# Android Connections Forensics
This software enables a forensic investigator to map each connection to its originating process.
It doesn't require root privliges on the system, but do require adb & USB debugging.
# Supported OS
ACF works currently only on Linux (Ubuntu 14.04)
# Installation
git clone https://github.com/CyberHatcoil/ACF.git
cd ACF
pip install -r requirments.txt
# Usage
Make sure you device is connected, usb debugging is enabled and authorized.
adb devices
To run Acf:
python acf.py -d [Device serial number]
Filter by process name match:
python acf.py -d [Device serial number] -f facebook
Filter by process owner:
python acf.py -d [Device serial number] -u user
python acf.py -d [Device serial number] -u system
python acf.py -d [Device serial number] -u root
# Output
ACF create 3 different output types:
1. console output - live connections
2. acm-log file - live connections
3. metadata file - external IP's metadata results
acm-log example:
#Metadata Plugins
Acf extract metadata to every external IP address.
Current Plugins:
1. IP Info - geolocation, provider etc..
2. IP Rep - alienvault ip blacklist database.
3. VirusTotal - virustotal ip lookup.
4. Whois
# Contact Us
Itayk [ [ AT ] ]CyberHat.co.il
