Android Analysis Quickstart

Enable USB Debugging

Tools you need to get started: the basics

Android File Transfer


./adb devices
./adb devices -l
./adb shell getprop pull /system/app/. phone1-apps
adb root (restarts adbd with root permissions)
adb start-server (starts the adb server)
adb kill-server (kills the adb server)
adb reboot (reboots the device)
adb devices -l (list of devices by product/model)
adb shell (starts the backround terminal)
exit (exits the background terminal)
adb help (list all commands)
adb -s <deviceName> <command> (redirect command to specific device)
adb –d <command> (directs command to only attached USB device)
adb –e <command> (directs command to only attached emulator)
adb pull <remote> <local> (copy file/dir from device)


% fastboot devices
% fastboot getvar version
version: 0.5
Finished. Total time: 0.001s
% fastboot getvar version-bootloader
% fastboot getvar version-baseband
% fastboot getvar serialno
% fastboot getvar product

MVT + Dependencies

mvt-android check-backup --iocs ~/iocs/malware.stix2 /path/to/android/backup/
export MVT_STIX2="/home/user/IOC1.stix2:/home/user/IOC2.stix2"



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store