botherder/androidqf: androidqf (Android Quick Forensics) helps quickly gathering forensic evidence from Android devices, in order to identify potential traces of compromise.
A command-line tool for rapidly pulling forensic artifacts from Android devices: logs, installed packages, file metadata, process state, and other indicators useful for spotting compromise or suspicious activity. Designed for incident responders and mobile forensicators who need to triage a device quickly without a full acquisition. Lighter-weight than full imaging but more targeted than manual inspection.