaging Forensics	In browser	SMS / MMS (mmssms.db) WhatsApp (msgstore.db / wa.db)
ALEAPP	CLI · open source	Accessibility and device admin ADB backup (.ab) Accounts (accounts_ce.db / accounts_de.db) Call log (calllog.db) Contacts (contacts2.db) Notification history Settings (settings_*.xml) Batterystats Bluetooth (bt_config.conf) build.prop and device identifiers Chrome History DCIM, EXIF and MediaStore Digital Wellbeing (app_usage) Google Maps Timeline Google Messages (bugle_db) Installed packages (packages.xml) Recent tasks and snapshots Runtime permissions and appops Samsung Internet (History) SMS / MMS (mmssms.db) Usagestats WhatsApp (msgstore.db / wa.db) Wi-Fi config (WifiConfigStore.xml)
Cellebrite UFEDCellebrite	Platform · commercial	ADB backup (.ab) Accounts (accounts_ce.db / accounts_de.db) Call log (calllog.db) Contacts (contacts2.db) Notification history Batterystats Bluetooth (bt_config.conf) build.prop and device identifiers Chrome History DCIM, EXIF and MediaStore Digital Wellbeing (app_usage) Google Maps Timeline Google Messages (bugle_db) Installed packages (packages.xml) Recent tasks and snapshots Samsung Internet (History) Signal (signal.db) SMS / MMS (mmssms.db) Telegram (cache4.db) Usagestats WhatsApp (msgstore.db / wa.db) Wi-Fi config (WifiConfigStore.xml)
Magnet AXIOMMagnet Forensics	Platform · commercial	ADB backup (.ab) Accounts (accounts_ce.db / accounts_de.db) Call log (calllog.db) Contacts (contacts2.db) Notification history Batterystats Bluetooth (bt_config.conf) build.prop and device identifiers Chrome History DCIM, EXIF and MediaStore Digital Wellbeing (app_usage) Google Maps Timeline Google Messages (bugle_db) Installed packages (packages.xml) Recent tasks and snapshots Samsung Internet (History) Signal (signal.db) SMS / MMS (mmssms.db) Telegram (cache4.db) Usagestats WhatsApp (msgstore.db / wa.db) Wi-Fi config (WifiConfigStore.xml)
Oxygen Forensic DetectiveOxygen Forensics	Platform · commercial	Accounts (accounts_ce.db / accounts_de.db) Call log (calllog.db) Contacts (contacts2.db) Bluetooth (bt_config.conf) build.prop and device identifiers Chrome History DCIM, EXIF and MediaStore Digital Wellbeing (app_usage) Google Maps Timeline Google Messages (bugle_db) Installed packages (packages.xml) Samsung Internet (History) Signal (signal.db) SMS / MMS (mmssms.db) Telegram (cache4.db) Usagestats WhatsApp (msgstore.db / wa.db) Wi-Fi config (WifiConfigStore.xml)
sqlite3SQLite	CLI · open source	Accounts (accounts_ce.db / accounts_de.db) Call log (calllog.db) Contacts (contacts2.db) Notification history Chrome History DCIM, EXIF and MediaStore Digital Wellbeing (app_usage) Google Messages (bugle_db) Samsung Internet (History) Signal (signal.db) SMS / MMS (mmssms.db) Telegram (cache4.db) WhatsApp (msgstore.db / wa.db)
dumpsysAndroid	CLI · on the device	Accessibility and device admin Accounts (accounts_ce.db / accounts_de.db) Notification history Settings (settings_*.xml) Batterystats Bluetooth (bt_config.conf) Installed packages (packages.xml) Recent tasks and snapshots Runtime permissions and appops Usagestats Wi-Fi config (WifiConfigStore.xml)
DB Browser for SQLite	GUI · open source	Accounts (accounts_ce.db / accounts_de.db) Call log (calllog.db) Contacts (contacts2.db) Chrome History Digital Wellbeing (app_usage) Google Messages (bugle_db) Samsung Internet (History) SMS / MMS (mmssms.db) Telegram (cache4.db) WhatsApp (msgstore.db / wa.db)
