Home

APEX

Android phone investigation and app security analysis, in one self-contained binary.

APEX collects a phone's state over USB, without root, into a hashed case directory, in under a minute with --quick. A small agent app is installed for a few seconds to read what ADB cannot, then removed, and every change it makes is recorded. It finds stalkerware and spyware, rebuilds install / uninstall and traffic history, lists the identifiers needed for legal requests, and, under a legal mandate, extracts communications, with deleted records recovered where the databases allow it. It writes a timeline, an HTML report and a French procès-verbal, and every case can be re-verified and timestamped.

APEX does not bypass a lock screen, does not root the phone and does not exploit anything. The reference scenario is a search where the phone is unlocked by its owner's code. For a locked, broken or switched-off phone, a lab tool makes a full file-system extraction under legal authority, and apex import reads it.

---

Start here

If you need to…	Read
Install APEX	Installation
Get a phone talking to APEX	Connecting a phone
Run an examination during a search, step by step	Field procedure
Check what each command needs before running it	Prerequisites
Fix a connection or command error	Troubleshooting

The commands

Command	What it does	Needs a phone
device listen	Wait for a phone, print the serials of the connected ones	yes
device list	List the third-party apps installed	yes
device posture	The phone's own security posture (boot, root signs, encryption, admins…)	yes
device scan	Pull and analyze every third-party app	yes
device dump	Pull the third-party APKs only	yes
device shell	Run one raw shell command (debugging)	yes
device acquire	Forensic acquisition into a case directory, triage mode, mandate mode	yes
device capture	Capture the conversation on screen: text of every screen, screenshots, transcript (under mandate)	yes
import	Turn a lab's full file-system extraction into an APEX case	no
db	One SQLite database with everything in a case, for SQL queries	no
link	What several exhibits have in common: numbers, accounts, wallets, Wi-Fi, apps	no
analyze	Findings on a case or any directory of packages; STIX2 and hash sets	no
identifiers	IMEI, IMSI, ICCID, line, MACs, accounts, operators to request	no
comms	Export communications collected under mandate (SQLite, CSV, JSON, KML), decrypt WhatsApp and Signal backups	no
media	Hash, EXIF / GPS, hash-set matching of shared storage	no
search	Keyword / regex search over a whole case, entity extraction	no
timeline	One chronological CSV / JSONL (Timesketch)	no
diff	What changed between two acquisitions of the same phone	no
report	Self-contained HTML case report	no
pv	French procès-verbal de constatations, one or several exhibits	no
seal	RFC 3161 trusted timestamp of a case (network)	no
verify	Re-hash a case and check its integrity and timestamp	no
scan	Static security analysis of one .apk / .aab / .xapk / .ipa	no

Key concepts

• Case directory: what an acquisition or import writes, file by file.
• APEX agent: the small app installed for the acquisition, what it reads, and per-maker prerequisites.
• Evidence and integrity: audit log, manifest, verify, RFC 3161.
• Legal scope: what is collected by default, what needs --mandate, what is never collected.
• Communications and app data: every source, live and from an extraction, and the keys they need.
• Deleted records: how SQLite write-ahead logs and free pages are carved.
• Findings: every finding ID and what it means, cyber findings included.
• Rules file: extend the built-in lists (phishing brands, vault apps, signatures…) with your own.
• Indicators and hash sets: STIX2, Project VIC / CAID, NSRL.
• Accuracy and limits: what a finding proves and what it does not.

APEX makes no network call except seal, which sends only a SHA-256.