<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Mobile Forensics

## ADB (Android Debug Bridge)

```bash
adb devices -l                     # List connected devices
adb backup -apk -shared -all -f backup.ab  # Full backup
adb pull /data/data/<pkg>/databases/<db>    # Extract database
adb shell ls -la /data/data/       # List app directories
adb shell dumpsys battery          # Device state
adb shell getprop ro.product.model # Device model
adb shell screencap -p /sdcard/s.png  # Screenshot
adb bugreport > bugreport.zip      # System diagnostics
```

## libimobiledevice (iOS)

```bash
idevice_id -l                      # List device UDIDs
ideviceinfo                        # Device information
idevicebackup2 backup --full ./backup/  # Create backup
idevicecrashreport ./crashes/      # Pull crash logs
idevicesyslog                      # Live system log
```

## ALEAPP (Android)

```bash
aleapp -t tar -i extraction.tar -o ./output/
aleapp -t directory -i /extracted/ -o ./output/
aleapp -t zip -i extraction.zip -o ./output/
```

**Key modules:** SMS/MMS, call logs, contacts, WiFi, Bluetooth, location,
installed apps, Chrome history, WhatsApp, Telegram, Signal, notifications.

## iLEAPP (iOS)

```bash
ileapp -t tar -i backup.tar -o ./output/
ileapp -t directory -i /backup/ -o ./output/
ileapp -t zip -i backup.zip -o ./output/
```

**Key modules:** iMessage, call history, contacts, Safari, photos,
location services, health data, screen time, WiFi, Bluetooth.

## Android SQLite Databases

| Database | Package | Contents |
|----------|---------|----------|
| `mmssms.db` | `com.android.providers.telephony` | SMS/MMS |
| `contacts2.db` | `com.android.providers.contacts` | Contacts |
| `calendar.db` | `com.android.providers.calendar` | Calendar |
| `external.db` | `com.android.providers.media` | Media metadata |
| `telephony.db` | `com.android.providers.telephony` | Call logs |

## iOS Backup Databases

| Database | Domain | Contents |
|----------|--------|----------|
| `sms.db` | HomeDomain | iMessage/SMS |
| `AddressBook.sqlitedb` | AddressBookDomain | Contacts |
| `CallHistory.storedata` | HomeDomain | Call logs |
| `History.db` | HomeDomain | Safari history |
| `consolidated.db` | RootDomain | Location cache |
| `Manifest.db` | (root) | Backup file index |

## iOS Backup File Hash Mapping

```python
# iOS backup files are stored as SHA1(domain + "-" + relativePath)
import hashlib
def backup_file_hash(domain: str, path: str) -> str:
    return hashlib.sha1(f"{domain}-{path}".encode()).hexdigest()

# Example: SMS database
backup_file_hash("HomeDomain", "Library/SMS/sms.db")
# → 3d0d7e5fb2ce288813306e4d4636395e047a3d28
```
