Joshua Hickman has created, for the DFIR community, an image of Android 7.x (Nougat) populated with apps and test data for a wide range of usage – everything from testing tools to training to teaching. It was created using a stock Android image from Google. Several popular applications (apps) were populated with user data utilizing the capabilities of each individual app. The stock Android apps were also populated with user data.
An LG Nexus 5x, model LG-H790 w/32GB of storage and 2GB of memory was used as the device of testing choice. Version of Nougat (7.1.2), Build N2G470, Patch Level 5/5/2017 was leveraged for the population of testing data and the installation of apps.
Takeout data was available for Facebook Messenger, Google, Instagram, Snapchat, Twitter, and WhatsApp.
Our AboutDFIR.com Research page holds the completed status with a link to the images, the documentation, and the list of hashes for verification purposes.