MSAB XRYMSAB	Platform · commercial	Call log (calllog.db) Contacts (contacts2.db) Chrome History Google Messages (bugle_db) SMS / MMS (mmssms.db) Telegram (cache4.db) WhatsApp (msgstore.db / wa.db)
abx2xmlAndroid 12+	CLI · on the device	Accessibility and device admin Settings (settings_*.xml) Installed packages (packages.xml) Recent tasks and snapshots Runtime permissions and appops Wi-Fi config (WifiConfigStore.xml)
ccl_abxCCL Solutions Group	Library · open source	Accessibility and device admin Settings (settings_*.xml) Installed packages (packages.xml) Recent tasks and snapshots Runtime permissions and appops Wi-Fi config (WifiConfigStore.xml)
xmllintlibxml2	CLI · open source	Settings (settings_*.xml) Installed packages (packages.xml) Recent tasks and snapshots Runtime permissions and appops Wi-Fi config (WifiConfigStore.xml)
AutopsyBasis Technology	GUI · open source	Call log (calllog.db) Contacts (contacts2.db) DCIM, EXIF and MediaStore SMS / MMS (mmssms.db)
MVTAmnesty International	CLI · open source	Accessibility and device admin Settings (settings_*.xml) Installed packages (packages.xml) Runtime permissions and appops
adbAndroid SDK Platform-Tools	CLI · open source	ADB backup (.ab) build.prop and device identifiers DCIM, EXIF and MediaStore
Andriller	GUI · open source	Call log (calllog.db) Contacts (contacts2.db) SMS / MMS (mmssms.db)
blackboxprotobufNCC Group	Library · open source	Notification history build.prop and device identifiers Usagestats
protocGoogle	CLI · open source	Notification history build.prop and device identifiers Usagestats
androidqfMVT project	CLI · open source	Accessibility and device admin Runtime permissions and appops
Apktool	CLI · open source	Accessibility and device admin Installed packages (packages.xml)
Belkasoft XBelkasoft	Platform · commercial	Telegram (cache4.db) WhatsApp (msgstore.db / wa.db)
Hindsight	CLI · open source	Chrome History Samsung Internet (History)
jadx	GUI · open source	Accessibility and device admin Installed packages (packages.xml)
pmAndroid package manager shell	CLI · on the device	Installed packages (packages.xml) Runtime permissions and appops
Python ElementTreePython standard library	Library · open source	Settings (settings_*.xml) Wi-Fi config (WifiConfigStore.xml)
settingsAndroid shell	CLI · on the device	Accessibility and device admin Settings (settings_*.xml)
Android Backup Extractor	CLI · open source	ADB backup (.ab)
apksignerAndroid SDK Build-Tools	CLI · open source	Accessibility and device admin
appopsAndroid shell (cmd appops)	CLI · on the device	Runtime permissions and appops
Battery HistorianGoogle	GUI · open source	Batterystats
contentAndroid shell	CLI · on the device	Call log (calllog.db)
ExifToolPhil Harvey	CLI · open source	DCIM, EXIF and MediaStore
getpropAndroid shell	CLI · on the device	build.prop and device identifiers
hashcat	CLI · open source	ADB backup (.ab)
John the RipperOpenwall	CLI · open source	ADB backup (.ab)
jq	CLI · open source	Google Maps Timeline
Plaso	CLI · open source	Chrome History
RLEAPP	CLI · open source	Google Maps Timeline
signalbackup-tools	CLI · open source	Signal (signal.db)
SQLCipherZetetic	Library · open source	Signal (signal.db)
wa-crypt-tools	CLI · open source	WhatsApp (msgstore.db / wa.db)
Wireshark	GUI · open source	Bluetooth (bt_config.conf)