Android Forensics Guide
ADB setup, device connection, evidence handling, logical acquisition, app databases, screenshots, and log collection.
Start with teaching guides for device workflows, then use browser-based viewers for exported artifacts such as SQLite databases, SMS/MMS records, logs, plist files, and wearable data.
Start here
Each resource is grouped by purpose so students can read a guide first, then open a browser-based tool when they are ready to inspect an example artifact or practice a concept.
Learning guides
Interactive tools
Learning guides
Teaching-first walkthroughs for workflows that cannot safely or fully run inside a browser.
ADB setup, device connection, evidence handling, logical acquisition, app databases, screenshots, and log collection.
Finder and iTunes backup workflows, MobileSync folders, plist review, backup preservation, and iOS artifact basics.
Lumia and Windows Phone evidence handling, historical app artifacts, backup considerations, and platform limitations.
A beginner-friendly guide for wearable evidence, exported health data, timestamps, device sync, and chain-of-custody notes.
Interactive tools
Browser-based utilities for safe local inspection of exported artifacts, databases, logs, and timelines.
Open exported SQLite databases locally, browse tables, inspect schema, and export selected rows for teaching examples.
A focused viewer for Android messaging artifacts such as mmssms.db, thread views, timestamps, and participants.
Paste or upload exported logcat text, filter by severity, package, timestamp, and forensic keywords.
Inspect safe exported backup metadata, plist files, and manifest-style records without uploading evidence.
Turn exported wearable CSV or JSON data into a clear activity, sleep, recovery, and timestamp timeline.
Begin with Android acquisition basics, move into example workflows, then inspect exported artifacts with the SQLite and SMS/MMS viewers before exploring iOS, Windows Phone, and wearable evidence.