# mvt-project/androidqf architecture

> Architecture diagram of the GitHub repository mvt-project/androidqf, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mvt-project/androidqf
- Repository: https://github.com/mvt-project/androidqf

## Overview

androidqf is a cross-platform Android forensic acquisition tool. A user connects and authorizes a USB-debugged device; the CLI initializes ADB, runs selected collection modules, and finalizes a ZIP acquisition archive for later analysis with MVT. The modules span device inventory, logs and diagnostics, application data, and optional sensitive or root-dependent evidence. The README documents the full capability set; where implementation excerpts were unavailable, subsystem nodes use exact module paths and only documented or indexed relationships are shown.

Main entry points: [`modules/modules.go`](https://github.com/mvt-project/androidqf/blob/main/modules/modules.go) (Module registry), [`adb/adb.go`](https://github.com/mvt-project/androidqf/blob/main/adb/adb.go) (ADB client), [`acquisition/acquisition.go`](https://github.com/mvt-project/androidqf/blob/main/acquisition/acquisition.go) (Acquisition archive), [`main.go`](https://github.com/mvt-project/androidqf/blob/main/main.go) (CLI workflow)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_orchestration["Acquisition orchestration"]
  node_cli["CLI workflow<br/>[main.go]"]
  node_registry["Module registry<br/>[modules.go]"]
end

subgraph group_device["Device access"]
  node_adb["ADB client<br/>[adb.go]"]
  node_collector["On-device collector<br/>[collector.go]"]
end

subgraph group_collection["Evidence collection"]
  node_system["System inventory<br/>[getprop.go]"]
  node_runtime["Runtime diagnostics<br/>[processes.go]"]
  node_settings["Settings and services<br/>[settings.go]"]
  node_logs["Logs and bugreports<br/>[logs.go]"]
  node_packages["Packages and APKs<br/>[packages.go]"]
  node_backup["Device backup<br/>[backup.go]"]
  node_browser["Browser history<br/>[browser_history.go]"]
  node_apex["APEX evidence<br/>[apex.go]"]
  node_intrusion["Intrusion logs<br/>[intrusion_logs.go]"]
  node_rootdata["Root-only evidence<br/>[init_scripts.go]"]
  node_filelist["Filesystem inventory<br/>[files.go]"]
  node_temp["Temporary files<br/>[temp.go]"]
  node_mounts["Mount inventory<br/>[mounts.go]"]
  node_selinux["SELinux evidence<br/>[selinux.go]"]
end

subgraph group_archive["Archive output"]
  node_archive[("Acquisition archive<br/>[acquisition.go]")]
  node_zip["Streaming ZIP writer<br/>[streaming_zip.go]"]
  node_stream["Streaming transfers"]
end

node_user(("Operator"))
node_android(("Android device"))

node_user -->|"starts"| node_cli
node_cli -->|"initializes"| node_adb
node_adb -->|"connects to"| node_android
node_cli -->|"lists modules"| node_registry
node_cli -->|"creates acquisition"| node_archive
node_cli -->|"runs selected modules"| node_registry
node_registry -->|"registers"| node_system
node_registry -->|"registers"| node_runtime
node_registry -->|"registers"| node_settings
node_registry -->|"registers"| node_logs
node_registry -->|"registers"| node_packages
node_registry -->|"registers"| node_backup
node_registry -->|"registers"| node_browser
node_registry -->|"registers"| node_apex
node_registry -->|"registers"| node_intrusion
node_registry -->|"registers"| node_rootdata
node_registry -->|"registers"| node_filelist
node_registry -->|"registers"| node_temp
node_registry -->|"registers"| node_mounts
node_registry -->|"registers"| node_selinux
node_system -->|"queries device"| node_adb
node_runtime -->|"queries device"| node_adb
node_settings -->|"queries device"| node_adb
node_logs -->|"collects from"| node_adb
node_packages -->|"inventories and pulls"| node_adb
node_backup -->|"requests backup"| node_adb
node_browser -->|"collects from"| node_adb
node_apex -->|"queries and pulls"| node_adb
node_intrusion -->|"lists and pulls"| node_adb
node_rootdata -->|"checks root and pulls"| node_adb
node_filelist -.->|"lists files"| node_collector
node_collector -->|"installs and invokes"| node_adb
node_temp -->|"collects from"| node_adb
node_mounts -->|"collects from"| node_adb
node_selinux -->|"collects from"| node_adb
node_system -.->|"writes evidence"| node_archive
node_runtime -.->|"writes evidence"| node_archive
node_settings -.->|"writes evidence"| node_archive
node_logs -.->|"writes evidence"| node_archive
node_packages -->|"streams evidence"| node_archive
node_backup -.->|"writes backup"| node_archive
node_browser -.->|"writes evidence"| node_archive
node_apex -->|"writes evidence"| node_archive
node_intrusion -.->|"writes evidence"| node_archive
node_rootdata -.->|"writes evidence"| node_archive
node_filelist -.->|"writes evidence"| node_archive
node_temp -.->|"writes evidence"| node_archive
node_mounts -.->|"writes evidence"| node_archive

