mvt-project/androidqf

How mvt-project/androidqf works

androidqf is a cross-platform Android forensic acquisition tool. A user connects and authorizes a USB-debugged device; the CLI initializes ADB, runs selected collection modules, and finalizes a ZIP acquisition archive for later analysis with MVT. The modules span device inventory, logs and diagnostics, application data, and optional sensitive or root-dependent evidence. The README documents the full capability set; where implementation excerpts were unavailable, subsystem nodes use exact module paths and only documented or indexed relationships are shown.

Main entry points: modules.go Module registry · adb.go ADB client · acquisition.go Acquisition archive · main.go CLI workflow

Components 23

Acquisition orchestration

CLI workflow main.go
Module registry modules/modules.go

Device access

ADB client adb/adb.go
On-device collector adb/collector.go

Evidence collection

System inventory modules/getprop.go
Runtime diagnostics modules/processes.go
Settings and services modules/settings.go
Logs and bugreports modules/logs.go
Packages and APKs modules/packages.go
Device backup modules/backup.go
Browser history modules/browser_history.go
APEX evidence modules/apex.go
Intrusion logs modules/intrusion_logs.go
Root-only evidence modules/init_scripts.go
Filesystem inventory modules/files.go
Temporary files modules/temp.go
Mount inventory modules/mounts.go
SELinux evidence modules/selinux.go

Archive output

Acquisition archive acquisition/acquisition.go
Streaming ZIP writer acquisition/streaming_zip.go
Streaming transfers acquisition/streaming_buffer.go

Other components

Operator
Android device

Connections 48

Operator → CLI workflow: starts README.md
CLI workflow → ADB client: initializes main.go
ADB client → Android device: connects to README.md
CLI workflow → Module registry: lists modules main.go
CLI workflow → Acquisition archive: creates acquisition main.go
CLI workflow → Module registry: runs selected modules main.go
Module registry → System inventory: registers modules/modules.go
Module registry → Runtime diagnostics: registers modules/modules.go
Module registry → Settings and services: registers modules/modules.go
Module registry → Logs and bugreports: registers modules/modules.go
Module registry → Packages and APKs: registers modules/modules.go
Module registry → Device backup: registers modules/modules.go
Module registry → Browser history: registers modules/modules.go
Module registry → APEX evidence: registers modules/modules.go
Module registry → Intrusion logs: registers modules/modules.go
Module registry → Root-only evidence: registers modules/modules.go
Module registry → Filesystem inventory: registers modules/modules.go
Module registry → Temporary files: registers modules/modules.go
Module registry → Mount inventory: registers modules/modules.go
Module registry → SELinux evidence: registers modules/modules.go
System inventory → ADB client: queries device
Runtime diagnostics → ADB client: queries device
Settings and services → ADB client: queries device
Logs and bugreports → ADB client: collects from modules/logs.go
Packages and APKs → ADB client: inventories and pulls modules/packages.go
Device backup → ADB client: requests backup modules/backup.go
Browser history → ADB client: collects from modules/browser_history.go
APEX evidence → ADB client: queries and pulls modules/apex.go
Intrusion logs → ADB client: lists and pulls modules/intrusion_logs.go
Root-only evidence → ADB client: checks root and pulls modules/init_scripts.go
Filesystem inventory → On-device collector: lists files
On-device collector → ADB client: installs and invokes adb/collector.go
Temporary files → ADB client: collects from modules/temp.go
Mount inventory → ADB client: collects from modules/mounts.go
SELinux evidence → ADB client: collects from modules/selinux.go
System inventory → Acquisition archive: writes evidence
Runtime diagnostics → Acquisition archive: writes evidence
Settings and services → Acquisition archive: writes evidence
Logs and bugreports → Acquisition archive: writes evidence
Packages and APKs → Acquisition archive: streams evidence modules/packages.go
Device backup → Acquisition archive: writes backup
Browser history → Acquisition archive: writes evidence
APEX evidence → Acquisition archive: writes evidence modules/apex.go
Intrusion logs → Acquisition archive: writes evidence
Root-only evidence → Acquisition archive: writes evidence
Filesystem inventory → Acquisition archive: writes evidence
Temporary files → Acquisition archive: writes evidence
Mount inventory → Acquisition archive: writes evidence

Drawn by GitDiagram on November 11, 2026 from the repository's file tree, README and source files. Read as Markdown ·