Building Forensic Raptor: Android Forensics with Python and ADB

Smartphones hold some of the most detailed records of people's lives: messages, locations, photos, contacts and, increasingly, their shopping. When an investigation involves online fraud, a disputed purchase or misuse of a company device, the evidence is often sitting on a phone.

For my final-year project in the Bachelor of Engineering in Computer Network and Security at Staffordshire University, I built a tool to help with exactly that. I called it Forensic Raptor. It's a Python command-line application that acquires a full image of an Android device's storage over ADB, verifies that image with SHA-512 hashes and analyzes it for data left behind by e-commerce apps.

This article walks through what the tool does, how I designed it and what the project taught me about forensics and software.

The problem I wanted to solve

E-commerce apps store a lot of information on a device: order histories, cached product pages, account details, addresses and payment-related records. In a fraud or dispute investigation, that data can show what was bought, when and by which account.

Commercial mobile forensics suites are powerful, but they're expensive, and their inner workings aren't always transparent. I wanted to build something that would:

• Acquire a complete image of the device rather than just selected files.
• Protect evidence integrity from the moment of acquisition.
• Search specifically for e-commerce artifacts using patterns I could understand and extend.
• Produce clear, case-based reports that an investigator could use.

How Forensic Raptor works

The tool follows a simple sequence, mirroring the standard forensic process of acquisition, verification, analysis and reporting.

1. Connect over ADB

ADB, the Android Debug Bridge, is a command-line tool from Google's Android developer toolkit that lets a computer communicate with an Android device over USB. Forensic Raptor uses ADB to detect the connected device, confirm the connection and gather basic information.

ADB requires USB debugging to be enabled on the device, and acquiring a full storage image generally requires elevated privileges on the device. That's an important constraint, and it's why real-world mobile forensics often involves specialized techniques and legal authority. For the project, I worked with test devices I controlled.

2. Acquire a full image

Rather than copying individual files, Forensic Raptor extracts a bit-for-bit image of the device's non-volatile memory, its storage partitions. A full image captures not only current files but also data that might be in unallocated space, such as remnants of deleted records.

The image is written to the investigator's machine, never back to the device. Writing to evidence is one of the fundamental mistakes forensic practitioners avoid.

3. Verify with SHA-512

As soon as the image is acquired, the tool calculates its SHA-512 hash and records it in the case file. Before every analysis run, it recalculates and compares the hash to confirm the image hasn't changed. If the values don't match, the tool stops.

This is the foundation of evidence integrity. A hash acts as a fingerprint for the data. If even a single bit changes, the hash changes completely, so a matching hash proves the analyzed evidence is identical to what was collected.

4. Analyze with custom regex patterns

The heart of the analysis is pattern matching. I wrote a set of regular expressions designed to find artifacts typical of e-commerce apps: order identifiers, product and transaction-related strings, addresses, email addresses and other structured data.

Regular expressions are well suited to this because e-commerce data tends to follow recognizable formats. They also make the tool transparent and extendable. An investigator can read exactly what's being searched for and add new patterns for different apps.

5. Extract device information

Alongside the e-commerce search, the tool extracts supporting information that helps an investigator understand the device and its context:

• Device properties, such as model, manufacturer and Android version.
• The contact list.
• Battery health information, which can help characterize the device's condition and usage.

6. Generate a case-based report

Finally, Forensic Raptor produces a report organized by case. It records the case details, the device information, the acquisition time, the SHA-512 hash and the findings from the analysis, so the investigator has a structured record of what was done and what was found.

Performance

I tested the tool on Kali Linux, a distribution widely used for security testing and forensics. In testing, Forensic Raptor processed a 29 GB device image in about 45 minutes, covering hashing and pattern-based analysis.

Hashing and scanning a large image are both input-heavy tasks, because every byte must be read. I learned a lot about working with large files in Python efficiently: reading in chunks rather than loading everything into memory, and avoiding repeated passes over the data where possible.

What the project taught me

Integrity has to be designed in from the start. I initially thought of hashing as one feature among many. I quickly realized it's the backbone of the entire process. If evidence integrity isn't guaranteed from acquisition onward, nothing found later can be fully trusted.

Never modify the evidence. Every design decision, from writing the image to the investigator's machine to analyzing copies, came back to this principle.

Documentation is part of the output. A forensic tool isn't just about finding data. It's about recording how the data was found, so another investigator can repeat the process and reach the same result. The case report was as important as the analysis itself.

Patterns produce false positives. Regular expressions find things that look like what you're searching for, which sometimes includes things that aren't. Tuning patterns and reviewing results carefully taught me why human judgment remains essential in forensics, and why analysts in security operations spend so much time on alert tuning.

Scope and authorization matter. Mobile devices contain deeply personal information. Forensic work must be carried out with proper legal authority, within a defined scope and with careful handling of everything found, including information unrelated to the investigation.

Building a tool teaches you the subject. To automate a process, you have to understand every step of it. Writing Forensic Raptor taught me more about Android storage, ADB and forensic methodology than reading about them ever could.

Tips for anyone writing security tools in Python

Python is a great language for security tooling: it's readable, has excellent libraries and runs almost everywhere. A few practices made the biggest difference for me.

• Use the standard library where you can. Python's hashlib handles SHA-512 and other algorithms, re handles regular expressions, subprocess runs external tools like ADB and argparse builds clean command-line interfaces. Fewer dependencies means fewer things to break and fewer supply-chain risks.
• Stream large files. Read big images in fixed-size chunks and update the hash incrementally. Loading a multi-gigabyte file into memory at once will either fail or slow everything to a crawl.
• Log everything the tool does. Timestamps, commands run, files read and results produced. A forensic tool's log is part of the evidence trail.
• Fail loudly. If a hash doesn't match or a command returns an error, stop and say so clearly. Silent failures are dangerous in forensics.
• Separate configuration from code. Keeping search patterns in their own files makes the tool easier to extend and review.
• Test against known data. Build small sample images with known contents, so you can prove the tool finds exactly what it should.

What I'd improve today

Looking back with more experience, there are several things I'd add or change:

• Support for more apps through a plugin-style pattern library, so new e-commerce apps can be added without changing the core code.
• Parsing of app databases. Many apps store data in SQLite databases. Parsing them directly would produce more structured and reliable results than pattern searches alone.
• Multiple hash algorithms, recording SHA-256 alongside SHA-512 to match common forensic practice.
• Better handling of modern device encryption, which makes full-image acquisition and analysis more complex on current Android versions.
• An automated test suite using sample images, to verify that each new pattern finds what it should and nothing it shouldn't.

How this connects to my work today

Forensic Raptor sits at the intersection of the things I care about most in security: careful handling of evidence, clear documentation and practical tools. The same principles apply far beyond mobile forensics. Incident responders preserve logs and disk images the same way. Security analysts tune detection rules to balance catching threats with avoiding false alarms. And everyone in security benefits from being able to automate repetitive work with a bit of Python.

If you're a student choosing a final project, my advice is to build something. A working tool, even a modest one, teaches you more and gives you far more to discuss in interviews than a purely theoretical report.

If you've built a security tool of your own, what problem did it solve, and what did building it teach you?