Andriller CE 3.6

Andriller CE (Community Edition) is a compact digital forensics toolkit for Android devices, developed by Denis Sazonov. It streamlines the acquisition and analysis of user data from smartphones and tablets, turning raw artifacts into clear, readable reports suitable for casework and documentation.

Designed for common Android investigation tasks, Andriller CE supports logical acquisition via ADB and, when available, targeted file system pulls on rooted devices. It parses a wide range of artifacts—such as call logs, SMS/MMS, contacts, browser history, Wi‑Fi profiles, media metadata, and selected messaging app data—and can decode Android lock patterns from the gesture.key file when that artifact is provided. The tool also converts Android backups into accessible formats and includes parsers to reduce manual database work.

Andriller CE runs on Windows, Linux, and macOS. It generates consolidated reports (e.g., HTML, CSV, XLSX) that are easy to review and share, making it useful for triage, DFIR, and lab workflows. The Community Edition focuses on core features; additional or advanced capabilities may be available in other editions.

Key highlights:

• Logical acquisition via ADB; backup creation and analysis
• Optional file system pulls on rooted devices (where permitted)
• Parsers for calls, messages, contacts, browser history, Wi‑Fi, media metadata, and select third-party apps
• Lock pattern decoding from gesture.key (when available)
• Consolidated reporting to HTML/CSV/XLSX
• Cross-platform support (Windows, Linux, macOS)
• Practical for triage and case documentation

Andriller CE is developed by Denis Sazonov. The most popular versions of this product among our users are: 3.3, 3.4, 3.5 and 3.6. The name of the program executable file is andriller.exe.