RAGBAZstudent instructions
How to run the toolchain, work an investigation, and write a report that a peer could act on. Read this once before Lab 1.
Every technique here is for devices you own or are explicitly authorized to examine. The toolchain is read-only: it never writes, flashes, unlocks, or roots a device. Acquisition assumes access you already hold on your own lab hardware. Handle all evidence as case material.
what you need
- A throwaway Android device or emulator you may reset freely — never your primary phone for the "infected" role.
- A workstation with Android platform-tools (
adb, andfastbootfor Lab 4). - The three tools, downloadable from any lab page.
- Python 3.8+ for the TUI. Everything else is bash.
ground rules
- Examine only what you own or are authorized to examine. Every tool makes you acknowledge this.
- Read-only always. The tools never write to the device — and neither do you.
- Analyze offline. Never trust the subject device to report honestly on itself.
- Treat evidence as case material: hash it, keep it, handle PII with care.
the loop you will run every time
Preserve → triage → acquire → analyze → report. It is the same five phases in every lab; the methodology page is the reference. Internalize it — the capstone expects it from memory.
running the tools
$ chmod +x apts.sh && ./apts.sh$ python3 apts_tui.py$ chmod +x acquire_artifacts.sh && ./acquire_artifacts.shEach tool writes a timestamped evidence directory with a SHA256SUMS manifest. Keep the whole directory — your report cites files inside it.
writing the report
The report is what you are graded on — not whether the tool ran. Every finding needs an evidence citation (file and line). Every assessment needs a stated confidence level. State plainly what your triage could not see.
Structure: authorization & preservation decision · findings with citations · a fused timeline · confidence level · remediation matched to severity · limits.
Correlation beats a lucky hit. One dangerous permission is normal; accessibility + overlay + sideload + a fresh install on the same package is a story. Show the story.