Andriller CE — Swiss Army Knife for Android Forensics
When you need a digital detective
Imagine this: you found an old Android smartphone but can't remember the pattern lock. Or you need to analyze an app backup, but the data is encrypted. These are exactly the kinds of tasks Andriller CE handles — a suite of tools for forensic analysis of mobile devices.
What can this tool do?
Andriller CE is a Python utility with an impressive set of capabilities:
- Data extraction without root — works with Android 4.x via backups
- Lock bypass — supports pattern locks, PINs, and passwords
- App analysis — decodes data from WhatsApp, Telegram, and other messengers
- Backup handling — can unpack .ab and TAR archives
- Result export — generates reports in HTML and Excel
Technical features
The project is written in Python 3.6+ and uses:
- ADB for device communication
- Custom decoders for popular data formats
- A tkinter-based GUI for easy operation
Installation is straightforward:
pip install andriller -U
And launching is even easier:
python -m andriller
Who is it for?
- Developers — for analyzing their own app behavior
- IT specialists — when diagnosing device issues
- Forensic experts — as part of legitimate data analysis
- Curious users — to regain access to their own devices
Personal experience
In my practice, Andriller has come in handy more than once when analyzing app backups. I was particularly impressed with its handling of encrypted WhatsApp databases — with the key available, decryption takes just a couple of clicks.
Andriller CE is not just another Android tool, but a full-fledged forensic laboratory in a single package. If you need to deeply analyze mobile devices — it's definitely worth trying.
The project is actively developed, has open source code (MIT License), and welcomes your pull requests in the GitHub repository.
Related projects