• Free Mobile Forensics Tool that allows you to:
• It is important that you take the training to ensure greater security and success in acquisitions without data loss (Brief training in the English language).
• É importante que você faça o treinamento para garantir maior segurança e sucesso nas aquisições sem perda de dados, veja no final da página.

1. Backup ADB.
2. APK Downgrade in 15 Apps: WhatsApp (com.whatsapp), Telegram (org.telegram.messenger), Messenger (com.facebook.orca), ICQ (com.icq.mobile.client), Twitter (com.twitter.android), Instagram (com.instagram.android), Signal (org.thoughtcrime.securems), Linkdin (com.linkedin.android), Tiktok (com.zhiliaoapp.musically), Snapchat (com.snapchat.android), Tinder (com.tinder), Badoo (com.badoo.mobile), Mozilla Firefox (org.mozilla.firefox), Dropbox (com.drobox.android), Alibaba (com.alibaba.intl.android.apps.poseidon)).
3. Parser Chats WhatsApp.
4. (NEW) Whatsapp .opus audio transcription and transcription plot in CHATS HTML PARSER:
5. Miscellaneous ADB collections: (System Properties (Full), Dumpsys (Full), Disktats (Disk Information), Android Geolocation Dump (Location Manager State), IMEI (01 ,02), S/N (Serial Number), Processes, TCP (Active Internet connections), Accounts (UserInfo), DUMP Wifi, DUMP Detailed Wifi, CPU Information, Memory Information, Display Information (WINDOW MANAGER DISPLAY CONTENTS), Resources, Resolution (Physical size), Screen Dump (.XML file), Dump Backup (Backup Manager is enabled), List Installed Third-Party Applications, List Native System Applications, Contacts, SMS, System Events, Active Users, Android Version, DB Info (Applications Database Info), On/Off History, LogCat, Space In Use Information, Carrier, Bluetooth (Bluetooth Status), Image File Location, Audio File Location, Video File Location, Face Recognition DUMP, Global Settings, Security Settings a, System Settings, Remove/Add PIN (Requires current PIN), DUMP ADB (ADB Connections), Reboot, Reboot Recovery Mode, Reboot Bootloader Mode, Reboot Fastboot Mode.
6. Tracking, Downloading and Decryption of Whatsapp .ENC files.
7. Contact List Search.
8. Deleted WhatsApp Photos Avatars and Contacts.
9. (NEW) Decrypting WhatsApp Databases Crypt 14/15
10. Screenshots.
11. Screen DUMP.
12. Chat Capture.
13. Automatic integration with IPED.
14. (NEW) Access Through the Tool to IPED Tools.
15. Automatic integration with AFLogical.
16. Automatic integration with Alias Connector.
17. Conversion from .AB to .TAR.
18. Fast Scan and Real-time Transfer .
19. Image Finder (Hash, Metadata, Geolocation, Plotting the location on Google Maps and Google Earch).
20. Plotting (IN BATCHES) of the Geolocation of images on Google Earch (geo.kml) with patch and thumbnails of the images.
21. Installing and Uninstalling APKs via ADB.
22. HASH Calculator.
23. Android Folder Browser (PULL and PUSH).
24. Device Mirroring.
25. Instagram Data Scraping.
26. General single copy
27. Automatic integration with MVT-1.5.3.
28. Access Through the Tool to JADX.
29. Access Through the Tool to WhatsApp Viewer.
30. Access Through the Tool to the BCV.
31. Access Through the Tool to SQLStudio.
32. PRUNE GPS Tool Access.
33. Access Through the Tool to jExiftool GUI.
34. Conversion of .csv/.txt files with GEOLIZATION information provided by court decisions into .KML for police investigations.

• Android default backup.

• WhatsApp (com.whatsapp)

• Telegram (org.telegram.messenger)

• Messenger (com.facebook.orca)

• ICQ (com.icq.mobile.client)

• Twitter (com.twitter.android)

• Instagram (com.instagram.android)

• Signal (org.thoughtcrime.securems)

• Linkdin (com.linkedin.android)

• Tiktok (com.zhiliaoapp.musically)

• Snapchat (com.snapchat.android)

• Tinder (com.tinder)

• Badoo (com.badoo.mobile)

• Mozilla Firefox (org.mozilla.firefox)

• Dropbox (com.drobox.android)

• Alibaba (com.alibaba.intl.android.apps.poseidon)

• Examples:

• The Backup Downgrade procedure in ANDROID 12 can damage the database

• The tool does a test in a generic application (com.aplicacaoteste.apk) before starting the DOWNGRADE process in the target APP.
• Tips: XIAOMI phones may come with USB protections, remove these protections without taking the device out of airplane mode by following the steps below:

1. Enable developer options.
2. Settings -> Additional Settings -> Disable MIUI optimizations
3. Reset phone
4. Settings -> Additional Settings -> Developer Options -> Allow USB Debugging
5. Security (system app) -> Manage apps -> Permissions -> Gear icon (top right) -> Install via USB (true)
6. Reset phone
7. Settings -> Additional Settings -> Developer Options -> Enable USB Installation

1. Select the Chats destination folder (Copy the "Media" folder in this same location).
2. Select the folder: \com.whatsapp\f\Avatars
3. Select the .DB file: \com.whatsapp\db\msgstore.db

• (NEW) In the "Generate Whatsapp Chats" modules it is possible to plot the transcripts in HTML.

