Andriller

Andriller is a program for Windows with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices. It has other features, such as powerful Lockscreen cracking for Pattern, PIN code, or Password; custom decoders for Apps data from Android (and some Apple iOS) databases for decoding communications. Decoders produce reports in a HTML format. Basic Setup Andriller comes as a lightweight setup installable. It requires no dependable to be installed. All it needs is a web browser for viewing results. Simple. Features Automated data extraction and decoding Data extraction with root permissions: root ADB daemon, CWM recovery mode, or SU binary (Superuser/SuperSU) Data extraction by Android Backup (Android versions 4.x). Selection of individual database decoders for Android and Apple Lockscreen cracking for Pattern, PIN, Password.

What is new in this release:

Version 2.6.2:

• GPS locations and metadata from media (images and videos) reporting, from package ID "com.google.android.apps.photos";
• Screen Capture UX improved and bugs fixed;
• Decoders menu items re-arranged;
• Phonebook decoding option bug fixed;
• Reporting on Excel is made prettier.

What is new in version 2.6.1.1:

Changelog 2.6.1.1 (18-08-2016)

• Facebook decoder has been completely re-written. Greater stability and error handling. Messages will also include "shares", "stickers", and "attachments" in the HTML view mode.
• AB extraction error fixed for Android versions 6.x;
• Improved stability when decoding individual databases;
• WhatsApp minor bugs fixed;
• Facebook multiple database decoder deprecated.

MD5: 9e8a2855b9f101b55444ed8df754a17a Andriller_v2.6.1_Setup.exe

What is new in version 2.6.1:

Changelog 2.6.1 (11-08-2016)

• Facebook decoder has been completely re-written. Greater stability and error handling. Messages will also include "shares", "stickers", and "attachments" in the HTML view mode.
• AB extraction error fixed for Android versions 6.x;
• Improved stability when decoding individual databases;
• WhatsApp minor bugs fixed;
• Facebook multiple database decoder deprecated.

MD5: 9e8a2855b9f101b55444ed8df754a17a Andriller_v2.6.1_Setup.exe

What is new in version 2.6.0.1:

Version 2.6.0.1 includes minor bug fixes with multiple WhatsApp database decoder, Facebook messages decoding improvements, and Viber bugs fixes.

What is new in version 2.5.4:

Maintenance release, bug fixes.

What is new in version 2.5.3.1:

Version 2.5.3.1:

• Release for UBUNTU (i686 and x64).
• Lockscreen PIN cracking bug fixed, where some numbers with leading zeros were not being tested.
• Grindr decoding errors fixed.

What is new in version 2.5.1:

Version 2.5.1:

• Added file system extraction of "Shared Storage". Supports Android versions 4.x and above. Generates a report with files, which can be viewed using a browser.
• WhatsApp decoding minor issues solved.
• Minor bugs causing crashes were fixed.
• EULA agreement added.

What is new in version 2.5.0.2:

Version 2.5.0.2: Multiple WhatsApp Databases decoder bugs fixed.

What is new in version 2.4.4.1:

Version 2.4.4.1 may include unspecified updates, enhancements, or bug fixes.

What is new in version 2.4.3:

Version 2.4.3:

• Time Zones added for reporting. Go to File > Preferences, and change to your UTC offset for your timezone. Default UTC+00:00.
• Customizable header and footer can be changed in Preferences. Use HTML tagging for customisations.
• WhatsApp Calls support added (Beta).
• Minor improvements to data extraction.

What is new in version 2.4.2:

Version 2.4.2:

• Data Parse decoding improved, it can detect a few more databases and decode them.
• Writing to Excel improved, which should result in fewer errors.
• License migration is added. Valid licenses can be transferred onto other UID if needed.
• Get salt from "locksettings.db-wal" (write ahead logs) for PIN/passwords cracking.
• Minor attributions extraction improvements.

What is new in version 2.3.8:

Version 2.3.8:

• Important bug fix! Latest Windows update had caused the Unique ID to change, that caused the license key not being recognised. This update will change your UID, and will prevent it from changing.

What is new in version 2.3.7:

Version 2.3.7:

• Various usage bugs eliminated in Lockscreens decoders/crackers.
• Reported bugs fixed.

What is new in version 2.3.6:

• ChatOn messages support added for root extraction and decoders.
• Improvements to Gesture pattern decoding: graphical design re-touched, visualisation of the pattern can be exported as a postscript file.
• User experience: keyboard shortcuts activated for common actions (eg: Esc to exit), Function keys (F5-F7) to proceed to extraction.
• Tool tips: new feature that displays helpful tips on mouse hover over items.
• Themes option added to Preferences, where window layout styles can be changed.

What is new in version 2.3.4:

Version 2.3.4:

• Lockscreen password cracking for #Samsung type passwords (using wordlists);
• Decrypt now decrypts WhatsApp encrypted databases with .crypt7 extentions;
• Lockscreen password cracking tried words count does not reset after pause;
• Menu for lockscreens re-arranged by groups.

What is new in version 2.3.3:

Version 2.3.3:

• Password cracking - minor improvements for reading dictionary file.
• Pattern cracking - the gesture pattern can now be drawn in a visual representation.
• Minor improvements for decoding Calls, WhatsApp contacts, Tinder matches.
• Extraction of data while the device is in RECOVERY MODE (ClockWorkMod, etc.) with root privilleges and /system and /data partitions mounted.
• Configutation now has Offline Mode, which skipps the version check on startup.

What is new in version 2.3.2:

Version 2.3.2:

• Lockscreen Gesture pattern decoding is now performed locally without the need to submit a hash value online. Import the 'gesture.key' file directly or input the hash value. Depending on CPU, the gesture hash is usually decoded within a few seconds.
• Lockscreen Brute force cracker now has procentage and time remaining for completion; also includes minor improvements.
• Configurations menu added under File. Minor miscelaneous options can be defined by the end user, these include: defining the default Output directory; setting the password cracking update rate (after how many password tries the update should be visualised).
• Configurations; last used path is now remembered from Decoders and other locations.
• Licensing issues; if upgrading a newly generated unique id will be issued.

Requirements:

Microsoft Visual C++ 2010 Redistributable Package (x86)

Limitations:

30-day trial