RAGBAZartifact acquisition
Read-only collection of live forensic artifacts from a running, authorized Android device — in developer mode, with root, or via run-as on your own debuggable test apps.
Every technique here is for devices you own or are explicitly authorized to examine. The toolchain is read-only: it never writes, flashes, unlocks, or roots a device. Acquisition assumes access you already hold on your own lab hardware. Handle all evidence as case material.
access modes
What you can read depends on the access you already hold on your own device. The collector detects the mode and skips what it cannot reach, telling you why.
developer mode (adb)
USB debugging enabled. Reads logs, dumpsys state, package inventory, settings, network state, and can pull third-party APKs. No private app storage.
run-as (debuggable apps)
For apps flagged debuggable — which your own planted test apps are — run-as reads that app's private data without root. Perfect for labs.
root (su)
On a device you own and have rooted, su reads any partition and any app's private data. This is the deepest live tier; the boot chain itself is imaged separately (see Lab 4).
the collector
acquire_artifacts.sh bundles the whole live set into a timestamped, hashed evidence tree. It is read-only and authorization-gated; PII providers and the full bugreport are opt-in flags.
$ chmod +x acquire_artifacts.sh $ ./acquire_artifacts.sh // standard artifacts $ ./acquire_artifacts.sh --include-pii // also query sms/call log (PII) $ ./acquire_artifacts.sh --bugreport // also full bugreport (slow)
Content-provider artifacts (SMS/MMS/call log/contacts/calendar) contain personal data of the owner and their contacts. They are opt-in for a reason. Acquire them only with authorization, and store them as case material.
artifact map
| artifact | contents | needs |
|---|---|---|
| system logs | logcat (main/system/events/crash/radio), dmesg (root). | dev mode |
| dumpsys state | package, activity, accessibility, device_policy, appops, netstats, usagestats, connectivity, wifi, batterystats, account. | dev mode |
| packages + APKs | full inventory plus a pulled APK per third-party app for offline static analysis. | dev mode |
| settings | secure / global / system namespaces. | dev mode |
| network | interfaces, live sockets, ARP cache, proxy, VPN; Wi-Fi config store (root). | dev mode / root |
| app-private data | per-app /data/data tarball via su, or via run-as for debuggable apps you own. | root / run-as |
| root artifacts | packages.xml, packages.list, user-added CA certs. | root |
| content providers | sms, mms, call_log, contacts, calendar. PII — opt-in only. | dev mode + consent |