• (NEW) You can also transcribe the audios along with Whatsapp parser process.

• New Schema (Table: message):

• Fields:

• _id, chat_row_id, from_me, key_id, sender_jid_row_id, status,broadcast, recipient_count, participant_hash, origination_flags, origin, timestamp received_timestamp, receipt_server_timestamp, message_type, text_data (Mensagens), starred, lookup_tables, message_add_on_flags, sort_id

1. Select the Chats destination folder (Copy the "Media" folder in this same location).
2. Select the folder: \com.whatsapp\f\Avatars
3. Select the .DB file: \com.whatsapp\db\msgstore.db

• (NEW) In the "Generate Whatsapp Chats" modules it is possible to plot the transcripts in HTML.

• (NEW) You can also transcribe the audios along with Whatsapp parser process.

• Old Schema (Table: messages)

• Fields:

• _id, key_remote_jid, key_from_me, key_id, status, needs_push, data (Mensagens), timestamp, media_url, media_mime_type, media_wa_type, media_size, media_name, media_caption, media_hash, media_durationorigin, latitude, longitude, thumb_image, remote_resource, received_timestamp, send_timestamp, receipt_server_timestamp, receipt_device_timestamp, read_device_timestamp, played_device_timestamp, raw_data, recipient_count, participant_hash, starred, quoted_row_id, mentioned_jids, multicast_id, edit_version, media_enc_hash, payment_transaction_id, forwarded, preview_type, send_count, lookup_tables, future_message_type, message_add_on_flags.

• In the "OPUS audio transcription" module you can transcribe one or thousands of audios at the same time.
• In the "Generate Whatsapp Chats" modules it is possible to plot the transcripts in HTML.
• You can also transcribe the audios along with Whatsapp parser process.
• Generate HTML report with transcribed texts, hash, contact linked to audio and chat linked to audio.

• System Properties (Full).
• Dumpsys (Complete).
• Disktats (Disk information).
• Android Geolocation Dump (Location Manager State).
• IMEI (01 .02).
• Y/N (Serial Number).
• Law Suit.
• TCP (Active Internet connections).
• Accounts (UserInfo).
• DUMP Wifi.
• Detailed Wifi DUMP.
• CPU information.
• Memory Information.
• Display Information (WINDOW MANAGER DISPLAY CONTENTS).
• Resources.
• Resolution (Physical size).
• Screen Dump (.XML file).
• Dump Backup (Backup Manager is enabled).
• List Installed Third-Party Applications.
• List Native System Applications.
• Contacts.
• SMS.
• System Events.
• Active Users.
• Android version.
• DB Info (Applications Database Info).
• On/Off History.
• LogCat.
• Space in Use Information.
• Operator.
• Bluetooth (Bluetooth Status).
• Location of Image Files.
• Location of Audio Files.
• Location of Video Files.
• Face Recognition DUMP
• Global Settings.
• Security Settings.
• System Settings.
• Remove/Add PIN (Requires current PIN).
• DUMP ADB (Connections ADB).
• Reboot.
• Reboot Recovery Mode.
• Reboot Bootloader Mode.
• Reboot Fastboot Mode.

• Examples:
• Dump ADB: ADB.txt, in this example we can check the last computer connected via ADB with the device:

• Dumpsys: dumpsys.txt, in addition to bringing thousands of device information, in this example we can check the uninstall date of an application:

• Note: The information can be in Unix Timestamp time format, use the link below to convert:
• 1649374898421 (Unix Timestamp) = Thu Apr 07 2022 23:41:38 GMT+0000 (GMT)
• https://www.unixtimestamp.com/

• Generate the Script and run the generated .bat file.

"C:\Forensics\bin\whatsapp-media-decrypt\decrypt.py"

1. Select the folder: \com.whatsapp\f\Avatars
2. Select .DB file: \com.whatsapp\db\wa.db

• Crypt14.
• Crypt15.

• Indexing of folders, .zip, .tar, .dd, .ufdr.