click node_cli "https://github.com/mvt-project/androidqf/blob/main/main.go"
click node_registry "https://github.com/mvt-project/androidqf/blob/main/modules/modules.go"
click node_adb "https://github.com/mvt-project/androidqf/blob/main/adb/adb.go"
click node_collector "https://github.com/mvt-project/androidqf/blob/main/adb/collector.go"
click node_system "https://github.com/mvt-project/androidqf/blob/main/modules/getprop.go"
click node_runtime "https://github.com/mvt-project/androidqf/blob/main/modules/processes.go"
click node_settings "https://github.com/mvt-project/androidqf/blob/main/modules/settings.go"
click node_logs "https://github.com/mvt-project/androidqf/blob/main/modules/logs.go"
click node_packages "https://github.com/mvt-project/androidqf/blob/main/modules/packages.go"
click node_backup "https://github.com/mvt-project/androidqf/blob/main/modules/backup.go"
click node_browser "https://github.com/mvt-project/androidqf/blob/main/modules/browser_history.go"
click node_apex "https://github.com/mvt-project/androidqf/blob/main/modules/apex.go"
click node_intrusion "https://github.com/mvt-project/androidqf/blob/main/modules/intrusion_logs.go"
click node_rootdata "https://github.com/mvt-project/androidqf/blob/main/modules/init_scripts.go"
click node_filelist "https://github.com/mvt-project/androidqf/blob/main/modules/files.go"
click node_temp "https://github.com/mvt-project/androidqf/blob/main/modules/temp.go"
click node_mounts "https://github.com/mvt-project/androidqf/blob/main/modules/mounts.go"
click node_selinux "https://github.com/mvt-project/androidqf/blob/main/modules/selinux.go"
click node_archive "https://github.com/mvt-project/androidqf/blob/main/acquisition/acquisition.go"
click node_zip "https://github.com/mvt-project/androidqf/blob/main/acquisition/streaming_zip.go"
click node_stream "https://github.com/mvt-project/androidqf/blob/main/acquisition/streaming_buffer.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_registry toneBlue
class node_adb,node_collector toneAmber
class node_system,node_runtime,node_settings,node_logs,node_packages,node_backup,node_browser,node_apex,node_intrusion,node_rootdata,node_filelist,node_temp,node_mounts,node_selinux toneMint
class node_archive,node_zip,node_stream toneRose
class node_user,node_android toneIndigo
```

## Components

### Acquisition orchestration

- [CLI workflow](https://github.com/mvt-project/androidqf/blob/main/main.go): `main.go`
- [Module registry](https://github.com/mvt-project/androidqf/blob/main/modules/modules.go): `modules/modules.go`

### Device access

- [ADB client](https://github.com/mvt-project/androidqf/blob/main/adb/adb.go): `adb/adb.go`
- [On-device collector](https://github.com/mvt-project/androidqf/blob/main/adb/collector.go): `adb/collector.go`

### Evidence collection

- [System inventory](https://github.com/mvt-project/androidqf/blob/main/modules/getprop.go): `modules/getprop.go`
- [Runtime diagnostics](https://github.com/mvt-project/androidqf/blob/main/modules/processes.go): `modules/processes.go`
- [Settings and services](https://github.com/mvt-project/androidqf/blob/main/modules/settings.go): `modules/settings.go`
- [Logs and bugreports](https://github.com/mvt-project/androidqf/blob/main/modules/logs.go): `modules/logs.go`
- [Packages and APKs](https://github.com/mvt-project/androidqf/blob/main/modules/packages.go): `modules/packages.go`
- [Device backup](https://github.com/mvt-project/androidqf/blob/main/modules/backup.go): `modules/backup.go`
- [Browser history](https://github.com/mvt-project/androidqf/blob/main/modules/browser_history.go): `modules/browser_history.go`
- [APEX evidence](https://github.com/mvt-project/androidqf/blob/main/modules/apex.go): `modules/apex.go`
- [Intrusion logs](https://github.com/mvt-project/androidqf/blob/main/modules/intrusion_logs.go): `modules/intrusion_logs.go`
- [Root-only evidence](https://github.com/mvt-project/androidqf/blob/main/modules/init_scripts.go): `modules/init_scripts.go`
- [Filesystem inventory](https://github.com/mvt-project/androidqf/blob/main/modules/files.go): `modules/files.go`
- [Temporary files](https://github.com/mvt-project/androidqf/blob/main/modules/temp.go): `modules/temp.go`
