<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Mobile Device Forensics

## adb (Android Debug Bridge)

**Primary interface for Android device interaction and data extraction.**

```bash
# Device enumeration
adb devices -l
adb get-serialno

# Property retrieval
adb shell getprop ro.product.model
adb shell getprop ro.build.version.release
adb shell getprop ro.serialno

# File extraction
adb pull /sdcard/ ./local_copy/
adb pull /data/data/com.whatsapp/databases/ ./whatsapp/

# Full backup
adb backup -apk -shared -all -f backup.ab

# Package management
adb shell pm list packages -f
adb shell dumpsys package <package_name>

# Runtime state
adb shell dumpsys battery
adb shell dumpsys location
adb shell dumpsys notification
```

| Command | Description |
|---------|-------------|
| `adb devices -l` | List connected devices with transport info |
| `adb pull <remote> <local>` | Copy file/directory from device |
| `adb backup` | Create logical backup (.ab format) |
| `adb shell getprop` | Read system property |
| `adb shell pm list packages` | List installed packages |
| `adb shell dumpsys` | Dump system service state |

## libimobiledevice

**Open-source library for iOS device communication.**

```bash
# Device identification
idevice_id -l
ideviceinfo -k ProductType
ideviceinfo -k ProductVersion
ideviceinfo -k SerialNumber

# Backup
idevicebackup2 backup --full ./backup_dir/
idevicebackup2 backup --full -p ./encrypted_backup/

# Crash logs
idevicecrashreport -e ./crash_logs/

# Syslog
idevicesyslog > syslog.txt

# App installation info
ideviceinstaller -l
```

| Tool | Description |
|------|-------------|
| `idevice_id` | List connected device UDIDs |
| `ideviceinfo` | Query device properties |
| `idevicebackup2` | Create/restore iTunes-style backups |
| `idevicecrashreport` | Extract crash/panic logs |
| `idevicesyslog` | Stream real-time syslog |
| `ideviceinstaller` | List/install/uninstall apps |

## MVT — Mobile Verification Toolkit

**Amnesty International tool for detecting spyware on mobile devices.**

```bash
# Android backup check
mvt-android check-backup --output ./results/ ./backup/

# iOS backup check
mvt-ios check-backup --output ./results/ ./backup/

# iOS filesystem check
mvt-ios check-fs --output ./results/ ./fs_dump/

# With custom IOCs
mvt-ios check-backup --iocs indicators.stix2 --output ./results/ ./backup/

# Download latest IOCs
mvt-ios download-iocs
```

| Flag | Description |
|------|-------------|
| `--output` | Output directory for results |
| `--iocs` | STIX2 indicator file |
| `--list-modules` | Show available analysis modules |
| `--module` | Run specific module only |

## ALEAPP / iLEAPP

**Artifact parsers for Android and iOS extractions.**

```bash
# ALEAPP — Android
python -m aleapp -t tar -i backup.tar -o ./report/
python -m aleapp -t fs -i ./filesystem/ -o ./report/

# iLEAPP — iOS
python -m ileapp -t tar -i backup.tar -o ./report/
python -m ileapp -t fs -i ./filesystem/ -o ./report/
```

| Flag | Description |
|------|-------------|
| `-t` | Input type: `tar`, `zip`, `fs` (filesystem) |
| `-i` | Input path |
| `-o` | Output report directory |

## Andriller

```bash
# Full extraction and analysis
andriller --input ./backup/ --output ./report/

# Specific artifact types
andriller --input ./backup/ --output ./report/ --type sms
```
