Android Analysis StudioConnected-device learning laboratory
Teaching edition 1.0NOT CONNECTED
Observe. Interpret. Document.

Meet the device.
Understand the evidence.

Connect an authorized Android phone, explore what ADB can actually show, and learn to support every conclusion with a recorded observation.

Real USB connectionNon-root, read-oriented tools6 guided labsOffline practice mode
ANDROID
Authorize on phone
WebUSB + ADB
Browser-local analysis
REPORT
Record your findings
No root, lock bypass, physical imaging, cloud analysis or device-data upload feature.

Choose your learning environment

Start without hardware, or connect an authorized device using a USB data cable.

This is a selective live logical-analysis teaching tool, not a full forensic acquisition or malware detector. It does not unlock phones, root devices, recover deleted data, or access protected private app databases.
Real device

Connect an Android phone

Desktop Chrome or Edge, a suitable secure context, USB debugging and on-phone authorization are required. No installed ADB executable is used by the browser transport.

The standard edition loads pinned Tango ADB JavaScript from esm.sh only after you click Load USB engine. A temporary authentication key stays in page memory. No collection runs automatically.

No phone required

Practice with synthetic evidence

Use fictional devices and harmless sample files to learn the same workflow. Practice works offline and never opens USB or loads the USB engine.

Every practice result and export is labeled SYNTHETIC PRACTICE. Profiles are fictional teaching datasets, not tested descriptions of specific commercial phones.

First connection: a guided checklist

  1. Use a spare training phone. Record the authorized scope and any preparation in .
  2. Enable Developer options, then USB debugging. Usually you expose Developer options by tapping Build number seven times; manufacturer menus vary.
  3. Unlock the phone and connect a data-capable USB cable. Close other ADB clients. If the computer's ADB server owns the interface, use adb kill-server on the computer.
  4. Check the authorization box above. Load the USB engine, click Connect Android and select the phone in the browser chooser.
  5. Approve the phone's USB-debugging prompt for the connection you initiated. Avoid permanent trust on a shared workstation.
  6. Open Device overview and choose Collect baseline. No personal logs or shared files are collected by the baseline.

Setup references: Android ADB documentation and Tango USB transport.

Opening this page locally or hosting it on a website

For real USB access, use HTTPS or a local server on localhost. Do not rely on an LMS preview, iframe or a remote plain-HTTP address. Practice lessons also work by opening the HTML file directly.

The package includes a Python launcher. Run python serve_local.py (or py serve_local.py on Windows), then open the displayed local address in Chrome or Edge. The launcher serves static files on the loopback interface only; it is not an ADB bridge and receives no device results.

For your website, upload this HTML to an HTTPS location and open it as a top-level page. A restrictive Permissions-Policy, a sandboxed frame, managed-browser policy or disabled USB permissions can still prevent access. A suggested header is Permissions-Policy: usb=(self).

The standard live engine requires internet access to esm.sh. An optional build script in the package can embed the pinned dependencies to make a separate offline-capable live edition; Node.js and internet access are required only for that build.

Device overview

Reported configuration with source commands and cautious interpretation.

Identity & build

Security-related observations

Interpretation notes

Collect a baseline to generate observations. This page deliberately does not issue a malware verdict or a security score.

Battery & storage

Not collected.
Not collected.

Time & session privileges

Not collected.

Capture timestamps use the workstation clock. Device time may differ. The shell identity describes the current session, not the absence of rooting elsewhere.

Primary references: Verified Boot states, file-based encryption and security bulletins.

Applications & installed code

Inventory shell-visible packages, inspect metadata and locate accessible APK files.

Third-party does not mean malicious or sideloaded. Requested permissions, granted permissions and actual use are different facts. Work profiles and vendor restrictions can limit coverage.
No inventory collected.Permission-aware, not root
PackageClassificationInspect
Collect an inventory to begin.

Package detail

Select Inspect in the inventory. Raw output remains available because Android and OEM output formats vary.

No package selected.

An APK copy contains installed code, not the application's private data. Split packages may require several APKs for a complete installed-code set. A successful copy is not a signature or malware analysis.

Accessible files & integrity

Selective copies, explicit scope and SHA-256 of the bytes received.

Shared storage may contain personal information. Only browse instructor-approved directories. This page does not traverse protected app-data areas, follow symlink entries, or write files to the phone.
Current path

/sdcard/Download

NameSizeModified (UTC)Action
Choose a directory and list its entries.

64 MiB maximum per copied file. Metadata is device-reported and may change during collection. Downloads use browser memory; keep files small on classroom machines.

Verify a local file

Recalculate a downloaded file's digest in your browser. The file is not uploaded. For the guided hash exercise, compare the original copy with an edited duplicate.

No local file selected.

Acquisition manifest

No files copied in this session.

Guided command lab

Learn the underlying commands without an unrestricted shell.

Only documented, read-oriented commands are accepted. Chaining, pipes, redirection, writes, installation, removal, root and bootloader operations are rejected. This is a teaching guardrail, not a sandbox against someone who edits the page source.