• "C:\Forensics\bin\IPEDTools\IPEDTools.exe"

• Performs the acquisition automatically without user intervention.
• "C:\Forensics\bin\AFLogicalOSE152OSE.apk"

• Performs the acquisition automatically without user intervention.
• "C:\Forensics\bin\com.alias.connector.apk"

• Passworded ADB backups may take longer to convert.
• Try not to put passwords in the backups requested in "ADB Backup" or "Downgrade", so you speed up the conversion process.
• If this module doesn't work, try to add the "C:\Forensics" patch to the system variables

• Images: .jpg, .jpeg, .png, .psd, .nef, .tiff, .bmp, .tec, .tif, .webp
• Videos: .aaf, .3gp, .asf, .avi, .m1v, .m2v, .m4v, .mp4, .mov, .mpeg, .mpg, .mpe, .mp4, .rm, .wmv, .mpv , .flv, .swf
• Audios: .opus, .aiff, .aif, .flac, .wav, .m4a, .ape, .wma, .mp2, .mp1, .mp3, .aac, .mp4, .m4p, .m1a, .m2a , .m4r, .mpa, .m3u, .mid, .midi, .ogg
• Archives: .zip, .rar, .7zip, .7z, .arj, .tar, .gzip, .bzip, .bzip2, .cab, .jar, .cpio, .ar, .gz, .tgz, .bz2
• Databases: .db, .db3, .sqlite, .sqlite3, .backup (SIGNAL)
• Documents: .htm, .html, .doc, .docx, .odt, .xls, .xlsx, .ppt, .pptx, .pdf, .txt, .rtf
• Executables: .exe, .msi, .cmd, .com, .bat, .reg, .scr, .dll, .ini, .apk

• Note: For this module DO NOT save your acquisitions on the Desktop, save for example in "C:\folder_name\collection_01" to run the image search.

• Note: To plot the thumbnails along with the yellow points, download Google Earch Pro, if you plot on Google Earch Online, only the blue points will be plotted without the images.
• Click on GENERATE KML to batch generate the geo.kml file

• .APK files

• Note: For this module DO NOT save your acquisitions on the Desktop, save for example in "C:\folder_name\collection_02" to calculate the Hashs of the files.
• Calculates the Hash of all files in an acquisition.
• SHA-256.
• SHA-1.
• SHA-384.
• SHA-512.
• SHA-MD5.

• A Simple folder browser to PULL and PUSH files or folders.

• "C:\Forensics\bin\scrcpy"

• If you have problems with "adb pull" or "adb backup", copy all files from the device in separate processes, copying one at a time.

• "C:\Forensics\bin\mvt-1.5.3\mvt.bat"

• "C:\Forensics\bin\jadx-1.2.0\jadx-gui-1.2.0-no-jre-win.exe"

• "C:\Forensics\bin\WhatsAppViewer.exe"

• "C:\Forensics\bin\bycodeviewer\GUI-ByteCode.bat"

• "C:\Forensics\bin\SQLiteStudio\SQLiteStudio.exe"

• "C:\Forensics\bin\gpsprune\GUI-GPSPrune.bat"

• "C:\Forensics\bin\exiftoolgui\jExifToolGUI.exe"

• Plotting thousands of points on the map in seconds
• In this example below, more than 36 thousand points were plotted on the map
• Example data from .csv file: 2022-04-15T02:59:45.368Z,2022-04-15T02:59:45.368, (Latitude/Column 2) -23.7416538, (Longitude/Column 3) -46.5744873,15,WIFI,1663554331,ANDROID

• TECHNICAL knowledge of Forensics in Mobile Devices.
• Minimal computer knowledge
• Device with DEBUG mode activated.
• Windows 10/11 with its proper updates.

• JAVA (https://www.java.com/pt-BR/).
• PHYTON (https://www.python.org/).

• ACADEMIA DE FORENSE DIGITAL - AFD (Advanced Extraction with Avilla Forensics).
• https://academiadeforensedigital.com.br/
• About the course: https://academiadeforensedigital.com.br/treinamentos/extracao-logica-avancada-com-avilla-forensics/
• Course content: https://drive.google.com/file/d/1mARPeClW1o3EBNIcLh3i9YzBn_fGuSet/view
• Webinar:
• Manual and step-by-step video prepared by Police Officer Emerson Borges - POLICE OF MINAS GERAIS - BRAZIL
• https://youtu.be/KuSmct1Qa30
• MANUAL_EXTRACAO_AVILLA_FORENSICS.pdf

• In progress

• Self-executing tool, no installation required.
• Run the "Avilla_Forensics.exe" file as administrator.
• Run the tool from "C:".
• Example: C:\Forensics".
• Do not put spaces in the tool folder name.

