FAMA: Forensic Analysis for Mobile Apps

Export context and analysisς Android με ενσωματωμένη ενότητα Autopsy. Απορρίψτε εύκολα δεδομένα χρήστη από μια συσκευή και δημιουργήστε ισχυρές αναφορές για αυτοψία ή εξωτερικές applications.

Specifications

• Export user application data from an Android device with ADB (root and ADB required).
• Discard user data from an Android image or a mounted path.
• Easily create sections for a specific Android application.
• Create clear and legible JSON reports.
• Full built-in automatic analysis compatibility (data source processor module, sink module, unit reference, geographic location, communication and schedule support).
• Export HTML report based on the current case.

Prerequisites

• Python (2.7 +)
• Autopsy

Use

At the terminal

usage: start.py [-h] [-d DUMP [DUMP ...]] [-p PATH] [-o OUTPUT] [-a] app Forensics Artefacts Analyzer positional arguments: app Application or package to be analyzed  or 

At Autopsy

1. Download repository contents (zip).
2. Autopsy -> Tools -> Python Plugins
3. Unzip the previously downloaded zip in the folder python_modules.
4. Restart Autopsy, create a case, and select a module.
5. Set your drive options in the selector window Ingest Module.
6. Click 'Generate Report' to generate an HTML report.

Tested on

• Windows (primary)
• Linux
• Mac OS

Application snapshots

You can download the program from here.