# FAMA | Forensic Analysis For Mobile Apps

**URL:** <https://onehack.st/t/fama-forensic-analysis-for-mobile-apps/164074>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, phone\
**Created:** [November 27, 2020, 11:19am UTC](https://onehack.st/t/fama-forensic-analysis-for-mobile-apps/164074 "2020-11-27T11:19:06Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [November 27, 2020, 11:19am UTC](https://onehack.st/t/fama-forensic-analysis-for-mobile-apps/164074/1 "2020-11-27T11:19:06Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/f/b/fb0bb67331e9c3babe6f4be24ea916abbd4743cd.png)

**LabCIF – Forensic Analysis for Mobile Apps**

**Getting Started**

Android extraction and analysis framework with an integrated Autopsy Module. Dump easily user data from a device and generate powerful reports for Autopsy or external applications.

**Functionalities**

- Extract user application data from an Android device with ADB (root and ADB required).
- Dump user data from an android image or mounted path.
- Easily build modules for a specific Android application.
- Generate clean and readable JSON reports.
- Complete integrated Autopsy compatibility (datasource processor module, ingest module, report module, geolocation, communication and timeline support).
- Export HTML report based on the current case.

**Report Screenshots**

 ![image](https://onehack.st/uploads/default/original/3X/6/7/67bcb02a5f61f977475777ce6d917eccdd6ee7df.png)

 ![image](https://onehack.st/uploads/default/original/3X/f/b/fb0bb67331e9c3babe6f4be24ea916abbd4743cd.png)

**Prerequisites**

- [Python](https://www.python.org/downloads/) (2.7+)
- [Autopsy](https://www.sleuthkit.org/autopsy/) (optional)

**How to use**

The script can be used directly in terminal or as Autopsy module.

**Running from Terminal**

```auto
usage: start.py [-h] [-d DUMP [DUMP ...]] [-p PATH] [-o OUTPUT] [-a] appForensics Artefacts Analyzerpositional arguments: app Application or package to be analyzed <tiktok> or <com.zhiliaoapp.musically>optional arguments: -h, --help show this help message and exit -d DUMP [DUMP ...], --dump DUMP [DUMP ...] Analyze specific(s) dump(s) <20200307_215555 ...> -p PATH, --path PATH Dump app data in path (mount or folder structure) -o OUTPUT, --output OUTPUT Report output path folder -a, --adb Dump app data directly from device with ADB -H, --html Generate HTML report

```

**Running from Autopsy**

1. Download repository contents ([zip](https://github.com/labcif/FAMA/archive/master.zip)).
2. Open Autopsy → Tools → Python Plugins
3. Unzip previously downloaded zip in `python_modules` folder.
4. Restart Autopsy, create a case and select the module.
5. Select your module options in the Ingest Module window selector.
6. Click “Generate Report” to generate an HTML report of the case.

**Build an application module**

Do you need a forensics module for a specific Android application? Follow the instructions [here](https://github.com/labcif/FAMA/blob/master/modules/README.md) and build a module by yourself.

**Authors**

- **José Francisco** – [GitHub](https://github.com/98jfran)
- **Ruben Nogueira** – [GitHub](https://github.com/rubnogueira)

**Mentors**

- **Miguel Frade** – [GitHub](https://github.com/mfrade)
- **Patrício Domingues** – [GitHub](https://github.com/PatricioDomingues)

Project developed as final project for Computer Engineering course in Escola Superior de Tecnologia e Gestão de Leiria.

**Environments Tested**

- Windows (primary)
- Linux
- Mac OS

**License**

This project is licensed under the terms of the GNU GPL v3 License.

- [ADB](https://developer.android.com/studio/releases/platform-tools) – Android Software Development Kit License Agreement
- [Base64](http://rtner.de/software/base64.html) – GNU GPL v2 License
- [Bootstrap](https://getbootstrap.com/) – MIT License
- [feather](https://github.com/feathericons/feather) – MIT License
- [Freepic Icons](https://www.flaticon.com/packs/user-interface-111)
- [jQuery](https://jquery.com/) – MIT License
- [jQuery.lazy](https://github.com/eisbehr-/jquery.lazy) – MIT License
- [leaflet](https://github.com/Leaflet/Leaflet) – BSD 2-Clause “Simplified” License
- [pdfmake](https://github.com/bpampuch/pdfmake) – MIT License
- [SQLite-Deleted-Records-Parser](https://github.com/mdegrazia/SQLite-Deleted-Records-Parser) – GNU GPL v3 License
- [Undark](https://github.com/witwall/undark) – BSD License 2.0

## GitHub:

> **[GitHub - labcif/FAMA: Forensic Analysis for Mobile Apps (FAMA) -- module...](https://github.com/labcif/FAMA)**
>
> Forensic Analysis for Mobile Apps (FAMA) -- module for the Autopsy Forensic Browser