• IPED-4.0.1: "C:\Forensics\IPED-4.0.1_and_plugins" (Just install JAVA).
• IPED Tools: "C:\Forensics\bin\IPEDTools\IPEDTools.exe" Just install JAVA).
• Bycode Viewer: "C:\Forensics\bin\bycodeviewer" (Just install JAVA).
• Jadx-1.2.0: "C:\Forensics\bin\jadx-1.2.0" (Just install JAVA).
• Backup Extractor: "C:\Forensics\backup_extractor" (Just install JAVA).
• The Backup Extractor module (.AB to .TAR) may require you to add the "C:\Forensics" patch to the system variables.
• GPS PRUNE: "C:\Forensics\bin\gpsprune" (Just install JAVA).
• jExiftool GUI: "C:\Forensics\bin\exiftoolgui\jExifToolGUI.exe" (Just install JAVA).

• Instaloader: To install run the file "C:\Forensics\bin\instaloader-master\install_instaloader.bat" or:

pip install instaloader

• MVT-1.5.3: To install run the file "C:\Forensics\bin\mvt-1.5.3\install_mvt.bat" or:

pip install mvt

• Whacipher: To install run the file "C:\Forensics\bin\install_whacipher.bat" or:

pip install --upgrade -r requirements.txt

• WhatsApp-Crypt14-Crypt15-Decrypt: To install run the file "C:\Forensics\bin\WhatsApp-Crypt14-Crypt15-Decrypter-main\install-Decrypter.bat" or:

pip install -r requirements.txt

• https://www.avillaforensics.com.br/avilla/Forensics.zip
• https://1drv.ms/u/s!AuRZbqnWANDKve0XC1CWoHWgFhDNrg?e=4gzQio (Ondrive)
• https://drive.google.com/file/d/155NtMyd0hVSzovbSnmgWKGG-wYRoBSx7/view?usp=sharing (Google Drive)
• MD5: A800F47B699DF7677AD260520A052F96
• SHA1: 45E940B1C615F41080DB7C4AB9E887587D2D6FDC
• SHA256: E77DB3875E0C2936B39CE2704F186026DFD2DC371CA72F38BA0827BA15B732EF
• SHA384: F5F75B8826A445430B3F67978A97B8C21D35C8131D80396B143F3B6A0375CBA7CD1212DBF505054A915C10341242D53F
• SHA512: 955335CC58549A4E8E504B247512C02049CE1EC3F452B6901920782A46DA297A74E3934F7988361DDA5B5082C54B937AB6289482D3DF0ED74534FDB5629DEFF3

• Donate Pypal:
• Link: https://www.paypal.com/donate/?hosted_button_id=PCMBCJFU2T4CG (Fernanda Santos)

• Doação pagseguro:
• Link: https://pagseguro.uol.com.br/checkout/nc/nl/donation/sender-identification.jhtml?t=2930fa8d59164d594a4c5b9b217472d79419ae9b60896765812aa72b1c1f38f7&e=true (Daniel Hubscher Avilla)

• C#.
• Python.
• Java.

• Free Software.

• 
• https://www.linkedin.com/in/daniel-a-avilla-0987/
• [email protected]

• IPED-4.0.1: https://github.com/sepinf-inc/IPED (Requires Java).

• IPED Tools: https://github.com/thiagofuer/IPEDTools_Releases/releases (Requires Java).

• Bytecode Viewer: https://github.com/phith0n/bytecode-viewer (Requires Java).

• Jadx-1.2.0: https://github.com/skylot/jadx (Requer Java).

• Android Backup Extractor: https://github.com/nelenkov/android-backup-extractor (Requires Java).

• GPS PRUNE: https://activityworkshop.net/software/gpsprune/download.html (Requires Java).

• jExiftool GUI: https://github.com/hvdwolf/jExifToolGUI (Requires Java).

• Instaloader: https://github.com/instaloader/instaloader (Requires Python).

• MVT-1.5.3: https://github.com/mvt-project/mvt (Requer Python).

• WhatsApp-Crypt14-Crypt15-Decrypter: https://github.com/ElDavoo/WhatsApp-Crypt14-Crypt15-Decrypter (Requires Python).

• Whatsapp-media-decrypt: https://github.com/sh4dowb/whatsapp-media-decrypt (Requires Python).

• Screen Copy: https://github.com/Genymobile/scrcpy

• AFLogical OSE 1.5.2: https://github.com/nowsecure/android-forensics

• Exiftool: https://github.com/exiftool/exiftool

• Grep: https://git-scm.com/docs/git-grep

• Alias Connector: http://www.newseg.seg.br/newseg/

• SqlStudio: https://sqlitestudio.pl/

• Audio transcription: https://github.com/Uberi/speech_recognition

• Audio transcription: https://github.com/delcristianoritta/whatsapptranscriber

• Audio transcription: http://www.newseg.seg.br/newseg/