ADB COMMAND WORKSPACE

Android Analysis Studio
Type help for allowed commands.
No commands have been sent.
What is allowed, and why are other commands rejected?
The page accepts the optional adb shell prefix and validates the remaining command before execution. Basic single-property getprop queries are permitted; arbitrary shell syntax is not. Package identifiers must match an inventory result before package-specific commands run.
Read-oriented does not mean forensically non-invasive: ADB authorization, process execution and the running phone generate state changes. Use proper validated procedures for actual evidence.
Understand diagnostic limits
A log snapshot is only what the device allows the shell to read at that time. Buffers rotate; entries may be absent or restricted. Threadtime formatting may omit year and timezone. A crash is not proof of malware, and an empty buffer is not proof that nothing occurred.
Google Logcat reference · Google dumpsys reference


Learn by examining
Six scenarios with rationale, novice steps, observations and reflection questions.
Worksheets and completion checkboxes are self-reported and stored only in this page's memory. They are included in report exports, not sent to a learning-management system.
Knowledge check
Six questions with explanations. This is practice, not a proctored assessment.


Report & examination notes
Capture provenance, preserve raw observations and describe what the data cannot establish.
Export this session
Exports preserve the original live/practice label, command output, errors, timestamps, file hashes and your worksheets. Copied file bytes are separate downloads, not embedded in the report. No automatic device-data upload is implemented.
A hash is an integrity aid, not a digital signature, independent timestamp or complete chain of custody. This tool has not been validated for evidentiary acquisition.
Collection record
0 records
No commands or directory listings recorded yet.


Help, concepts & primary sources
Use vendor documentation to verify behavior and explain unexpected results.
Troubleshooting connection and collection


The browser says WebUSB is unavailable
Use desktop Chrome or Edge with USB access enabled by policy. Firefox and Safari do not provide this direct WebUSB route. Open the page over HTTPS or localhost, outside an embedded LMS preview. Practice mode still works.


The phone is missing from the chooser
Use a data-capable cable and try a direct USB port. Unlock the phone, enable USB debugging and check that the ADB USB interface is exposed. On Windows, consult the manufacturer's official USB driver guidance. Do not blindly replace unrelated USB drivers. Enterprise management can prohibit debugging.


Unable to claim the interface / device is already in use
Close Android Studio, another WebADB tab and other device tools. If native ADB is running, execute adb kill-server in the computer's terminal, then reconnect. On Linux, check the authorized user's USB/udev permissions using Google's device-setup documentation. Do not run the entire browser as root.


Authentication waits or times out
Look for the USB-debugging authorization dialog on the unlocked phone. Approve only the connection you initiated. Disconnect, reconnect and try again. If needed on a training phone, revoke USB-debugging authorizations in Developer options and retry; record that change. An enterprise policy may block debugging entirely.


The USB engine will not load
The standard edition fetches pinned JavaScript from esm.sh after your explicit click. Check internet access, institutional filtering and the browser console. Do not disable browser security to work around a failed import. The optional offline build embeds dependencies locally. Practice mode needs no engine.


A command reports permission denied or an unavailable property
Keep the error in the report. Modern Android, OEM policy and work-profile restrictions can reduce visibility. Do not root or unlock a phone just to make this lab produce more data. Unknown or denied data is not a negative finding.


Copy fails or a download is blocked
Check the 64 MiB per-file limit, shell readability and the browser's download controls. Files may change or disappear during live collection. Copy APK splits individually. Symlinks and special file entries are deliberately blocked. An accessible APK is not a private-data acquisition.


Why does a new page request authorization again?
The page generates a temporary, per-session ADB private key and does not store it in localStorage or IndexedDB. Refreshing or clearing the session discards it. Browser USB permission and phone ADB authorization are separate; remove both as appropriate after the lab.


What this page does not establish
Normal authorized ADB access does not imply access to protected SMS stores, app-private databases, all work-profile data, deleted files, unallocated space or hardware-protected secrets. A reported patch, boot state or encryption property is not proof that a phone is malware-free. The app does not perform physical imaging, independently attest hardware, or implement automated signature-based malware detection.
Reports are intended for learning and triage. Use validated forensic tools and appropriate preservation procedures for real cases. Enable debugging only on approved training devices and document changes.
Implementation & privacy
Page build: 2026-09-05. Standard engine pins: Tango ADB 2.6.4, WebUSB transport 2.3.2, stream-extra 2.6.1. The main page, lessons, simulator, reports and hashing use local HTML/CSS/JavaScript. Real USB uses the linked Tango libraries under their MIT license. The standard edition downloads that code from esm.sh only after an explicit request; the CDN sees normal code-fetch metadata. The application code does not send collected device results to a server. External documentation links are voluntary navigations.
Device results, file bytes, notes and authentication keys are held in page memory. Downloads persist where the browser saves them. No analytics, service worker, account system, cloud storage, native bridge or automatic reconnection is included. Closing the page loses unsaved notes and results. Review and pin dependencies before deploying to a sensitive lab.
Validation boundary: synthetic workflow and browser-interface tests can be run without a handset. Successful real-device authentication and transfers still require validation against the classroom phone/browser/driver combination. Do not assume every OEM or Android release is supported.