- [Mount inventory](https://github.com/mvt-project/androidqf/blob/main/modules/mounts.go): `modules/mounts.go`
- [SELinux evidence](https://github.com/mvt-project/androidqf/blob/main/modules/selinux.go): `modules/selinux.go`

### Archive output

- [Acquisition archive](https://github.com/mvt-project/androidqf/blob/main/acquisition/acquisition.go): `acquisition/acquisition.go`
- [Streaming ZIP writer](https://github.com/mvt-project/androidqf/blob/main/acquisition/streaming_zip.go): `acquisition/streaming_zip.go`
- [Streaming transfers](https://github.com/mvt-project/androidqf/blob/main/acquisition/streaming_buffer.go): `acquisition/streaming_buffer.go`

### Other components

- **Operator**
- **Android device**

## Connections

- Operator → CLI workflow: starts (evidence: `README.md`)
- CLI workflow → ADB client: initializes (evidence: `main.go`)
- ADB client → Android device: connects to (evidence: `README.md`)
- CLI workflow → Module registry: lists modules (evidence: `main.go`)
- CLI workflow → Acquisition archive: creates acquisition (evidence: `main.go`)
- CLI workflow → Module registry: runs selected modules (evidence: `main.go`)
- Module registry → System inventory: registers (evidence: `modules/modules.go`)
- Module registry → Runtime diagnostics: registers (evidence: `modules/modules.go`)
- Module registry → Settings and services: registers (evidence: `modules/modules.go`)
- Module registry → Logs and bugreports: registers (evidence: `modules/modules.go`)
- Module registry → Packages and APKs: registers (evidence: `modules/modules.go`)
- Module registry → Device backup: registers (evidence: `modules/modules.go`)
- Module registry → Browser history: registers (evidence: `modules/modules.go`)
- Module registry → APEX evidence: registers (evidence: `modules/modules.go`)
- Module registry → Intrusion logs: registers (evidence: `modules/modules.go`)
- Module registry → Root-only evidence: registers (evidence: `modules/modules.go`)
- Module registry → Filesystem inventory: registers (evidence: `modules/modules.go`)
- Module registry → Temporary files: registers (evidence: `modules/modules.go`)
- Module registry → Mount inventory: registers (evidence: `modules/modules.go`)
- Module registry → SELinux evidence: registers (evidence: `modules/modules.go`)
- System inventory → ADB client: queries device
- Runtime diagnostics → ADB client: queries device
- Settings and services → ADB client: queries device
- Logs and bugreports → ADB client: collects from (evidence: `modules/logs.go`)
- Packages and APKs → ADB client: inventories and pulls (evidence: `modules/packages.go`)
- Device backup → ADB client: requests backup (evidence: `modules/backup.go`)
- Browser history → ADB client: collects from (evidence: `modules/browser_history.go`)
- APEX evidence → ADB client: queries and pulls (evidence: `modules/apex.go`)
- Intrusion logs → ADB client: lists and pulls (evidence: `modules/intrusion_logs.go`)
- Root-only evidence → ADB client: checks root and pulls (evidence: `modules/init_scripts.go`)
- Filesystem inventory → On-device collector: lists files
- On-device collector → ADB client: installs and invokes (evidence: `adb/collector.go`)
- Temporary files → ADB client: collects from (evidence: `modules/temp.go`)
- Mount inventory → ADB client: collects from (evidence: `modules/mounts.go`)
- SELinux evidence → ADB client: collects from (evidence: `modules/selinux.go`)
- System inventory → Acquisition archive: writes evidence
- Runtime diagnostics → Acquisition archive: writes evidence
- Settings and services → Acquisition archive: writes evidence
- Logs and bugreports → Acquisition archive: writes evidence
- Packages and APKs → Acquisition archive: streams evidence (evidence: `modules/packages.go`)
- Device backup → Acquisition archive: writes backup
- Browser history → Acquisition archive: writes evidence
- APEX evidence → Acquisition archive: writes evidence (evidence: `modules/apex.go`)
- Intrusion logs → Acquisition archive: writes evidence
- Root-only evidence → Acquisition archive: writes evidence
- Filesystem inventory → Acquisition archive: writes evidence
- Temporary files → Acquisition archive: writes evidence
- Mount inventory → Acquisition archive: writes evidence